Align Fastly staging store selectors with EdgeZero PR 381 by aram356 · Pull Request #1175 · IABTechLab/trusted-server

aram356 · 2026-09-16T07:58:59Z

Summary

Restore Fastly staging secret resolution by consuming the store-selection model from EdgeZero PR 381: a managed deployment links each physical store selected by a canonical EDGEZERO__STORES__<KIND>__<ID>__NAME deployment selector to the target version under its logical ID, and the runtime opens stores by that ID.
Open trusted_server_config and trusted_server_secrets by logical ID in the Fastly entry point and read the config entry under trusted_server_config for every target. The upstream branch removed runtime_env_config and the edgezero_runtime_env Config Store it read, and fixed the Fastly config key to the logical ID; staging isolation comes from the physical store the staging environment selects.
Expose the local Viceroy secret store under trusted_server_secrets and drop the edgezero_runtime_env selector store, so local runs exercise the same store-opening path as a deployed version.
Update operator guidance so production and staging select physical stores through their deployment environments and so ts deploy --adapter fastly passes a verified application release.
Watch only bundle inputs in the trusted-server-js build script. It previously emitted a rerun directive for every file under lib/, including node_modules, so any npm install invalidated the crate and Cargo re-checked 33,932 paths on every build.

The EdgeZero dependencies temporarily follow fix/fastly-environment-store-selectors and currently lock to 12c3215c2637d961a27eefa12e235033fadb4c4a. Replace the branch dependency with the release tag after the upstream PR merges.

Changes

File	Change
`Cargo.toml`, `Cargo.lock`	Select and lock the EdgeZero PR 381 branch head for every EdgeZero crate.
Fastly adapter `main.rs`, `app.rs`	Replace `RuntimeStoreConfig::from_env` with `logical()`: logical store IDs and the logical config key for every target. A unit test covers the bindings.
`fastly.toml`, Viceroy integration fixture, template-cache script	Rename the local secret store to `trusted_server_secrets`; remove the `edgezero_runtime_env` mapping.
Integration config test	Verify both Viceroy configurations expose the secret store under its logical ID and define no legacy selector store.
Fastly and CLI guides	Document deploy-time environment selectors, logical-ID resource links, the fixed logical config key, and the `--application-release` requirement for managed deploys.
Design and implementation plan	Record the root cause, the logical-ID runtime model, validation, and the release-tag follow-up.
`crates/trusted-server-js/build.rs`	Replace the recursive `lib/` walk with explicit `rerun-if-changed` directives for `lib/src`, the package manifests, and the bundler configuration. No-op `cargo check -p trusted-server-js` drops from 1.1s to 0.15s and the script emits 7 directives instead of 33,932.

Closes

Closes #1174

Test plan

Checklist

Changes follow AGENTS.md conventions
No unwrap() added in production code
No production logging changes
New behavior has a regression test
No secrets or credentials committed

Move the EdgeZero pin from 8efad3c8 to 657bfdcb. The branch head replaces the edgezero_runtime_env selector store with logical-ID resource links and removes runtime_env_config, so the Fastly entry point now opens trusted_server_config and trusted_server_secrets by logical ID and derives the config key from Fastly's staging signal through EdgeZero's target key rule. Expose the local Viceroy secret store under trusted_server_secrets, drop the runtime selector store from fastly.toml and the integration template, and regress that shape in the config test. Update the Fastly and CLI guides for deterministic config keys, logical-ID links, and the application release that managed deploys now require.

Move the EdgeZero pin from 657bfdcb to 74207863. Upstream fixed the Fastly config key to the logical store ID for production, staging, and local Viceroy alike, removing the `_staging` suffix and `store_key_for_target`. Staging isolation now comes only from the physical Config Store the staging environment selects. Replace `RuntimeStoreConfig::for_target(staging)` with `logical()`, drop the staging signal from both entry points, and update the CLI guide, spec, and plan to describe the fixed key.

The only upstream change since 74207863 hardens immutable release publication in the Fastly CLI deploy path. No public API or runtime contract changed, so this is a lockfile-only update.

The only upstream change since dbb95018 aligns the immutable release verifier with the complete set of adapter-manifest references in edgezero.toml. No public API or runtime contract changed, so this is a lockfile-only update.

The only upstream change since fba2076a scopes the Fastly release verifier and the config push preflight to the selected adapter. A Fastly config push no longer reads the Spin or Cloudflare manifests. No public API or runtime contract changed, so this is a lockfile-only update.

Upstream now parses the live Fastly resource-link types (`config`, `kv-store`, `secret-store`), documents the custom entry point migration, and moves the release verifier into edgezero-adapter, which adds serde, serde_json, sha2, and walkdir edges under its cli feature. No public API used by Trusted Server changed, so this is a lockfile-only update.

The two upstream commits since 4531aeec touch only the deploy action script and a demo lockfile. No crate source changed, so this is a lockfile-only update.

The two upstream commits since 7162b7e2 only reorganize the EdgeZero CI test workflows. No crate source changed, so this is a lockfile-only update.

Upstream replaces the Compute-unsupported version diff snapshot with per-collection reads and drops the parent service ID comparison from the staged-source guard and staging rollback. No public API used by Trusted Server changed, so this is a lockfile-only update.

The only upstream change since fd45db1f corrects the Google Pub/Sub logging snapshot path to the Fastly API's `logging/pubsub` and adds `logentries` to the swept endpoint kinds. No public API used by Trusted Server changed, so this is a lockfile-only update.

The only upstream change since 6258b6b2 switches the Fastly deploy to the current `service resource-link` and `service version` command spellings, removing the CLI deprecation notices. No public API used by Trusted Server changed, so this is a lockfile-only update.

# Conflicts: # crates/trusted-server-adapter-fastly/src/app.rs # crates/trusted-server-adapter-fastly/src/main.rs # crates/trusted-server-integration-tests/fixtures/configs/viceroy-template.toml # fastly.toml

The only crate change since bb4e0040 canonicalizes the Fastly configuration snapshot by sorting object keys before ordering rows, so the drift check no longer fails on Fastly's random JSON key order. No public API used by Trusted Server changed, so this is a lockfile-only update.

The only upstream commit since cf9a96a0 adds a Cargo target cache to EdgeZero's CI. No crate source changed, so this is a lockfile-only update.

The build script asked Cargo to rerun on every file under lib/, including node_modules, which emitted 33,932 rerun-if-changed directives in a 2.8 MB output that Cargo re-checked on every build and invalidated the crate after any npm install. Watch the TypeScript sources, package manifests, and bundler configuration explicitly instead. Measured on an Apple Silicon host with a warm cache: a no-op `cargo check -p trusted-server-js` drops from 1.1s to 0.15s, the script emits 7 directives, touching a node_modules file no longer reruns it, and touching lib/src or package-lock.json still does.

The only upstream commit since 119fbf80 fixes a shellcheck finding in EdgeZero's CI cache action. No crate source changed, so this is a lockfile-only update.

ChristianPavilonis

Review summary

Reviewed ae47b43 against 6cae7f5. The logical-store runtime path passes local validation. No runtime correctness or security findings were confirmed. One P2 deployment-documentation finding is posted inline.

Validation

cargo test-fastly --locked runtime_store_config_opens_logical_store_ids_and_key: 1 passed.
cargo test --locked --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test integration local_fastly --target x86_64-unknown-linux-gnu: 3 passed.
cargo test-fastly --locked config_payload::tests::: 21 passed.
cargo test-fastly --locked secret_resolution::tests::: 8 passed.
cargo test --locked -p trusted-server-cli --target x86_64-unknown-linux-gnu run::tests::: 29 passed.
BID_DELAY=3 ./scripts/template-cache-local-test.sh inline: 8 assertions passed, exercising CLI-published configuration and logical secret bindings through Viceroy.
cd crates/trusted-server-js/lib && npm test -- --run: 959 passed, no type errors.
cargo fmt --all -- --check and bash -n scripts/template-cache-local-test.sh: passed.

CI was green. Existing reviews, inline comments, issue comments, and review threads were empty when inspected.

Residual risk: live Fastly link reconciliation and staging isolation were traced through pinned EdgeZero revision 5878eb740897749e4cfab7b410fa28791a371602 but not exercised against Fastly. JS filesystem-invalidation behavior was inspected but not mutation-tested. The worktree remained clean; no source edits or delegation.

prk-Jr

Summary

Reviewed commit ae47b4350b0297be935f258c9e9d81d22426bf4c.

The logical store bindings match the pinned EdgeZero deployment model, and the JS watch list retains the inspected bundle inputs. The existing P2 documentation finding remains: both new deployment commands select the checkout manifest unless EDGEZERO_MANIFEST is set.

Blocking

🔧 Select the release manifest in both deployment examples — see inline at docs/guide/cli.md:128–129 (one-click suggestion). This confirms the existing unresolved finding and covers both commands.

Validation

The exact locked dependency's path-resolution helper was independently compiled and exercised: a checkout manifest outside the release root was rejected; the release's own manifest was accepted. The exact documentation suggestion passes full docs formatting with no patch drift. Shell syntax and diff whitespace checks pass. Scratch edits were restored.

Live Fastly staging/resource-link reconciliation and a complete deployment were not exercised. Runtime gates rely on passing remote CI.

CI Status

integration tests: PASS
integration tests (Fastly EC lifecycle): PASS
browser integration tests: PASS
CodeQL: PASS
Analyze (actions): PASS
cargo test (ts CLI, native): PASS
cargo test: PASS (required)
Analyze (rust): PASS
Analyze (javascript-typescript): PASS
cargo test (axum native): PASS
cargo fmt: PASS (required)
format-typescript: PASS (required)
cargo check (cloudflare native + wasm32-unknown-unknown): PASS
format-docs: PASS (required)
cargo check/build/test (spin native + wasm32-wasip1): PASS
cargo test (cross-adapter parity): PASS
CLAUDE.md symlink guard: PASS
vitest: PASS
prepare integration artifacts: PASS
Analyze (javascript-typescript): PASS

`ts deploy --application-release` does not choose the release's manifest. The CLI loads `edgezero.toml` from the working directory unless `EDGEZERO_MANIFEST` names another file, and it rejects a manifest outside the release root, so both documented commands failed from the checkout root with "loaded application manifest ... is outside application release root" before reaching Fastly. Set `EDGEZERO_MANIFEST` to the release's manifest in both examples, as the EdgeZero deploy action does, and say where the release root comes from.

