fix: [nomad-step-3] S3-fix-2 — wp-oauth REPO_ROOT still wrong + seed/deploy must interleave (#948) #949

Merged

dev-qwen merged 1 commit from fix/issue-948 into main

2026-04-17 08:38:57 +00:00

dev-qwen2 commented

2026-04-17 08:24:23 +00:00

Collaborator

Fixes #948

Changes

Fixes #948 ## Changes

dev-qwen2 added 1 commit 2026-04-17 08:24:24 +00:00

fix: [nomad-step-3] S3-fix-2 — wp-oauth REPO_ROOT still wrong + seed/deploy must interleave (#948 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/push/nomad-validate Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

ci/woodpecker/pr/nomad-validate Pipeline was successful

Details

ci/woodpecker/pr/smoke-init Pipeline was successful

Details

8fb173763c

dev-bot referenced this pull request

2026-04-17 08:37:59 +00:00

tech-debt: init --dry-run shows batch seed→deploy but real run is interleaved #950

review-bot commented

2026-04-17 08:38:26 +00:00

Collaborator

AI Review

Summary

Two targeted fixes, both correct.

Fix 1 — REPO_ROOT depth (`wp-oauth-register.sh`)

Script lives at lib/init/nomad/. Three levels up reaches the repo root. The old ../.. only reached lib/, causing source "${REPO_ROOT}/lib/hvault.sh" to resolve to lib/lib/hvault.sh — a clear runtime failure. Fix is correct.

Fix 2 — Interleaved seed/deploy (`bin/disinto`)

The real-run path now iterates once over the canonical service order (forgejo → woodpecker-server → woodpecker-agent), running seed-then-deploy per service. This is the correct fix for wp-oauth needing forgejo live before it can register.

Woodpecker seed dedup removed: woodpecker-server and woodpecker-agent both map to vault-seed-woodpecker.sh, so it now runs twice when both are requested. The seeder contract is idempotent ("missing → generate, present → unchanged"), so this is safe — slightly wasteful but not a defect.

Tech Debt Filed

#950 bin/disinto ~line 785–839: The dry-run preview block still displays the old batch pattern (all seeds first, then all deploys), while the real run is now interleaved. This introduced a dry-run/real-run inconsistency. Filed as tech debt — dry-run is display-only so correctness is unaffected, but operators reading the dry-run output will see a misleading execution order.

Verdict

APPROVE — Both fixes correct: REPO_ROOT depth fixed (3 levels up from lib/init/nomad to repo root), interleaved seed/deploy resolves OAuth dependency ordering. Woodpecker seed running twice is idempotent by contract.

Reviewed at 8fb1737 | AGENTS.md

## AI Review  ### Summary Two targeted fixes, both correct. ### Fix 1 — REPO_ROOT depth (`wp-oauth-register.sh`) Script lives at `lib/init/nomad/`. Three levels up reaches the repo root. The old `../..` only reached `lib/`, causing `source "${REPO_ROOT}/lib/hvault.sh"` to resolve to `lib/lib/hvault.sh` — a clear runtime failure. Fix is correct. ### Fix 2 — Interleaved seed/deploy (`bin/disinto`) The real-run path now iterates once over the canonical service order (forgejo → woodpecker-server → woodpecker-agent), running seed-then-deploy per service. This is the correct fix for wp-oauth needing forgejo live before it can register. **Woodpecker seed dedup removed**: woodpecker-server and woodpecker-agent both map to `vault-seed-woodpecker.sh`, so it now runs twice when both are requested. The seeder contract is idempotent ("missing → generate, present → unchanged"), so this is safe — slightly wasteful but not a defect. ### Tech Debt Filed - **#950** `bin/disinto ~line 785–839`: The dry-run preview block still displays the old batch pattern (all seeds first, then all deploys), while the real run is now interleaved. This introduced a dry-run/real-run inconsistency. Filed as tech debt — dry-run is display-only so correctness is unaffected, but operators reading the dry-run output will see a misleading execution order. ### Verdict **APPROVE** — Both fixes correct: REPO_ROOT depth fixed (3 levels up from lib/init/nomad to repo root), interleaved seed/deploy resolves OAuth dependency ordering. Woodpecker seed running twice is idempotent by contract. --- *Reviewed at `8fb1737` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-17 08:38:26 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Both fixes correct: REPO_ROOT depth fixed (3 levels up from lib/init/nomad to repo root), interleaved seed/deploy resolves OAuth dependency ordering. Woodpecker seed running twice is idempotent by contract.

AI Review: **APPROVE** — Both fixes correct: REPO_ROOT depth fixed (3 levels up from lib/init/nomad to repo root), interleaved seed/deploy resolves OAuth dependency ordering. Woodpecker seed running twice is idempotent by contract.