Skip to content
loomster

Turn on scheduled Ops

llms.txt lists every page for a coding agent.

Optional: hand this page to your coding agentThe steps work by hand too.
Show the prompt
Read https://intentius.io/loomster/guides/turn-on-scheduled-ops/ and list, for the person's repository, which scheduled workflows are on (`gh variable list`) and what each still needs.
Don't set variables, environments or secrets; tell the person the commands.
Never run `chant approve` or `just grant`, never deploy to or delete from a real AWS account unless the person asked for that in this session, never register an identity provider in Loom, and never push or edit the `chant/lifecycle` branch.

Result

Section titled “Result”

The ungated Ops running on cron in GitHub Actions. The gated ones (upgrade, rotation, restore, teardown) are never scheduled; a person runs and approves them.

Prerequisites

Section titled “Prerequisites”

The repository on GitHub, and for the workflows that touch AWS a GitHub environment named production with the account’s credentials (the same one deploy.yml uses).

Steps

Section titled “Steps”

  1. Pick the workflows and set their variables:

    WorkflowRunsCronSetAlso needs
    watch.ymlloom-watchevery 15 minutesSCHEDULED_WATCH=trueproduction environment
    reconcile.ymlloom-reconcilehourlySCHEDULED_RECONCILE=true, and LOOM_TIER set to a production tierproduction environment
    backup.ymlloom-backupdailySCHEDULED_BACKUP=trueproduction environment; LOOM_DR_REGION, LOOM_DR_KMS_KEY_ID for a DR copy
    restore-drill.ymlloom-restore-drillmonthlySCHEDULED_RESTORE_DRILL=trueproduction environment
    cost-report.ymlsynth and estimate-costweeklySCHEDULED_COST_REPORT=trueinfracost and an INFRACOST_CLI_AUTHENTICATION_TOKEN secret for real numbers
    audit.ymlloom-auditdailySCHEDULED_AUDIT=truenothing

    For example:

    gh variable set SCHEDULED_BACKUP --body true
    gh variable set LOOM_TIER --body production
    gh variable set LOOM_ENV --body prod

    The workflows read LOOM_ENV and LOOM_TIER repository variables for the deployment they act on (dev and light when unset).

  2. Run one by hand to check it: every workflow has workflow_dispatch, so gh workflow run backup.yml starts it now.

reconcile.yml opens pull requests with the default GITHUB_TOKEN; its contents: write and pull-requests: write permissions are already declared. watch.yml and reconcile.yml write their run records to the chant/lifecycle branch, which CI pushes (Gated Ops). On GitLab the same Ops run as schedule-only jobs in .gitlab-ci.yml, each behind its own variable.

Next

Section titled “Next”

Watch and reconcile drift and Back up and restore.