Skip to content

Address Review Findings from the Develop-to-Main Promotion PR#109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ptr727 merged 2 commits into from
Aug 24, 2026
Merged

Address Review Findings from the Develop-to-Main Promotion PR #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7b1ce47
Address review findings from the develop-to-main promotion PR
ptr727 Aug 24, 2026
d4ab6c3
Fix a scope claim and a bash-version-sensitive display escape
ptr727 Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions .secrets/README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -7,11 +7,14 @@ exposing one.

## Real values live on the host, never in the checkout

Every real value this repo's scripts read comes from `~/.secrets/`, not from this directory.
The documented local convention is `~/.secrets/`, not this directory. CI supplies the same
values directly from the GitHub Environment instead, reading no file here at all.
`ENV_FILE=<name> deploy/make-release.sh` and `ops/install.sh` both resolve a relative `ENV_FILE`
against `$HOME/.secrets`, refuse a traversing one, and default to
`~/.secrets/Blog.local.production.env`. `~/.secrets/` is shared across every repo on the host,
so each of this repo's files carries the `Blog.` prefix:
`~/.secrets/Blog.local.production.env`. An absolute `ENV_FILE` is honored as given rather than
resolved against `~/.secrets/`, an escape hatch rather than the documented shape.
`~/.secrets/` is shared across every repo on the host, so each of this repo's files carries the
`Blog.` prefix:

| File | Selects |
| --- | --- |
Expand Down
9 changes: 5 additions & 4 deletions OPERATIONS.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -77,11 +77,11 @@ So release to the local mirror and run the live check **before** opening a pull

```sh
set -a; . ~/.secrets/Blog.local.production.env; set +a
deploy/make-release.sh
ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
checks/check-live-urls.sh "$SITE_BASE_URL"
```

Against the staging mirror, name its file in both places, since the sourced values and the ones `make-release.sh` reads must describe the same environment:
Name the file in both places, even when it is the default, since `make-release.sh` sources `ENV_FILE` independently of the shell above and a value already exported earlier in the same session would otherwise win silently over the sourced one:

```sh
set -a; . ~/.secrets/Blog.local.staging.env; set +a
Expand DownExpand Up@@ -142,8 +142,9 @@ Three properties of how the credential is handled, each there for a reason worth
## Deploying

```sh
SITE_BASE_URL=<base-url> deploy/make-release.sh <deploy-root> "$(git rev-parse --short HEAD)"
checks/check-live-urls.sh <base-url>
RELEASE="$(git rev-parse --short HEAD)"
SITE_BASE_URL=<base-url> deploy/make-release.sh <deploy-root> "$RELEASE"
EXPECT_RELEASE="$RELEASE" checks/check-live-urls.sh <base-url>
```

The deploy root and the base URL are the only host-specific values. A local run reads them from a file under `~/.secrets/`, one per environment, copied from [`.secrets/example.env`](./.secrets/example.env), and CI passes both explicitly. The real files live on the host, never in this checkout.
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -179,7 +179,7 @@ Build a release and verify it against a running server:

```sh
set -a; . ~/.secrets/Blog.local.production.env; set +a
deploy/make-release.sh
ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
checks/check-live-urls.sh "$SITE_BASE_URL"
```

Expand Down
2 changes: 1 addition & 1 deletion deploy/README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -54,7 +54,7 @@ neither. Seven facts are the whole contract:

```sh
set -a; . ~/.secrets/Blog.local.production.env; set +a
deploy/make-release.sh
ENV_FILE=~/.secrets/Blog.local.production.env deploy/make-release.sh
checks/check-live-urls.sh "$SITE_BASE_URL"
```

Expand Down
13 changes: 11 additions & 2 deletions ops/install.sh
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -91,7 +91,16 @@ MOUNT=$(findmnt -no TARGET --target "$ANCESTOR" 2>/dev/null) ||

VPS_TRAEFIK_ARCHIVE=${VPS_TRAEFIK_LOG_ARCHIVE:-/var/log/traefik/archive}

printf '=== derived from %s\n' "${ENV_FILE/#"$HOME"/\~}"
# A display value only, built without the \~ parameter-expansion escape, since bash versions differ on whether that yields a literal backslash, and this is what an operator reads to trust the source file.
ENV_FILE_DISPLAY=$ENV_FILE
case "$ENV_FILE_DISPLAY" in
"$HOME"/*)
# shellcheck disable=SC2088 # Literal display text, deliberately not expanded.
ENV_FILE_DISPLAY="~/${ENV_FILE_DISPLAY#"$HOME"/}"
;;
esac

printf '=== derived from %s\n' "$ENV_FILE_DISPLAY"
note "VPS_SSH_HOST $VPS_SSH_HOST"
note "BACKUP_ARCHIVE_ROOT $BACKUP_ARCHIVE_ROOT"
note "LOG_ARCHIVE_ROOT $LOG_ARCHIVE_ROOT"
Expand All@@ -105,7 +114,7 @@ DROPIN_DEST=$DROPIN_DIR/local.conf

ENV_BODY=$(
cat <<EOF
# Generated by ops/install.sh from ${ENV_FILE/#"$HOME"/\~}. Re-run that rather than editing
# Generated by ops/install.sh from $ENV_FILE_DISPLAY. Re-run that rather than editing
# here, or this copy and the one the log review reads stop agreeing and nothing reports it.
VPS_SSH_HOST=$VPS_SSH_HOST
VPS_ARCHIVE_DIR=${VPS_ARCHIVE_DIR:-/var/backups/pangolin}
Expand Down