Wpb 23988 disable smallstep

[mohitrajain]

Fixed: stop deploying smallstep in wiab-staging and wiab-dev environments

Change type

• Fix
• Feature
• Documentation
• Security / Upgrade

Basic information

• THIS CHANGE REQUIRES A DEPLOYMENT PACKAGE RELEASE
• THIS CHANGE REQUIRES A WIRE-DOCS RELEASE

Testing

• I ran/applied the changes myself, in a test environment.
• The CI job attached to this repo will test it for me.

Offline Build CI (label-based)

Add one or more labels to trigger offline builds:

• build-default - Full production build (ansible, terraform, all packages)
• build-demo - Demo/WIAB build
• build-wiab-staging - WIAB-staging build
• build-min - Minimal build (fastest, essential charts only)
• build-all - Run all three builds

Note: No builds run by default. Add a label to trigger CI.

Tracking

• I added a new entry in an appropriate subdirectory of changelog.d
• I mentioned this PR in Jira, OR I mentioned the Jira ticket in this PR.
• I mentioned this PR in one of the issues attached to one of our repositories.

Knowledge Transfer

• An Asciinema session is attached to the Jira ticket.

Motivation

Objective

Reason

Use case

[Copilot]

Pull request overview

Disables deployment of the smallstep-accomp Helm chart in WIAB-related flows, aligning deployment automation and WIAB staging documentation with the intent to no longer include smallstep in those environments.

Changes:

• Remove smallstep-accomp from bin/helm-operations.sh chart processing and deployment order.
• Update WIAB staging documentation to no longer list or link smallstep-accomp.
• Remove smallstep-accomp from the demo Ansible inventory chart deployment list.
• Add a changelog entry documenting the change.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
offline/wiab-staging.md	Updates WIAB staging docs to exclude smallstep-accomp from deployed charts and further-reading links.
bin/helm-operations.sh	Stops preparing values for and deploying the smallstep-accomp chart.
ansible/inventory/demo/host.yml	Removes smallstep-accomp from charts_to_deploy.
changelog.d/3-deploy-builds/disable-smallstep	Adds release note about disabling smallstep deployments in WIAB environments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[arthurwolf]

why the change from demo-smtp to smtp ? is that related to the smallstep stuff or should it be done separately?

[mohitrajain]

this was an old typo, which i found and I fixed it in the documentation.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

With the new push trigger enabled, the workflow will now run on merge commits and other pushes. The script’s push path currently diffs against HEAD~1, which can miss changes when a push contains multiple commits; use github.event.before (or otherwise diff ${{ github.sha }} against the correct base) to cover the full push range. Also consider whether develop should be included here for consistency with other workflows that run on push to master, develop.

[Copilot]

This list implies cert-manager is always deployed, but bin/helm-operations.sh only installs it when DEPLOY_CERT_MANAGER=TRUE (and docs above mention disabling it). Consider marking cert-manager/nginx-ingress-services as conditional in this list to avoid confusing users. Also there’s a missing space after the comma between rabbitmq-external and postgresql-external in the same line.

Suggested change

	- External datastores and helpers: `cassandra-external`, `elasticsearch-external`, `minio-external`, `rabbitmq-external`,`postgresql-external`, `databases-ephemeral`, `reaper`, `fake-aws`, `smtp`.
	- Wire services: `wire-server`, `webapp`, `account-pages`, `team-settings`.
	- Ingress and certificates: `ingress-nginx-controller`, `cert-manager`, `nginx-ingress-services`.
	- External datastores and helpers: `cassandra-external`, `elasticsearch-external`, `minio-external`, `rabbitmq-external`, `postgresql-external`, `databases-ephemeral`, `reaper`, `fake-aws`, `smtp`.
	- Wire services: `wire-server`, `webapp`, `account-pages`, `team-settings`.
	- Ingress and certificates (conditional on `DEPLOY_CERT_MANAGER=TRUE`): `ingress-nginx-controller`, `cert-manager`, `nginx-ingress-services`.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The changelog entry says “smallstep”, but the actual component removed from deployments/docs appears to be the smallstep-accomp chart. Please update the entry to use the precise chart/component name to avoid ambiguity.

Suggested change

	Fixed: stop deploying smallstep in wiab-staging and wiab-dev environments
	Fixed: stop deploying the smallstep-accomp chart in wiab-staging and wiab-dev environments

[Copilot]

Now that this workflow also runs on push to master, the push-event diff base should use github.event.before (the pre-push SHA) instead of git rev-parse HEAD~1. Using HEAD~1 can miss changelog changes when a push contains multiple commits, causing false failures/successes.

[julialongtin]

how is this change related?

[mohitrajain]

no, not related but it is part of chained changes in chained PRs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud