Deduplicate release-ref resolution logic in ansible/deploy.yml #103

Closed
Closed
Deduplicate release-ref resolution logic in ansible/deploy.yml#103

Description

@ineedjet
ineedjet
opened on Aug 20, 2026

Problem

ansible/deploy.yml has three near-identical ~30-line bash blocks, each
parsing an owner/repo@tag[:asset] ref, resolving @latest via
gh release view, and downloading the asset:

  • "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
  • the download_release_ref() function inside "Pull and merge app packages"
    (called once per entry in flightdeck_app_refs)
  • "Pull encrypted env package" (flightdeck_env_ref, single ref)

These three copies implement the exact same parsing/resolution logic
independently, and #102 added a fourth-ish variant (the loop version) while
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
behavior change to ref resolution (@latest handling, :asset-name suffix
parsing, error messages) needs to be applied in three places by hand, with
nothing — no test, no lint — catching a missed spot.

Proposed change

Prefer Ansible-native reuse instead of extracting this into a standalone
shell-script dependency. Move the shared release-ref download/resolution
sequence into a reusable task file, for example:

ansible/tasks/download_release_asset.yml

and invoke it from the existing call sites with ansible.builtin.include_tasks,
passing the ref, output directory, and default-asset behavior as variables.

The reusable task should expose enough facts/results for callers to use the
resolved artifact, ideally including:

  • original ref;
  • repository;
  • resolved tag (especially when the input uses @latest);
  • resolved asset name;
  • downloaded file path.

This keeps the orchestration expressed as Ansible tasks while centralizing the
ref parsing, @latest resolution, download, validation, and error behavior.

Env asset detail

The env call site has one important difference from the machinery/app bundle
cases: when no explicit :asset suffix is supplied, its default asset name is
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
must first resolve latest to the concrete release tag and only then derive
the default env asset name.

The reusable task should support this without duplicating ref-resolution logic
back into the env caller.

This structure should also compose naturally with future env_refs: the caller
can loop over refs and include the same reusable task for every source rather
than introducing another copy of the shell implementation.

Not urgent — the current duplication works correctly (--syntax-check and
matrix trace-through verified in #102) — but worth doing before additional
call sites appear or this logic needs an actual bug fix.

Related

Surfaced during final review of #102. Also relevant to #104 (env_refs).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
       blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

      Skip to content
      Deduplicate release-ref resolution logic in ansible/deploy.yml #103
      Closed
      Closed
      Deduplicate release-ref resolution logic in ansible/deploy.yml#103
      Description
      @ineedjet
      ineedjet
      opened on Aug 20, 2026
      Problem
      ansible/deploy.yml has three near-identical ~30-line bash blocks, each
      
parsing an owner/repo@tag[:asset] ref, resolving @latest via
      gh release view, and downloading the asset:
      • "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
      • the download_release_ref() function inside "Pull and merge app packages"
        
(called once per entry in flightdeck_app_refs)
      • "Pull encrypted env package" (flightdeck_env_ref, single ref)
      These three copies implement the exact same parsing/resolution logic
      
independently, and #102 added a fourth-ish variant (the loop version) while
      
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
      
behavior change to ref resolution (@latest handling, :asset-name suffix
      
parsing, error messages) needs to be applied in three places by hand, with
      
nothing — no test, no lint — catching a missed spot.
      Proposed change
      Prefer Ansible-native reuse instead of extracting this into a standalone
      
shell-script dependency. Move the shared release-ref download/resolution
      
sequence into a reusable task file, for example:
      ansible/tasks/download_release_asset.yml
      and invoke it from the existing call sites with ansible.builtin.include_tasks,
      
passing the ref, output directory, and default-asset behavior as variables.
      The reusable task should expose enough facts/results for callers to use the
      
resolved artifact, ideally including:
      • original ref;
      • repository;
      • resolved tag (especially when the input uses @latest);
      • resolved asset name;
      • downloaded file path.
      This keeps the orchestration expressed as Ansible tasks while centralizing the
      
ref parsing, @latest resolution, download, validation, and error behavior.
      Env asset detail
      The env call site has one important difference from the machinery/app bundle
      
cases: when no explicit :asset suffix is supplied, its default asset name is
      
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
      
must first resolve latest to the concrete release tag and only then derive
      
the default env asset name.
      The reusable task should support this without duplicating ref-resolution logic
      
back into the env caller.
      This structure should also compose naturally with future env_refs: the caller
      
can loop over refs and include the same reusable task for every source rather
      
than introducing another copy of the shell implementation.
      Not urgent — the current duplication works correctly (--syntax-check and
      
matrix trace-through verified in #102) — but worth doing before additional
      
call sites appear or this logic needs an actual bug fix.
      Related
      Surfaced during final review of #102. Also relevant to #104 (env_refs).
      Metadata
      Metadata
      Assignees
      No one assigned
        Labels
        No labels
        No labels
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

