26422042659
95%

Ran 25 May 2026 10:26PM UTC

Jobs 1

Files 77

Run time 1min

Badge

Embed ▾

Committed 25 May 2026 10:21PM UTC coverage: 95.85% (-0.008%) from 95.858%

Build # 26422042659

Build Type

push

github

Committed by

web-flow

Commit Message

fix(deploy): require peer mTLS or explicit opt-in for HA Helm deployments (#452)

The chart defaulted HA drivers (openraft/paxos) to tls.enabled=false, which
binds the consensus peer port to 0.0.0.0 and publishes it through the headless
Service while the peer transport falls back to plaintext when no peer TLS is
supplied. Any pod on the cluster network could then send unauthenticated
raft/paxos RPCs, threatening leadership, quorum, and timestamp ordering.

- _helpers.tpl: render-time guard fails openraft/paxos when tls.enabled=false
  unless tls.allowInsecurePeer=true is set explicitly.
- networkpolicy.yaml: new NetworkPolicy (networkPolicy.enabled, default true)
  restricts the peer port to sibling replicas; the client port stays open.
- NOTES.txt: warn when plaintext consensus is active.
- render.sh: cover the new guard and NetworkPolicy invariants.

Coverage Stats

11270 of 11758 relevant lines covered (95.85%)

437830.77 hits per line

Coverage Regressions

Lines	Coverage	∆	File
1	96.14	-0.18%	crates/tsoracle-client/src/driver.rs

Jobs

ID	Job ID	Ran	Files	Coverage
1	26422042659.1	25 May 2026 10:26PM UTC	77	95.85	GitHub Action Run

prisma-risk / tsoracle / 26422042659
95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 26422042659

prisma-risk / tsoracle / 26422042659 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 26422042659

prisma-risk / tsoracle / 26422042659
95%

README BADGES
x