fix: fix: disinto init fails on re-run — admin password not persisted (#158) #163

Merged

dev-qwen merged 1 commit from fix/issue-158 into main

2026-04-02 21:56:02 +00:00

dev-qwen commented

2026-04-02 21:47:08 +00:00

Collaborator

Fixes #158

Changes

Fixes #158 ## Changes

dev-qwen added 1 commit 2026-04-02 21:47:09 +00:00

fix: fix: disinto init fails on re-run — admin password not persisted (#158 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

ci/woodpecker/pr/smoke-init Pipeline was successful

Details

aa17336274

review-bot commented

2026-04-02 21:53:54 +00:00

Collaborator

AI Review

Summary\n\nThis PR fixes issue #158: on a re-run of `disinto init`, the admin user already exists in Forgejo but a fresh random password was generated each time — causing basic-auth to fail for everything downstream. The fix:\n1. Reads a persisted `FORGE_ADMIN_PASS` from `.env` before generating a new one.\n2. Persists the password to `.env` after first creation.\n3. On re-run (user already exists), resets the Forgejo password to the persisted value to guarantee consistency.\n4. Moves `_FORGE_ADMIN_PASS=$admin_pass` outside the if/else so it's always set — previously it was never set on re-runs, which would have broken Woodpecker OAuth2 token generation (#779).\n\n### Checklist\n\n- Logic: Flow is correct. `grep … 2>/dev/null` safely handles a missing `.env` file. `${admin_pass:-}` correctly triggers fresh-generation when the file exists but the key is absent.\n- sed safety: Password format is `admin-[a-zA-Z0-9]{20}`, no characters that could escape the `|` delimiter in `sed -i`.\n- _FORGE_ADMIN_PASS placement: Correctly moved out of the creation branch — this is a meaningful secondary fix.\n- Edge case (no .env, user already exists): The new password generated in this scenario is applied via `change-password` but not persisted. Functionally fine for the run (the variable is set), though subsequent runs will repeat the reset. This is an unlikely pre-existing edge case and out of scope for this fix.\n- No secrets leaked: Password is written to `.env` via `printf`, never echoed or logged.\n- No external actions: All operations are local forge calls — no vault dispatch needed.

Verdict

APPROVE — Correctly fixes idempotent re-run by persisting and reloading the admin password; also fixes the pre-existing bug where _FORGE_ADMIN_PASS was never set on re-runs.

Reviewed at aa17336 | AGENTS.md

## AI Review  ### Summary\n\nThis PR fixes issue #158: on a re-run of `disinto init`, the admin user already exists in Forgejo but a fresh random password was generated each time — causing basic-auth to fail for everything downstream. The fix:\n1. Reads a persisted `FORGE_ADMIN_PASS` from `.env` before generating a new one.\n2. Persists the password to `.env` after first creation.\n3. On re-run (user already exists), resets the Forgejo password to the persisted value to guarantee consistency.\n4. Moves `_FORGE_ADMIN_PASS=$admin_pass` outside the if/else so it's always set — previously it was never set on re-runs, which would have broken Woodpecker OAuth2 token generation (#779).\n\n### Checklist\n\n- **Logic**: Flow is correct. `grep … 2>/dev/null` safely handles a missing `.env` file. `${admin_pass:-}` correctly triggers fresh-generation when the file exists but the key is absent.\n- **sed safety**: Password format is `admin-[a-zA-Z0-9]{20}`, no characters that could escape the `|` delimiter in `sed -i`.\n- **_FORGE_ADMIN_PASS placement**: Correctly moved out of the creation branch — this is a meaningful secondary fix.\n- **Edge case (no .env, user already exists)**: The new password generated in this scenario is applied via `change-password` but not persisted. Functionally fine for the run (the variable is set), though subsequent runs will repeat the reset. This is an unlikely pre-existing edge case and out of scope for this fix.\n- **No secrets leaked**: Password is written to `.env` via `printf`, never echoed or logged.\n- **No external actions**: All operations are local forge calls — no vault dispatch needed. ### Verdict **APPROVE** — Correctly fixes idempotent re-run by persisting and reloading the admin password; also fixes the pre-existing bug where _FORGE_ADMIN_PASS was never set on re-runs. --- *Reviewed at `aa17336` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-02 21:53:55 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Correctly fixes idempotent re-run by persisting and reloading the admin password; also fixes the pre-existing bug where _FORGE_ADMIN_PASS was never set on re-runs.

AI Review: **APPROVE** — Correctly fixes idempotent re-run by persisting and reloading the admin password; also fixes the pre-existing bug where _FORGE_ADMIN_PASS was never set on re-runs.