Upstream merged main into the branch, which renames the staged-deploy identifiers to the staging naming. Trusted Server references none of the renamed variants, so this is a lockfile-only update.

aram356 added 6 commits September 16, 2026 00:26

Document EdgeZero store selector alignment

98247d6

Plan EdgeZero store selector alignment

ca5b4d4

Use canonical Fastly secret store selectors

fbeb195

Consume canonical EdgeZero deployment selectors

f2b1b39

Document deploy-time Fastly store selection

3416b71

Merge branch 'main' into fix/align-edgezero-pr-381

76bc65d

aram356 self-assigned this Sep 16, 2026

aram356 added this to the 202609 milestone Sep 16, 2026

aram356 marked this pull request as draft September 16, 2026 16:30

aram356 added 3 commits September 17, 2026 13:05

Move the EdgeZero pin to the PR 381 branch head dbb95018

86a3df8

The only upstream change since 74207863 hardens immutable release publication in the Fastly CLI deploy path. No public API or runtime contract changed, so this is a lockfile-only update.

This was referenced Sep 18, 2026

Fix staging and prod deployment stackpop/edgezero#381

Open

Bind Fastly stores selected by each deployment environment stackpop/edgezero#380

Open

aram356 added 8 commits September 18, 2026 10:57

Move the EdgeZero pin to the PR 381 branch head fba2076a

2c43347

The only upstream change since dbb95018 aligns the immutable release verifier with the complete set of adapter-manifest references in edgezero.toml. No public API or runtime contract changed, so this is a lockfile-only update.

Move the EdgeZero pin to the PR 381 branch head 7162b7e2

3c9d8c0

The two upstream commits since 4531aeec touch only the deploy action script and a demo lockfile. No crate source changed, so this is a lockfile-only update.

Move the EdgeZero pin to the PR 381 branch head 8b506782

9226cfb

The two upstream commits since 7162b7e2 only reorganize the EdgeZero CI test workflows. No crate source changed, so this is a lockfile-only update.

aram356 mentioned this pull request Sep 19, 2026

September release candidate (DO NOT MERGE) #1112

Draft

aram356 added a commit that referenced this pull request Sep 19, 2026

Merge updated PR #1175 into rc/202609

2e16309

aram356 mentioned this pull request Sep 19, 2026

Align Fastly staging store selectors with EdgeZero PR 381 #1174

Open

aram356 added 3 commits September 18, 2026 18:41

Move the EdgeZero pin to the PR 381 branch head 119fbf80

4295039

The only upstream commit since cf9a96a0 adds a Cargo target cache to EdgeZero's CI. No crate source changed, so this is a lockfile-only update.

Move the EdgeZero pin to the PR 381 branch head 5878eb74

ae47b43

The only upstream commit since 119fbf80 fixes a shellcheck finding in EdgeZero's CI cache action. No crate source changed, so this is a lockfile-only update.

aram356 added a commit that referenced this pull request Sep 19, 2026

Merge updated PR #1175 into rc/202609

76ef421

ChristianPavilonis approved these changes Sep 19, 2026

View reviewed changes

Comment thread docs/guide/cli.md Outdated

aram356 requested a review from prk-Jr September 19, 2026 05:31

aram356 marked this pull request as ready for review September 19, 2026 05:31

prk-Jr requested changes Sep 19, 2026

View reviewed changes

Comment thread docs/guide/cli.md Outdated

aram356 requested a review from prk-Jr September 20, 2026 07:32

Move the EdgeZero pin to the PR 381 branch head 12c3215c

d6fecdf

Upstream merged main into the branch, which renames the staged-deploy identifiers to the staging naming. Trusted Server references none of the renamed variants, so this is a lockfile-only update.

Navigation Menu

Align Fastly staging store selectors with EdgeZero PR 381 - #1175

Align Fastly staging store selectors with EdgeZero PR 381#1175
aram356 wants to merge 23 commits into
mainfrom
fix/align-edgezero-pr-381

aram356 commented Sep 16, 2026 •

edited

Loading

Uh oh!

ChristianPavilonis left a comment

Uh oh!

Uh oh!

prk-Jr left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aram356 commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Closes

Test plan

Checklist

Uh oh!

ChristianPavilonis left a comment

Choose a reason for hiding this comment

Review summary

Validation

Uh oh!

Uh oh!

prk-Jr left a comment

Choose a reason for hiding this comment

Summary

Blocking

Validation

CI Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aram356 commented Sep 16, 2026 •

edited

Loading