fix(moodle): fetch the source from a host that answers the runners

download.moodle.org returns 403 to GitHub-hosted runners while serving the identical artefact elsewhere: 12 failures across three runners over twelve hours, each 40-66ms after TLS, with curl's four retries and Ansible's three exhausted. The GitHub tag archive is content-equivalent - both tarballs extracted and diffed over 39312 entries, the only delta being githash.php, which nothing in the 4.5.11 tree includes - and needs --strip-components=1 because it roots at moodle-4.5.11/ rather than moodle/.

auth-oidc.sh was the next landmine, two Dockerfile lines behind the fixed one: an anonymous api.github.com tag query, 60 requests per hour per runner IP, no retry, -s swallowing the rate-limit body under set -e, and a floating plugin version as the build input. It now reads a new meta/addons/auth_oidc.yml, which declares bridges: [sso] and update.monitored so the version is watched by the update pipeline instead of frozen.

MOODLE_BRANCH and MOODLE_TARBALL_FILENAME die with the old URL; the latter was already dead, demanded only by its own :?required guard.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-moodle/files/Dockerfile

@@ -28,9 +28,9 @@ ARG MOODLE_OIDC_PLUGIN_RELPATH
 ARG MOODLE_MCP_ENABLED
 ARG MOODLE_MCP_PLUGIN_RELPATH
 ARG MOODLE_MCP_PLUGIN_ARCHIVE_URL
+ARG MOODLE_OIDC_PLUGIN_ARCHIVE_URL
 ARG MOODLE_RELEASE
 ARG MOODLE_TARBALL_URL
-ARG MOODLE_TARBALL_FILENAME
 ARG MOODLE_VERSION_FILE
 ARG MOODLE_AUTH_SUBDIR
 ARG MOODLE_WEBSERVICE_SUBDIR
@@ -43,9 +43,9 @@ ENV MOODLE_CODE_DIR=${MOODLE_CODE_DIR} \
     MOODLE_OIDC_PLUGIN_RELPATH=${MOODLE_OIDC_PLUGIN_RELPATH} \
     MOODLE_MCP_PLUGIN_RELPATH=${MOODLE_MCP_PLUGIN_RELPATH} \
     MOODLE_MCP_PLUGIN_ARCHIVE_URL=${MOODLE_MCP_PLUGIN_ARCHIVE_URL} \
+    MOODLE_OIDC_PLUGIN_ARCHIVE_URL=${MOODLE_OIDC_PLUGIN_ARCHIVE_URL} \
     MOODLE_RELEASE=${MOODLE_RELEASE} \
     MOODLE_TARBALL_URL=${MOODLE_TARBALL_URL} \
-    MOODLE_TARBALL_FILENAME=${MOODLE_TARBALL_FILENAME} \
     MOODLE_VERSION_FILE=${MOODLE_VERSION_FILE} \
     MOODLE_AUTH_SUBDIR=${MOODLE_AUTH_SUBDIR} \
     MOODLE_WEBSERVICE_SUBDIR=${MOODLE_WEBSERVICE_SUBDIR}

roles/web-app-moodle/files/build/install/auth-oidc.sh

@@ -1,34 +1,22 @@
 #!/bin/bash
-# Install Microsoft auth_oidc plugin pinned to the highest tag matching
-# the Moodle major.minor we are building. All values come from env
-# vars exported by the Dockerfile (single source of truth:
+# Install the Microsoft auth_oidc plugin. All values come from env vars
+# exported by the Dockerfile (single source of truth:
 # roles/web-app-moodle/vars/main.yml).
 set -euxo pipefail
 
 : "${MOODLE_SOURCE_DIR:?required}"
 : "${MOODLE_OIDC_PLUGIN_RELPATH:?required}"
-: "${MOODLE_RELEASE:?required}"
+: "${MOODLE_OIDC_PLUGIN_ARCHIVE_URL:?required}"
 : "${MOODLE_AUTH_SUBDIR:?required}"
 