          Skip to content
          Deduplicate release-ref resolution logic in ansible/deploy.yml #103
          Closed
          Closed
          Deduplicate release-ref resolution logic in ansible/deploy.yml#103
          Description
          @ineedjet
          ineedjet
          opened on Aug 20, 2026
          Problem
          ansible/deploy.yml has three near-identical ~30-line bash blocks, each
          
parsing an owner/repo@tag[:asset] ref, resolving @latest via
          gh release view, and downloading the asset:
          • "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
          • the download_release_ref() function inside "Pull and merge app packages"
            
(called once per entry in flightdeck_app_refs)
          • "Pull encrypted env package" (flightdeck_env_ref, single ref)
          These three copies implement the exact same parsing/resolution logic
          
independently, and #102 added a fourth-ish variant (the loop version) while
          
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
          
behavior change to ref resolution (@latest handling, :asset-name suffix
          
parsing, error messages) needs to be applied in three places by hand, with
          
nothing — no test, no lint — catching a missed spot.
          Proposed change
          Prefer Ansible-native reuse instead of extracting this into a standalone
          
shell-script dependency. Move the shared release-ref download/resolution
          
sequence into a reusable task file, for example:
          ansible/tasks/download_release_asset.yml
          and invoke it from the existing call sites with ansible.builtin.include_tasks,
          
passing the ref, output directory, and default-asset behavior as variables.
          The reusable task should expose enough facts/results for callers to use the
          
resolved artifact, ideally including:
          • original ref;
          • repository;
          • resolved tag (especially when the input uses @latest);
          • resolved asset name;
          • downloaded file path.
          This keeps the orchestration expressed as Ansible tasks while centralizing the
          
ref parsing, @latest resolution, download, validation, and error behavior.
          Env asset detail
          The env call site has one important difference from the machinery/app bundle
          
cases: when no explicit :asset suffix is supplied, its default asset name is
          
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
          
must first resolve latest to the concrete release tag and only then derive
          
the default env asset name.
          The reusable task should support this without duplicating ref-resolution logic
          
back into the env caller.
          This structure should also compose naturally with future env_refs: the caller
          
can loop over refs and include the same reusable task for every source rather
          
than introducing another copy of the shell implementation.
          Not urgent — the current duplication works correctly (--syntax-check and
          
matrix trace-through verified in #102) — but worth doing before additional
          
call sites appear or this logic needs an actual bug fix.
          Related
          Surfaced during final review of #102. Also relevant to #104 (env_refs).
          Metadata
          Metadata
          Assignees
          No one assigned
            Labels
            No labels
            No labels
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              Deduplicate release-ref resolution logic in ansible/deploy.yml #103
              Closed
              Closed
              Deduplicate release-ref resolution logic in ansible/deploy.yml#103
              Description
              @ineedjet
              ineedjet
              opened on Aug 20, 2026
              Problem
              ansible/deploy.yml has three near-identical ~30-line bash blocks, each
              
parsing an owner/repo@tag[:asset] ref, resolving @latest via
              gh release view, and downloading the asset:
              • "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
              • the download_release_ref() function inside "Pull and merge app packages"
                
(called once per entry in flightdeck_app_refs)
              • "Pull encrypted env package" (flightdeck_env_ref, single ref)
              These three copies implement the exact same parsing/resolution logic
              
independently, and #102 added a fourth-ish variant (the loop version) while
              
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
              
behavior change to ref resolution (@latest handling, :asset-name suffix
              
parsing, error messages) needs to be applied in three places by hand, with
              
nothing — no test, no lint — catching a missed spot.
              Proposed change
              Prefer Ansible-native reuse instead of extracting this into a standalone
              
shell-script dependency. Move the shared release-ref download/resolution
              
sequence into a reusable task file, for example:
              ansible/tasks/download_release_asset.yml
              and invoke it from the existing call sites with ansible.builtin.include_tasks,
              
