docs: the Coder workspace is the normal case, so tea runs without op #29

2026-09-18T13:22:19+02:00

jlab-bot commented

2026-09-18 13:22:19 +02:00

Follow-up to #27.

Work on this repo happens in a Coder workspace, and it has no op. The rule that tea may only be called as op plugin run -- tea therefore described an environment that no longer exists here — and following it meant either waiting for a tool that is not coming, or ending with a pushed branch and no PR.

tea is called directly. It carries the workspace's stored login, so what it opens is authored by the bot account — accepted, and named in the report when it happens. The older instruction is kept for machines that do have op.
Signing needed the same correction. It runs through the workspace's own SSH signer (gpg.format = ssh, gpg.ssh.program = coder-git-ssh-sign), not op-ssh-sign, and the check is git log --format='%G?' -1 printing G. The requirement itself is unchanged: branch protection rejects unsigned commits on main.

The wiki is updated in the same round of work, as #27 now requires: Forge-and-Tooling, Workflow and Local-Development all said the same thing and would otherwise have kept saying it.

Follow-up to #27. Work on this repo happens in a **Coder workspace, and it has no `op`**. The rule that `tea` may only be called as `op plugin run -- tea` therefore described an environment that no longer exists here — and following it meant either waiting for a tool that is not coming, or ending with a pushed branch and no PR. - **`tea` is called directly.** It carries the workspace's stored login, so what it opens is authored by the **bot account** — accepted, and named in the report when it happens. The older instruction is kept for machines that do have `op`. - **Signing needed the same correction.** It runs through the workspace's own SSH signer (`gpg.format = ssh`, `gpg.ssh.program = coder-git-ssh-sign`), not `op-ssh-sign`, and the check is `git log --format='%G?' -1` printing `G`. The requirement itself is unchanged: branch protection rejects unsigned commits on `main`. The wiki is updated in the same round of work, as #27 now requires: `Forge-and-Tooling`, `Workflow` and `Local-Development` all said the same thing and would otherwise have kept saying it.

jlab-bot added 1 commit 2026-09-18 13:22:19 +02:00

docs: the Coder workspace is the normal case, so tea runs without op

Validate Helm Charts / Detect changed charts (pull_request) Successful in 3s

Details

Validate Helm Charts / Build ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }} (pull_request) Skipped

Details

Validate Helm Charts / Trivy config ${{ fromJSON(needs.detect-changed-charts.outputs.scan-charts) }} (pull_request) Skipped

Details

Validate Helm Charts / Install-test ${{ fromJSON(needs.detect-changed-charts.outputs.install-charts) }} (pull_request) Skipped

Details

Validate Helm Charts / Resource quantities (pull_request) Successful in 7s

Details

5b13569948

Work on this repo happens in a Coder workspace that has no 1Password CLI.
The rule that tea may only be called as 'op plugin run -- tea' therefore
described an environment that no longer exists here, and following it meant
either waiting for a tool that is not coming or ending with a pushed branch
and no PR.

tea is now called directly. It carries the workspace's stored login, so what
it opens is authored by the bot account - accepted, and named in the report
when it happens. The older instruction is kept for machines that do have op.

Signing needed the same correction: it runs through the workspace's own SSH
signer, not op-ssh-sign, and the check is 'git log --format=%G?' printing G.

jklein approved these changes

2026-09-18 15:34:13 +02:00

jklein merged commit 5b13569948 into main

2026-09-18 15:34:17 +02:00

jklein deleted branch docs/coder-workspace-tooling

2026-09-18 15:34:17 +02:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: jlab-cluster/helm-charts#29