-MOODLE_VER="$(printf '%s' "${MOODLE_RELEASE}" | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')"
-
 PLUGIN_DIR="${MOODLE_SOURCE_DIR}/${MOODLE_OIDC_PLUGIN_RELPATH}"
 ZIP_PATH="$(mktemp -t auth-oidc.XXXXXX.zip)"
 EXTRACT_DIR="$(mktemp -d -t auth-oidc-extract.XXXXXX)"
 trap 'rm -rf "${ZIP_PATH}" "${EXTRACT_DIR}"' EXIT
 
-VERSION="$(curl --connect-timeout 5 --max-time 60 -sfSL https://api.github.com/repos/microsoft/moodle-auth_oidc/tags \
-  | jq -r '.[].name' \
-  | grep -E "^v${MOODLE_VER}\." \
-  | sort -Vr \
-  | head -n1)"
-
-[ -n "${VERSION}" ] || { echo "no auth_oidc tag found for Moodle ${MOODLE_VER}" >&2; exit 1; }
-
-echo "Installing auth_oidc ${VERSION} (Moodle ${MOODLE_VER})"
 test -d "${MOODLE_SOURCE_DIR}/${MOODLE_AUTH_SUBDIR}"
 
-curl --connect-timeout 5 --max-time 300 --retry 3 --retry-all-errors --retry-delay 2 -fSL -o "${ZIP_PATH}" "https://github.com/microsoft/moodle-auth_oidc/archive/refs/tags/${VERSION}.zip"
+curl --connect-timeout 5 --max-time 300 --retry 3 --retry-all-errors --retry-delay 2 -fSL -o "${ZIP_PATH}" "${MOODLE_OIDC_PLUGIN_ARCHIVE_URL}"
 unzip -q "${ZIP_PATH}" -d "${EXTRACT_DIR}"
 rm -rf "${PLUGIN_DIR}"
 

roles/web-app-moodle/files/build/install/moodle-source.sh

@@ -10,21 +10,18 @@ set -euxo pipefail
 : "${MOODLE_SOURCE_DIR:?required}"
 : "${MOODLE_RUNTIME_USER:?required}"
 : "${MOODLE_TARBALL_URL:?required}"
-: "${MOODLE_TARBALL_FILENAME:?required}"
 : "${MOODLE_VERSION_FILE:?required}"
 : "${MOODLE_AUTH_SUBDIR:?required}"
 
-EXTRACT_DIR="$(mktemp -d -t moodle-extract.XXXXXX)"
 TARBALL_PATH="$(mktemp -t moodle-tarball.XXXXXX)"
-trap 'rm -rf "${EXTRACT_DIR}" "${TARBALL_PATH}"' EXIT
+trap 'rm -rf "${TARBALL_PATH}"' EXIT
 
 curl --connect-timeout 5 --max-time 600 --retry 3 --retry-all-errors --retry-delay 2 -fSL -o "${TARBALL_PATH}" "${MOODLE_TARBALL_URL}"
 file "${TARBALL_PATH}"
 
 rm -rf "${MOODLE_SOURCE_DIR}"
 mkdir -p "${MOODLE_SOURCE_DIR}"
-tar -xzf "${TARBALL_PATH}" -C "${EXTRACT_DIR}"
-cp -a "${EXTRACT_DIR}/moodle/." "${MOODLE_SOURCE_DIR}/"
+tar -xzf "${TARBALL_PATH}" --strip-components=1 -C "${MOODLE_SOURCE_DIR}"
 
 test -d "${MOODLE_SOURCE_DIR}/${MOODLE_AUTH_SUBDIR}"
 test -f "${MOODLE_SOURCE_DIR}/${MOODLE_VERSION_FILE}"

roles/web-app-moodle/meta/addons/auth_oidc.yml

@@ -0,0 +1,12 @@
+---
+enabled: "{{ lookup('config', 'web-app-moodle', 'services.sso.enabled') | bool }}"
+required: false
+mechanism: plugin
+source: upstream
+version: "v4.5.8"
+bridges:
+  - sso
+update:
+  monitored: true
+  catalog: github-releases
+  upstream_id: microsoft/moodle-auth_oidc

roles/web-app-moodle/meta/services.yml

@@ -44,7 +44,6 @@ moodle:
   bond: 1
   enabled: true # nocheck: dynamic-flag
   shared: true
-  branch: stable405
   release: 4.5.11
   image: php
   # nocheck: docker-version