passing the ref, output directory, and default-asset behavior as variables.
              The reusable task should expose enough facts/results for callers to use the
              
resolved artifact, ideally including:
              • original ref;
              • repository;
              • resolved tag (especially when the input uses @latest);
              • resolved asset name;
              • downloaded file path.
              This keeps the orchestration expressed as Ansible tasks while centralizing the
              
ref parsing, @latest resolution, download, validation, and error behavior.
              Env asset detail
              The env call site has one important difference from the machinery/app bundle
              
cases: when no explicit :asset suffix is supplied, its default asset name is
              
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
              
must first resolve latest to the concrete release tag and only then derive
              
the default env asset name.
              The reusable task should support this without duplicating ref-resolution logic
              
back into the env caller.
              This structure should also compose naturally with future env_refs: the caller
              
can loop over refs and include the same reusable task for every source rather
              
than introducing another copy of the shell implementation.
              Not urgent — the current duplication works correctly (--syntax-check and
              
matrix trace-through verified in #102) — but worth doing before additional
              
call sites appear or this logic needs an actual bug fix.
              Related
              Surfaced during final review of #102. Also relevant to #104 (env_refs).
              Metadata
              Metadata
              Assignees
              No one assigned
                Labels
                No labels
                No labels
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions
                  
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

                  Skip to content
                  Deduplicate release-ref resolution logic in ansible/deploy.yml #103
                  Closed
                  Closed
                  Deduplicate release-ref resolution logic in ansible/deploy.yml#103
                  Description
                  @ineedjet
                  ineedjet
                  opened on Aug 20, 2026
                  Problem
                  ansible/deploy.yml has three near-identical ~30-line bash blocks, each
                  
parsing an owner/repo@tag[:asset] ref, resolving @latest via
                  gh release view, and downloading the asset:
                  • "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
                  • the download_release_ref() function inside "Pull and merge app packages"
                    
(called once per entry in flightdeck_app_refs)
                  • "Pull encrypted env package" (flightdeck_env_ref, single ref)
                  These three copies implement the exact same parsing/resolution logic
                  
independently, and #102 added a fourth-ish variant (the loop version) while
                  
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
                  
behavior change to ref resolution (@latest handling, :asset-name suffix
                  
parsing, error messages) needs to be applied in three places by hand, with
                  
nothing — no test, no lint — catching a missed spot.
                  Proposed change
                  Prefer Ansible-native reuse instead of extracting this into a standalone
                  
shell-script dependency. Move the shared release-ref download/resolution
                  
sequence into a reusable task file, for example:
                  ansible/tasks/download_release_asset.yml
                  and invoke it from the existing call sites with ansible.builtin.include_tasks,
                  
passing the ref, output directory, and default-asset behavior as variables.
                  The reusable task should expose enough facts/results for callers to use the
                  
resolved artifact, ideally including:
                  • original ref;
                  • repository;
                  • resolved tag (especially when the input uses @latest);
                  • resolved asset name;
                  • downloaded file path.
                  This keeps the orchestration expressed as Ansible tasks while centralizing the
                  
ref parsing, @latest resolution, download, validation, and error behavior.
                  Env asset detail
                  The env call site has one important difference from the machinery/app bundle
                  
cases: when no explicit :asset suffix is supplied, its default asset name is
                  
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
                  
must first resolve latest to the concrete release tag and only then derive
                  
the default env asset name.
                  The reusable task should support this without duplicating ref-resolution logic
                  
back into the env caller.
                  This structure should also compose naturally with future env_refs: the caller
                  
can loop over refs and include the same reusable task for every source rather
                  
than introducing another copy of the shell implementation.
                  Not urgent — the current duplication works correctly (--syntax-check and
                  
matrix trace-through verified in #102) — but worth doing before additional
                  
call sites appear or this logic needs an actual bug fix.
                  Related
                  Surfaced during final review of #102. Also relevant to #104 (env_refs).
                  Metadata
                  Metadata
                  Assignees
                  No one assigned
                    Labels
                    No labels
                    No labels
                    Type
                    No type
                    Projects
                    No projects
                      Milestone
                      No milestone
                      Relationships
                      None yet
                      Development
                      No branches or pull requests
                      Issue actions
                      
