perf(web-app-xwiki): skip the auth-off bootstrap restart when core and add-ons already run on their pins

Every redeploy rendered the bootstrap config with OIDC/LDAP off, restarted XWiki, waited ~80 s for REST, checked the add-ons and then switched auth back on with a second restart and wait. A probe now asks the running wiki as superadmin first: when its core version equals the pinned core and every add-on reports INSTALLED at its pin, the bootstrap already renders the final auth config, so the final phase finds nothing to change. Any other answer (fresh install, missing add-on, pin or core bump, unreachable, 401, distribution wizard, 503, any status) falls back to today's two-restart flow; the written xwiki.properties is identical in every case.

Verified on echoserver under the live OIDC config: superadmin basic auth answers 200 on /rest/wikis/xwiki/spaces and on bin/view (no Keycloak redirect, trylocal), and /rest/ reports <version>18.8.0</version>. Replay harness: redeploy on pin 2 -> 0 restarts, with another config change 2 -> 1, all fallback scenarios unchanged. About 190 s per unchanged redeploy.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

roles/web-app-xwiki/tasks/00_core.yml

@@ -4,6 +4,9 @@
 - name: ✅ Validate XWiki variables
   include_tasks: 01_validation.yml
 
+- name: "🔎 Probe whether the running XWiki already carries every add-on on its pin"
+  include_tasks: utils/extensions_ready.yml
+
 - block:
     - name: "🧩 load docker, db and proxy for {{ application_id }}"
       include_role:
@@ -25,8 +28,8 @@
       include_tasks: utils/flush_config.yml
       when: IS_STACK_HOST | bool
   vars:
-    xwiki_oidc_enabled_switch: false
-    xwiki_ldap_enabled_switch: false
+    xwiki_oidc_enabled_switch: "{{ (XWIKI_OIDC_ENABLED | bool) and (xwiki_extensions_ready | bool) }}"
+    xwiki_ldap_enabled_switch: "{{ (XWIKI_LDAP_ENABLED | bool) and (xwiki_extensions_ready | bool) }}"
 
 - name: "👔 XWiki manager-side operations (file deploys + container exec)"
   include_tasks: 02_manager_ops.yml

roles/web-app-xwiki/tasks/04_extensions.yml

@@ -3,11 +3,6 @@
 # Extension Script Service (services.extension.install).
 # Avoids REST job API and any Namespace class import for portability.
 #
-# Flow:
-#  - Bootstrap config renders with both auth backends OFF (already in your role).
-#  - This file installs required extensions on the current wiki.
-#  - Final config later turns auth ON (already in your role).
-#
 # Notes:
 #  - We print machine-readable markers so Ansible can assert deterministically.
 

roles/web-app-xwiki/tasks/utils/extensions_ready.yml

@@ -0,0 +1,67 @@
+---
+- name: "🔎 XWIKI | Probe whether the running wiki answers the superadmin"
+  uri_retry:
+    url: "{{ [XWIKI_REST_XWIKI, 'spaces'] | url_join }}"
+    method: GET
+    url_username: "{{ XWIKI_SUPERADMIN_USERNAME }}"
+    url_password: "{{ XWIKI_SUPERADMIN_PASSWORD }}"
+    force_basic_auth: true
+    follow_redirects: none
+    return_content: false
+    status_code: "{{ [-1] + range(100, 600) | list }}"
+  register: _xwiki_running
+  changed_when: false
+  when:
+    - IS_STACK_HOST | bool
+    - XWIKI_SSO_ENABLED | bool
+
+- name: "🔎 XWIKI | Read the core version of the running wiki"
+  uri_retry:
+    url: "{{ XWIKI_REST_BASE }}"
+    method: GET
+    url_username: "{{ XWIKI_SUPERADMIN_USERNAME }}"
+    url_password: "{{ XWIKI_SUPERADMIN_PASSWORD }}"
+    force_basic_auth: true
+    follow_redirects: none
+    headers:
+      Accept: "application/xml"
+    return_content: true
+    status_code: "{{ [-1] + range(100, 600) | list }}"
+  register: _xwiki_running_core
+  changed_when: false
+  when:
+    - _xwiki_running is not skipped
+    - _xwiki_running.status == 200
+
+- name: "🧭 XWIKI | Compare the running core with the pinned core {{ XWIKI_CORE_VERSION }}"
+  set_fact:
+    _xwiki_core_on_pin: >-
+      {{ _xwiki_running_core is not skipped
+         and _xwiki_running_core.status == 200
+         and _xwiki_running_core.content is search('<version>' ~ (XWIKI_CORE_VERSION | regex_escape) ~ '</version>') }}
+
+- name: "✅ XWIKI | Check the running wiki's add-ons against their pins"
+  include_tasks: _check_extension_via_groovy.yml
+  loop: "{{ XWIKI_PLUGINS }}"
+  loop_control:
+    loop_var: plugin
+    label: "{{ plugin.id }}"
+  vars:
+    ext_id: "{{ plugin.id }}"
+    ext_version: "{{ plugin.version }}"
+    result_var: "xwiki_running_{{ plugin.id | regex_replace('[^A-Za-z0-9_]', '_') }}"
+  when: _xwiki_core_on_pin | bool
+
+- name: "🧭 XWIKI | Skip the bootstrap boot when core and add-ons run on their pins"
+  set_fact:
+    xwiki_extensions_ready: >-
+      {{ (_xwiki_core_on_pin | bool)
+         and (XWIKI_PLUGINS
+              | map(attribute='id')
+              | map('regex_replace', '[^A-Za-z0-9_]', '_')
+              | map('regex_replace', '^', 'xwiki_running_')
+              | map('extract', hostvars[inventory_hostname], 'status')
+              | map('int')
+              | reject('equalto', 200)
+              | list
+              | length == 0) }}

roles/web-app-xwiki/vars/main.yml

@@ -14,6 +14,7 @@ XWIKI_DOCK_DATA_DIR: "{{ lookup('volume', 'web-app-xwiki', 'data').target }}"
 
 XWIKI_IMAGE: "{{ lookup('config', application_id, 'services.xwiki.image') }}"
 XWIKI_VERSION: "{{ lookup('config', application_id, 'services.xwiki.version') }}"
+XWIKI_CORE_VERSION: "{{ (XWIKI_VERSION | string).split('-') | first }}"
 XWIKI_CONTAINER: "{{ lookup('config', application_id, 'services.xwiki.name') }}"
 XWIKI_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, entity_name) }}"