0b994d5d6f
All checks were successful
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/nomad-validate Pipeline was successful
ci/woodpecker/pr/ci Pipeline was successful
ci/woodpecker/pr/nomad-validate Pipeline was successful
ci/woodpecker/pr/secret-scan Pipeline was successful
ci/woodpecker/pr/smoke-init Pipeline was successful
Post-Step-2 verification on a fresh LXC uncovered 4 stacked bugs blocking the `disinto init --backend=nomad --import-env ... --with forgejo` hero command. Root cause is #1; #2-#4 surface as the operator walks past each. 1. kv/ secret engine never enabled — every policy, role, import write, and template read references kv/disinto/* and 403s without the mount. Adds lib/init/nomad/vault-engines.sh (idempotent POST sys/mounts/kv) wired into `_disinto_init_nomad` before vault-apply-policies.sh. 2. VAULT_ADDR/VAULT_TOKEN not exported in the init process. Extracts the 5-line default-and-resolve block into `_hvault_default_env` in lib/hvault.sh and sources it from vault-engines.sh, vault-nomad-auth.sh, vault-apply-policies.sh, vault-apply-roles.sh, and vault-import.sh. One definition, zero copies — avoids the 5-line sliding-window duplicate gate that failed PRs #917/#918. 3. vault-import.sh required --sops; spec (#880) says --env alone must succeed. Flag validation now: --sops requires --age-key, --age-key requires --sops, --env alone imports only the plaintext half. 4. forgejo.hcl template blocks forever when kv/disinto/shared/forgejo is absent or missing a key. Adds `error_on_missing_key = false` so the existing `with ... else ...` fallback emits placeholders instead of hanging on template-pending. vault-engines.sh parser uses a while/shift shape distinct from vault-apply-policies.sh (flat case) and vault-apply-roles.sh (if/elif ladder) so the three sibling flag parsers hash differently under the repo-wide duplicate detector. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| hooks | ||
| init/nomad | ||
| action-vault.sh | ||
| agent-sdk.sh | ||
| AGENTS.md | ||
| branch-protection.sh | ||
| build-graph.py | ||
| ci-debug.sh | ||
| ci-helpers.sh | ||
| ci-log-reader.py | ||
| ci-setup.sh | ||
| claude-config.sh | ||
| env.sh | ||
| forge-push.sh | ||
| forge-setup.sh | ||
| formula-session.sh | ||
| generators.sh | ||
| git-creds.sh | ||
| guard.sh | ||
| hire-agent.sh | ||
| hvault.sh | ||
| issue-lifecycle.sh | ||
| load-project.sh | ||
| mirrors.sh | ||
| ops-setup.sh | ||
| parse-deps.sh | ||
| pr-lifecycle.sh | ||
| release.sh | ||
| secret-scan.sh | ||
| sprint-filer.sh | ||
| stack-lock.sh | ||
| tea-helpers.sh | ||
| worktree.sh | ||