Skip to content

docs: security, architecture, and CI/CD updates - #6

Merged
VikramChennai merged 1 commit into
mainfrom
docs/security-arch-cicd-updates
May 1, 2026
Merged

VikramChennai merged 1 commit into
mainfrom
docs/security-arch-cicd-updates

Conversation

@VikramChennai

@VikramChennai VikramChennai commented May 1, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Security: minimal production footprint (replaces incorrect read-only claim), encryption and secrets consolidated, BYOC framing for secret residency, control plane language
  • Architecture: branch storage described as shared via copy-on-write for compute + storage efficiency at scale
  • CI/CD: full validated GitHub Actions workflow with Claude snippet, deterministic project/connector selection, comparison section rewritten around full production data and efficiency
  • Sidebar: Examples renamed to Workflows
  • Added .gitignore for node_modules

Test plan

Made with Cursor


Note

Low Risk
Low risk: documentation-only updates and a .gitignore tweak; no runtime code paths are changed.

Overview
Updates docs to clarify Ardent’s split-plane model (adds Branch proxy, BYOC/residency framing, and copy-on-write shared branch storage) and revises security claims to describe the minimal production footprint plus secrets/encryption handling.

Revamps the landing page “Get started” section to point to Quickstart and provide an AI-guided setup prompt, and expands the CI/CD guide with a more complete GitHub Actions workflow (token-based login, explicit project/connector selection, unique branch naming, and guaranteed cleanup) plus updated rationale vs shared staging.

Adds .gitignore entry for node_modules/.

Reviewed by Cursor Bugbot for commit d1ed765. Bugbot is set up for automated code reviews on this repo. Configure here.

- Security: minimal production footprint (not read-only), encryption and secrets section, BYOC framing, control plane language
- Architecture: shared storage via copy-on-write for efficient scale
- CI/CD: full validated workflow, Claude snippet, deterministic project/connector, compared-to section with production data and efficiency
- Sidebar: Examples renamed to Workflows
- Added .gitignore for node_modules

Co-authored-by: Cursor <cursoragent@cursor.com>
@VikramChennai
VikramChennai merged commit d56a34e into main May 1, 2026
3 checks passed

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit d1ed765. Configure here.

Comment thread workflows/ci-cd.mdx

- name: Delete database branch
if: always()
run: ardent branch delete "$ARDENT_BRANCH"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Branch cleanup fragile due to env var ordering

Low Severity

The ARDENT_BRANCH write to GITHUB_ENV (line 117) comes after the DATABASE_URL extraction (line 116). If the ardent branch info pipeline fails and the step exits early (particularly when shell: bash enables pipefail), the branch is created but ARDENT_BRANCH is never set, so the if: always() cleanup step runs ardent branch delete "" and the branch is orphaned. Writing ARDENT_BRANCH immediately after ardent branch create would ensure cleanup always works.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit d1ed765. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant