fix(merge): keep the credential env convention in the merged discourse and openproject tasks

The updater merge took the stdin form for web-app-discourse: an sh -c 'IFS= read -r ...' wrapper that the exec-env lint reads as an IFS= assignment carrying the administrator password. The site settings and the administrator still go through one rails runner, but every secret, the LDAP site settings with their bind password included, now reaches the container as -e NAME with the value in the task's environment, as this branch's convention requires; the read-back follows suit.

The merged web-app-openproject task name was 85 characters and is shortened to fit the 80-character limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/web-app-discourse/tasks/stack_host/02_credentials.yml

@@ -10,6 +10,8 @@
       - -e
       - "DISCOURSE_LOCAL_LOGINS={{ DISCOURSE_LOCAL_LOGIN_ENABLED | bool | string | lower }}"
       - -e
+      - DISCOURSE_LDAP_SITE_SETTINGS
+      - -e
       - "DISCOURSE_OIDC_ENABLED={{ DISCOURSE_OIDC_ENABLED | bool | string | lower }}"
       - -e
       - "DISCOURSE_OIDC_VERBOSE={{ MODE_DEBUG | bool | string | lower }}"
@@ -18,23 +20,23 @@
       - -e
       - "DISCOURSE_OIDC_CLIENT_ID={{ OIDC.CLIENT.ID if DISCOURSE_OIDC_ENABLED | bool else '' }}"
       - -e
+      - DISCOURSE_OIDC_CLIENT_SECRET
+      - -e
       - "DISCOURSE_OIDC_LOGOUT_REDIRECT={{ DISCOURSE_OIDC_LOGOUT_REDIRECT_URL if DISCOURSE_OIDC_ENABLED | bool else '' }}"
       - -e
       - "DISCOURSE_ADMIN_EMAIL={{ lookup('users', 'platform_administrator').email }}"
       - -e
       - "DISCOURSE_ADMIN_USERNAME={{ lookup('users', 'platform_administrator').username }}"
+      - -e
+      - DISCOURSE_ADMIN_PASSWORD
       - "{{ DISCOURSE_CONTAINER }}" # nocheck: container-exec-resolver  the launcher names the container itself, so the bare name resolves in both modes
-      - sh
-      - -c
-      - 'IFS= read -r DISCOURSE_LDAP_SITE_SETTINGS; IFS= read -r DISCOURSE_OIDC_CLIENT_SECRET; IFS= read -r DISCOURSE_ADMIN_PASSWORD; export DISCOURSE_LDAP_SITE_SETTINGS DISCOURSE_OIDC_CLIENT_SECRET DISCOURSE_ADMIN_PASSWORD; exec "$@"'
-      - sh
       - rails
       - r
       - "{{ lookup('file', 'ruby/apply_settings.rb') }}\n{{ lookup('file', 'ruby/ensure_admin_user.rb') }}"
-    stdin: |-
-      {{ (DISCOURSE_PLUGINS['discourse-ldap-auth'].config.site_settings if DISCOURSE_LDAP_ENABLED | bool else {}) | to_json }}
-      {{ OIDC.CLIENT.SECRET if DISCOURSE_OIDC_ENABLED | bool else '' }}
-      {{ lookup('users', 'platform_administrator').password }}
+  environment:
+    DISCOURSE_LDAP_SITE_SETTINGS: "{{ (DISCOURSE_PLUGINS['discourse-ldap-auth'].config.site_settings if DISCOURSE_LDAP_ENABLED | bool else {}) | to_json }}"
+    DISCOURSE_OIDC_CLIENT_SECRET: "{{ OIDC.CLIENT.SECRET if DISCOURSE_OIDC_ENABLED | bool else '' }}"
+    DISCOURSE_ADMIN_PASSWORD: "{{ lookup('users', 'platform_administrator').password }}"
   changed_when: false
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
 
@@ -47,18 +49,18 @@
       - -e
       - "DISCOURSE_ADMIN_EMAIL={{ lookup('users', 'platform_administrator').email }}"
       - -e
+      - DISCOURSE_ADMIN_PASSWORD
+      - -e
       - "DISCOURSE_OIDC_ENABLED={{ DISCOURSE_OIDC_ENABLED | bool | string | lower }}"
+      - -e
+      - DISCOURSE_OIDC_CLIENT_SECRET
       - "{{ DISCOURSE_CONTAINER }}" # nocheck: container-exec-resolver  the launcher names the container itself, so the bare name resolves in both modes
-      - sh
-      - -c
-      - 'IFS= read -r DISCOURSE_ADMIN_PASSWORD; IFS= read -r DISCOURSE_OIDC_CLIENT_SECRET; export DISCOURSE_ADMIN_PASSWORD DISCOURSE_OIDC_CLIENT_SECRET; exec "$@"'
-      - sh
       - rails
       - r
       - "{{ lookup('file', 'ruby/verify_settings.rb') }}"
-    stdin: |-
-      {{ lookup('users', 'platform_administrator').password }}
-      {{ OIDC.CLIENT.SECRET if DISCOURSE_OIDC_ENABLED | bool else '' }}
+  environment:
+    DISCOURSE_ADMIN_PASSWORD: "{{ lookup('users', 'platform_administrator').password }}"
+    DISCOURSE_OIDC_CLIENT_SECRET: "{{ OIDC.CLIENT.SECRET if DISCOURSE_OIDC_ENABLED | bool else '' }}"
   register: discourse_settings_readback
   changed_when: false
   no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"

roles/web-app-openproject/tasks/04_admin.yml

@@ -6,7 +6,7 @@
     resolve_output_prefix: OPENPROJECT_WEB
     resolve_compose_cid: "{{ OPENPROJECT_WEB_CONTAINER_ADDRESS }}"
 
-- name: 🔧 Apply settings, ensure the administrator, lock the seeded admin and link it to LDAP
+- name: 🔧 Apply settings, ensure the administrator, lock the seeded admin, link LDAP
   ansible.builtin.shell:
     cmd: >- # nocheck: container-exec-resolver CID resolved at delegate_to runtime; container_address targets a manager-only subshell
       container exec -i
@@ -14,7 +14,8 @@
       -e {{ ('OPENPROJECT_ADMIN_EMAIL=' ~ OPENPROJECT_ADMINISTRATOR_EMAIL) | quote }}
       {% if OPENPROJECT_HEADER_SSO_ENABLED | bool %}-e {{ ('OPENPROJECT_LDAP_NAME=' ~ OPENPROJECT_LDAP.name) | quote }}{% endif %}
       {{ OPENPROJECT_WEB_LOCAL_CID | quote }}
-      sh -c 'IFS= read -r OPENPROJECT_ADMIN_PASSWORD; IFS= read -r OPENPROJECT_RAILS_SETTINGS; export OPENPROJECT_ADMIN_PASSWORD OPENPROJECT_RAILS_SETTINGS; exec "$@"' sh bash -lc 'cd /app && bundle exec rails runner -'
+      sh -c 'IFS= read -r OPENPROJECT_ADMIN_PASSWORD; IFS= read -r OPENPROJECT_RAILS_SETTINGS; export OPENPROJECT_ADMIN_PASSWORD OPENPROJECT_RAILS_SETTINGS; exec
+      "$@"' sh bash -lc 'cd /app && bundle exec rails runner -'
     stdin: |-
       {{ OPENPROJECT_ADMINISTRATOR_PASSWORD }}
       {{ OPENPROJECT_RAILS_SETTINGS | to_json }}