roles/web-app-moodle/templates/compose.yml.j2

@@ -20,9 +20,9 @@
         MOODLE_MCP_ENABLED: "{{ MOODLE_MCP_ENABLED | bool | ternary('1','0') }}"
         MOODLE_MCP_PLUGIN_RELPATH: "{{ MOODLE_MCP_PLUGIN_RELPATH }}"
         MOODLE_MCP_PLUGIN_ARCHIVE_URL: "{{ MOODLE_MCP_PLUGIN_ARCHIVE_URL }}"
+        MOODLE_OIDC_PLUGIN_ARCHIVE_URL: "{{ MOODLE_OIDC_PLUGIN_ARCHIVE_URL }}"
         MOODLE_RELEASE: "{{ MOODLE_RELEASE }}"
         MOODLE_TARBALL_URL: "{{ MOODLE_TARBALL_URL }}"
-        MOODLE_TARBALL_FILENAME: "{{ MOODLE_TARBALL_FILENAME }}"
         MOODLE_VERSION_FILE: "{{ MOODLE_VERSION_FILE }}"
         MOODLE_AUTH_SUBDIR: "{{ MOODLE_AUTH_SUBDIR }}"
         MOODLE_WEBSERVICE_SUBDIR: "{{ MOODLE_WEBSERVICE_SUBDIR }}"

roles/web-app-moodle/vars/main.yml

@@ -24,6 +24,9 @@ MOODLE_AUTH_SUBDIR: "auth" # top-level auth/ tree
 MOODLE_WEBSERVICE_SUBDIR: "webservice"
 MOODLE_CLI_RELPATH: "admin/cli" # admin CLI script dir
 
+MOODLE_OIDC_PLUGIN_VERSION: "{{ lookup('config', application_id, 'addons.auth_oidc.version') }}"
+MOODLE_OIDC_PLUGIN_UPSTREAM: "{{ lookup('config', application_id, 'addons.auth_oidc.update.upstream_id') }}"
+MOODLE_OIDC_PLUGIN_ARCHIVE_URL: "https://github.com/{{ MOODLE_OIDC_PLUGIN_UPSTREAM }}/archive/refs/tags/{{ MOODLE_OIDC_PLUGIN_VERSION }}.zip"
 MOODLE_OIDC_PLUGIN_RELPATH: "{{ [MOODLE_AUTH_SUBDIR, 'oidc'] | path_join }}"
 MOODLE_OIDC_PLUGIN_DIR: "{{ [MOODLE_CODE_DIR, MOODLE_OIDC_PLUGIN_RELPATH] | path_join }}"
 MOODLE_CLI_DIR: "{{ [MOODLE_CODE_DIR, MOODLE_CLI_RELPATH] | path_join }}"
@@ -32,10 +35,8 @@ MOODLE_CONFIG: "{{ [MOODLE_CODE_DIR, 'config.php'] | path_join }}"
 MOODLE_RUNTIME_USER: "www-data"
 MOODLE_RUNTIME_USER_GROUP: "{{ MOODLE_RUNTIME_USER }}:{{ MOODLE_RUNTIME_USER }}"
 
-MOODLE_BRANCH: "{{ lookup('config', application_id, 'services.moodle.branch') }}"
 MOODLE_RELEASE: "{{ lookup('config', application_id, 'services.moodle.release') }}"
-MOODLE_TARBALL_FILENAME: "moodle-{{ MOODLE_RELEASE }}.tgz"
-MOODLE_TARBALL_URL: "https://download.moodle.org/download.php/direct/{{ MOODLE_BRANCH }}/{{ MOODLE_TARBALL_FILENAME }}"
+MOODLE_TARBALL_URL: "https://github.com/moodle/moodle/archive/refs/tags/v{{ MOODLE_RELEASE }}.tar.gz"
 
 MOODLE_MSMTP_SRC: "{{ lookup('path_absolute', 'roles/sys-svc-mail-msmtp/templates/msmtprc.conf.j2') }}"
 MOODLE_MSMTP_ABS: "{{ [ lookup('container', application_id, 'directories.config'), 'msmtprc.conf'] | path_join }}"