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

                      Skip to content
                      Deduplicate release-ref resolution logic in ansible/deploy.yml #103
                      Closed
                      Closed
                      Deduplicate release-ref resolution logic in ansible/deploy.yml#103
                      Description
                      @ineedjet
                      ineedjet
                      opened on Aug 20, 2026
                      Problem
                      ansible/deploy.yml has three near-identical ~30-line bash blocks, each
                      
parsing an owner/repo@tag[:asset] ref, resolving @latest via
                      gh release view, and downloading the asset:
                      • "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
                      • the download_release_ref() function inside "Pull and merge app packages"
                        
(called once per entry in flightdeck_app_refs)
                      • "Pull encrypted env package" (flightdeck_env_ref, single ref)
                      These three copies implement the exact same parsing/resolution logic
                      
independently, and #102 added a fourth-ish variant (the loop version) while
                      
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
                      
behavior change to ref resolution (@latest handling, :asset-name suffix
                      
parsing, error messages) needs to be applied in three places by hand, with
                      
nothing — no test, no lint — catching a missed spot.
                      Proposed change
                      Prefer Ansible-native reuse instead of extracting this into a standalone
                      
shell-script dependency. Move the shared release-ref download/resolution
                      
sequence into a reusable task file, for example:
                      ansible/tasks/download_release_asset.yml
                      and invoke it from the existing call sites with ansible.builtin.include_tasks,
                      
passing the ref, output directory, and default-asset behavior as variables.
                      The reusable task should expose enough facts/results for callers to use the
                      
resolved artifact, ideally including:
                      • original ref;
                      • repository;
                      • resolved tag (especially when the input uses @latest);
                      • resolved asset name;
                      • downloaded file path.
                      This keeps the orchestration expressed as Ansible tasks while centralizing the
                      
ref parsing, @latest resolution, download, validation, and error behavior.
                      Env asset detail
                      The env call site has one important difference from the machinery/app bundle
                      
cases: when no explicit :asset suffix is supplied, its default asset name is
                      
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
                      
must first resolve latest to the concrete release tag and only then derive
                      
the default env asset name.
                      The reusable task should support this without duplicating ref-resolution logic
                      
back into the env caller.
                      This structure should also compose naturally with future env_refs: the caller
                      
can loop over refs and include the same reusable task for every source rather
                      
than introducing another copy of the shell implementation.
                      Not urgent — the current duplication works correctly (--syntax-check and
                      
matrix trace-through verified in #102) — but worth doing before additional
                      
call sites appear or this logic needs an actual bug fix.
                      Related
                      Surfaced during final review of #102. Also relevant to #104 (env_refs).
                      Metadata
                      Metadata
                      Assignees
                      No one assigned
                        Labels
                        No labels
                        No labels
                        Type
                        No type
                        Projects
                        No projects
                          Milestone
                          No milestone
                          Relationships
                          None yet
                          Development
                          No branches or pull requests
                          Issue actions
                          
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

                          Skip to content
                          Deduplicate release-ref resolution logic in ansible/deploy.yml #103
                          Closed
                          Closed
                          Deduplicate release-ref resolution logic in ansible/deploy.yml#103
                          Description
                          @ineedjet
                          ineedjet
                          opened on Aug 20, 2026
                          Problem
                          ansible/deploy.yml has three near-identical ~30-line bash blocks, each
                          
parsing an owner/repo@tag[:asset] ref, resolving @latest via
                          gh release view, and downloading the asset:
                          • "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
                          • the download_release_ref() function inside "Pull and merge app packages"
                            
(called once per entry in flightdeck_app_refs)
                          • "Pull encrypted env package" (flightdeck_env_ref, single ref)
                          These three copies implement the exact same parsing/resolution logic
                          
independently, and #102 added a fourth-ish variant (the loop version) while
                          
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
                          
behavior change to ref resolution (@latest handling, :asset-name suffix
                          
parsing, error messages) needs to be applied in three places by hand, with
                          
nothing — no test, no lint — catching a missed spot.
                          Proposed change
                          Prefer Ansible-native reuse instead of extracting this into a standalone
                          
shell-script dependency. Move the shared release-ref download/resolution
                          
sequence into a reusable task file, for example:
                          ansible/tasks/download_release_asset.yml
                          and invoke it from the existing call sites with ansible.builtin.include_tasks,
                          
passing the ref, output directory, and default-asset behavior as variables.
                          The reusable task should expose enough facts/results for callers to use the
                          
