fix(decidim): take the ruby fragment path from its one source

patch.py located files/ruby/ relative to its own __file__. That holds in
the repo, where the script sits next to the fragments, but the image
copies the script to /tmp/patch.py and the fragments to /tmp/ruby/, so
parent.parent resolved to / and the build died with
FileNotFoundError: /ruby/omniauth_provider.rb on every retry.

DECIDIM_PATCH_RUBY_DOCKER already decides where the COPY puts the
fragments. Reading it in the script makes that variable the only place
the location is stated, so the layout can change without a second
place silently disagreeing. Missing variable raises instead of
guessing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-decidim/files/Dockerfile

@@ -13,4 +13,4 @@ RUN echo "gem 'omniauth_openid_connect'" >> /code/Gemfile && \
 
 COPY ${DECIDIM_PATCH_SCRIPT_HOST_REL} ${DECIDIM_PATCH_SCRIPT_DOCKER}
 COPY ${DECIDIM_PATCH_RUBY_HOST_REL}/ ${DECIDIM_PATCH_RUBY_DOCKER}/
-RUN python3 ${DECIDIM_PATCH_SCRIPT_DOCKER}
+RUN DECIDIM_PATCH_RUBY_DOCKER=${DECIDIM_PATCH_RUBY_DOCKER} python3 ${DECIDIM_PATCH_SCRIPT_DOCKER}

roles/web-app-decidim/files/python/patch.py

@@ -31,6 +31,7 @@ is sourced from runtime ENV vars instead. The patches below:
 """
 
 import glob
+import os
 import re
 from pathlib import Path
 
@@ -44,12 +45,14 @@ end
 """
 
 
-_FRAGMENT = (
-    # nocheck: project-root-import  sibling files/ruby/, not the project root
-    Path(__file__).parent.parent / "ruby" / "omniauth_provider.rb"
-)
+def omniauth_injection() -> str:
+    """Read the provider builder fragment from the ruby directory the build mounts.
 
-OMNIAUTH_INJECTION = "\n" + _FRAGMENT.read_text()
+    Returns:
+        The fragment's content, prefixed with a newline.
+    """
+    fragment = Path(os.environ["DECIDIM_PATCH_RUBY_DOCKER"]) / "omniauth_provider.rb"
+    return "\n" + fragment.read_text()
 
 
 def patch_omniauth_rb(content: str) -> str:
@@ -57,7 +60,7 @@ def patch_omniauth_rb(content: str) -> str:
     if 'ENV["OIDC_ENABLED"]' in content:
         return content
     content = (
-        re.sub(r"(  end\nend\s*)$", OMNIAUTH_INJECTION + r"\1", content.rstrip()) + "\n"
+        re.sub(r"(  end\nend\s*)$", omniauth_injection() + r"\1", content.rstrip()) + "\n"
     )
     return OMNIAUTH_REGISTRATION + content
 

roles/web-app-decidim/vars/main.yml

@@ -22,7 +22,7 @@ DECIDIM_ORGANIZATION_NAME: "{{ defaults_service_provider.platform.titel }}"
 DECIDIM_PATCH_SCRIPT_FILE: "patch.py"
 DECIDIM_PATCH_SCRIPT_HOST_ABS: "{{ [ lookup('container', application_id, 'directories.volumes'), DECIDIM_PATCH_SCRIPT_FILE ] | path_join }}"
 DECIDIM_PATCH_SCRIPT_HOST_REL: "volumes/{{ DECIDIM_PATCH_SCRIPT_FILE }}"
-DECIDIM_PATCH_SCRIPT_DOCKER: "/tmp/patch.py"
+DECIDIM_PATCH_SCRIPT_DOCKER: "/tmp/{{ DECIDIM_PATCH_SCRIPT_FILE }}"
 
 DECIDIM_PATCH_RUBY_DIR: "ruby"
 DECIDIM_PATCH_RUBY_HOST_ABS: "{{ [ lookup('container', application_id, 'directories.volumes'), DECIDIM_PATCH_RUBY_DIR ] | path_join }}"

tests/unit/python/roles/web-app-decidim/test_patch.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import os
 import sys
 import unittest
 
@@ -11,6 +12,10 @@ sys.path.insert(0, str(PROJECT_ROOT / "roles" / "web-app-decidim" / "files" / "p
 
 from patch import patch_omniauth_helper_rb, patch_omniauth_rb
 
+os.environ["DECIDIM_PATCH_RUBY_DOCKER"] = str(
+    PROJECT_ROOT / "roles" / "web-app-decidim" / "files" / "ruby"
+)
+
 OMNIAUTH_RB_FIXTURE = """\
 Decidim::Auth.setup do |config|
   config.providers = []