feat: plain compose with shared fragments, a shared backup service, the secret store's host side, and the chart, tags and people retired

.github/workflows/deploy.yml

@@ -4,12 +4,11 @@ on:
   push:
     branches: [main]
     paths:
-      - charts/core/**
       - deploy/**
       - edge/**
       - host/**
       - projects/**
-      - tags/**
+      - shared/**
   workflow_dispatch:
     inputs:
       project:
@@ -36,8 +35,6 @@ jobs:
   plan:
     name: Plan
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     outputs:
       pages: ${{ steps.plan.outputs.pages }}
     steps:
@@ -48,7 +45,6 @@ jobs:
         with:
           python-version: "3.14"
       - run: pip install pyyaml
-      - run: python scripts/deploy.py release-core
       - id: plan
         run: python scripts/deploy.py plan | tee -a "$GITHUB_OUTPUT"
 
@@ -66,9 +62,6 @@ jobs:
         with:
           python-version: "3.14"
       - run: pip install pyyaml
-      - uses: azure/setup-helm@v5
-        with:
-          version: v3.22.0
       - run: python scripts/deploy.py apply
         env:
           DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

.github/workflows/pr.yml

@@ -16,25 +16,28 @@ jobs:
         with:
           python-version: "3.14"
       - run: pip install pyyaml jsonschema
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          client-id: ${{ secrets.PLATFORM_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PLATFORM_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
       - run: python scripts/validate.py
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
   deploy:
     name: Deploy values
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
       - uses: actions/setup-python@v7
         with:
           python-version: "3.14"
       - run: pip install pyyaml
-      - uses: azure/setup-helm@v5
-        with:
-          version: v3.22.0
       - run: python scripts/deploy.py check
-        env:
-          BASE_REF: ${{ github.base_ref }}
+      - run: python scripts/check-memory.py
+      - run: python scripts/check-values.py
 
   secrets:
     name: Secrets

.github/workflows/sync-registry.yml

@@ -4,6 +4,8 @@ on:
   workflow_dispatch:
   repository_dispatch:
     types: [sync-registry]
+  schedule:
+    - cron: "17 * * * *"
 
 concurrency:
   group: sync-registry
@@ -44,14 +46,9 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: python scripts/sync.py
 
-      - name: Sync people from GitHub profiles
-        id: people
-        continue-on-error: true
+      - run: python scripts/validate.py
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: python scripts/people.py
-
-      - run: python scripts/validate.py
 
       - name: Open registry update
         env:
@@ -60,7 +57,7 @@ jobs:
           WORKFLOW_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          git add projects people
+          git add projects
           if git diff --cached --quiet; then
             echo "Registry already current."
             exit 0
@@ -99,9 +96,9 @@ jobs:
           fi
 
           file_count="$(gh pr view "$pr" --json files --jq '.files | length')"
-          invalid_paths="$(gh pr view "$pr" --json files --jq '[.files[].path | select(test("^(projects|people)/[^/]+\\.yml$") | not)] | join(", ")')"
+          invalid_paths="$(gh pr view "$pr" --json files --jq '[.files[].path | select(test("^projects/[^/]+\\.yml$") | not)] | join(", ")')"
           if [ "$file_count" -eq 0 ] || [ -n "$invalid_paths" ]; then
-            echo "::error::Registry PR #${pr} changes files outside projects/*.yml and people/*.yml: ${invalid_paths}"
+            echo "::error::Registry PR #${pr} changes files outside projects/*.yml: ${invalid_paths}"
             exit 1
           fi
 
@@ -129,7 +126,7 @@ jobs:
           gh pr merge "$pr" --squash --delete-branch --match-head-commit "$head_sha"
 
       - name: Report skipped manifests
-        if: steps.sync.outcome == 'failure' || steps.people.outcome == 'failure'
+        if: steps.sync.outcome == 'failure'
         run: |
-          echo "::error::The sync skipped invalid repository manifests or could not read GitHub profiles; see the Sync repository manifests and Sync people steps."
+          echo "::error::The sync skipped invalid repository manifests; see the Sync repository manifests step."
           exit 1

.gitignore

@@ -1,2 +1 @@
 __pycache__/
-registry.json