resolved artifact, ideally including:
                          • original ref;
                          • repository;
                          • resolved tag (especially when the input uses @latest);
                          • resolved asset name;
                          • downloaded file path.
                          This keeps the orchestration expressed as Ansible tasks while centralizing the
                          
ref parsing, @latest resolution, download, validation, and error behavior.
                          Env asset detail
                          The env call site has one important difference from the machinery/app bundle
                          
cases: when no explicit :asset suffix is supplied, its default asset name is
                          
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
                          
must first resolve latest to the concrete release tag and only then derive
                          
the default env asset name.
                          The reusable task should support this without duplicating ref-resolution logic
                          
back into the env caller.
                          This structure should also compose naturally with future env_refs: the caller
                          
can loop over refs and include the same reusable task for every source rather
                          
than introducing another copy of the shell implementation.
                          Not urgent — the current duplication works correctly (--syntax-check and
                          
matrix trace-through verified in #102) — but worth doing before additional
                          
call sites appear or this logic needs an actual bug fix.
                          Related
                          Surfaced during final review of #102. Also relevant to #104 (env_refs).
                          Metadata
                          Metadata
                          Assignees
                          No one assigned
                            Labels
                            No labels
                            No labels
                            Type
                            No type
                            Projects
                            No projects
                              Milestone
                              No milestone
                              Relationships
                              None yet
                              Development
                              No branches or pull requests
                              Issue actions
                              
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                              Skip to content
                              Deduplicate release-ref resolution logic in ansible/deploy.yml #103
                              Closed
                              Closed
                              Deduplicate release-ref resolution logic in ansible/deploy.yml#103
                              Description
                              @ineedjet
                              ineedjet
                              opened on Aug 20, 2026
                              Problem
                              ansible/deploy.yml has three near-identical ~30-line bash blocks, each
                              
parsing an owner/repo@tag[:asset] ref, resolving @latest via
                              gh release view, and downloading the asset:
                              • "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
                              • the download_release_ref() function inside "Pull and merge app packages"
                                
(called once per entry in flightdeck_app_refs)
                              • "Pull encrypted env package" (flightdeck_env_ref, single ref)
                              These three copies implement the exact same parsing/resolution logic
                              
independently, and #102 added a fourth-ish variant (the loop version) while
                              
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
                              
behavior change to ref resolution (@latest handling, :asset-name suffix
                              
parsing, error messages) needs to be applied in three places by hand, with
                              
nothing — no test, no lint — catching a missed spot.
                              Proposed change
                              Prefer Ansible-native reuse instead of extracting this into a standalone
                              
shell-script dependency. Move the shared release-ref download/resolution
                              
sequence into a reusable task file, for example:
                              ansible/tasks/download_release_asset.yml
                              and invoke it from the existing call sites with ansible.builtin.include_tasks,
                              
passing the ref, output directory, and default-asset behavior as variables.
                              The reusable task should expose enough facts/results for callers to use the
                              
resolved artifact, ideally including:
                              • original ref;
                              • repository;
                              • resolved tag (especially when the input uses @latest);
                              • resolved asset name;
                              • downloaded file path.
                              This keeps the orchestration expressed as Ansible tasks while centralizing the
                              
ref parsing, @latest resolution, download, validation, and error behavior.
                              Env asset detail
                              The env call site has one important difference from the machinery/app bundle
                              
cases: when no explicit :asset suffix is supplied, its default asset name is
                              
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
                              
must first resolve latest to the concrete release tag and only then derive
                              
the default env asset name.
                              The reusable task should support this without duplicating ref-resolution logic
                              
back into the env caller.
                              This structure should also compose naturally with future env_refs: the caller
                              
can loop over refs and include the same reusable task for every source rather
                              
than introducing another copy of the shell implementation.
                              Not urgent — the current duplication works correctly (--syntax-check and
                              
matrix trace-through verified in #102) — but worth doing before additional
                              
call sites appear or this logic needs an actual bug fix.
                              Related
                              Surfaced during final review of #102. Also relevant to #104 (env_refs).
                              Metadata
                              Metadata
                              Assignees
                              No one assigned
                                Labels
                                No labels
                                No labels
                                Type
                                No type
                                Projects
                                No projects
                                  Milestone
                                  No milestone
                                  Relationships
                                  None yet
                                  Development
                                  No branches or pull requests
                                  Issue actions