Introduce plugins/lookup/path_absolute.py as the single source for the
repo-root anchor: lookup('path_absolute', 'roles/...') returns an absolute
path under playbook_dir, joining every term. Replace all hand-built
playbook_dir path constructions across .yml/.yaml and .j2 templates with it:
[playbook_dir, '<rel>'] | path_join -> lookup('path_absolute', '<rel>')
playbook_dir ~ '/<rel>' -> lookup('path_absolute', '<rel>')
{{ playbook_dir }}/<rel> -> lookup('path_absolute', '<rel>')
Unrelated repo_path symbols in cli/meta/roles/applications/resolution and the
single bare discover_playwright_roles(playbook_dir) call are left untouched.
Add tests/lint/ansible/test_playbook_dir_via_lookup.py: fails the build if any
of the three construction forms reappears in .yml/.yaml/.j2, pointing callers
at the lookup. Unit test covers the plugin.
Touching these files pulled their pre-existing narration comments into
test_comments_valid scope; clean them (delete restatement/banners, keep real
trip-wires as Workaround/Upstream/Invariant markers). Drop caution, important
and pitfall from the comment-lint marker vocabulary and remove the comments
that used them.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add tests/lint/repository/test_name_emoji_and_length.py: every Ansible task
name and GitHub Actions workflow/job/step name must start with an emoji (first
char not 0-9/A-Za-z) and be <= 80 chars.
- emit emoji names at the source: cli/build/include generator now writes
"🔧 setup <app>" / "🚿 flush handlers after <app>" so generated
tasks/groups/*-roles.yml satisfy the convention too
- convert existing task/step/job/workflow names to emoji-prefixed, choosing a
task-fitting icon per action (📦 install, ✅ ensure, 🔍 probe, 🥾 bootstrap,
🚀 deploy, 🧩 service-module load, ⬇️ checkout, 📂 include-routines, ...)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The patch task in 02_ldap.yml ran `compose exec friendica` before the
container was up (it sits before the meta: flush_handlers in 01_core.yml),
and even after a forced flush it raced the entrypoint rsync that copies
/usr/src/friendica/ into the /var/www/html volume. The script then saw
`addon/ldapauth/ldapauth.php` missing and exited 1 with the misleading
"NO-MATCH ldap_createaccount return-line shape changed upstream" — for
30 retries × 2s, then fatal. CI run 25967376208 (job 76334304707) hit
this on the first push that introduced the patch task (9763cd8a4).
Fix: move the patch into 04_addons.yml, after both readiness probes
(`bin/console list` for vendor/addon rsync, `addon list all` for DB)
and before the addon sync that enables ldapauth. Gated by
FRIENDICA_LDAP_ENABLED. Drops the retries/until — once those probes
pass, the file is guaranteed present, so a non-zero exit now means real
upstream drift and should fail loud.
02_ldap.yml is back to the pre-patch shape: template ldapauth.config.php
and notify compose up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Root cause: upstream friendica-addons/ldapauth's `ldap_createaccount`
returns the raw `User::create()` result (`['user' => UserRow, 'password' => '']`),
but the `authenticate` hook only sets `authenticated = 1` when
`$user['uid']` is non-empty — never true for the autocreate path. First-
login LDAP users (e.g. biber) were inserted into `friendica.user` but
the session was never started, so /network kept serving the login form.
Encoded as an idempotent in-container patch task in `tasks/02_ldap.yml`
+ `files/patch_ldapauth_autocreate.sh` (reports PATCHED on first run,
ALREADY on subsequent runs). Runs whenever LDAP is wired, gated by
FRIENDICA_LDAP_ENABLED.
Other changes in the same stack:
- meta/services.yml: drop keycloakpassword addon (oauth2-proxy in front
owns SSO); ldap.enabled now follows svc-db-openldap group presence so
the variant matrix can disable it without a static override.
- tasks/01_core.yml + tasks/06_user_bootstrap.yml: pre-create the
administrator only in LDAP-disabled variants — when LDAP is wired,
ldapauth materialises the row on first admin login.
- files/playwright.spec.js: variant-aware spec replacing the parked
test.skip cases. Three tests now run: guest flow (always), admin
native login (picks double-login vs direct based on
OAUTH2_SERVICE_ENABLED), biber + admin side-by-side in isolated
contexts. PERSONA_* still blocked — friendica has no header-trusted
autocreate path.
- templates/playwright.env.j2: expose BIBER_* + service-gate flags.
- inventories/development/default.yml: biber email aligned with the
oauth2-proxy `email_domains = infinito.example` filter so biber's
Keycloak login isn't 403'd at the proxy.
- TODO.md: SAML migration outlined as the long-term replacement for
the double-login (currently second hop silently bypasses Keycloak 2FA).
Drive-by: trim double-space before `# nocheck` in
roles/sys-aur/meta/services.yml.
Verified on VARIANT=0 (oauth2 + ldap + oidc all enabled): three
playwright tests green, failed=0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Makefile lint integration:
* scripts/install/lint.sh: replace the prior checkmake binary install with
ensure_mbake (mbake is pip-installable, parses our Makefile correctly
whereas checkmake bailed on .ONESHELL: / .SHELLFLAGS: / ifneq).
* scripts/lint/makefile.sh: new runner — `mbake format --check Makefile`
reports formatting drift and missing .PHONY declarations.
* scripts/lint/autoformat.sh: add a two-pass `mbake format Makefile`
(mbake's formatter is not strictly idempotent on the first pass).
* Makefile: split the multi-line `.PHONY:` block into 18 single-line
`.PHONY:` declarations so mbake's parser can validate it; add the
previously-missing `install-python-dev` and `build-dependency` PHONY
targets; add `lint-makefile` aggregate-and-direct target.
* .pre-commit-config.yaml: new make-lint-makefile hook scoped to
`^Makefile$`.
* .github/workflows/lint-makefile.yml: new CI workflow (pip-install mbake
+ make lint-makefile).
* .github/workflows/ci-orchestrator.yml: wire lint-makefile into
lint-gate.needs.
Misc:
* .gitignore: add roles/importer_result.json (tooling artefact written by
galaxy-importer when it runs in roles/).
Plus working-tree drift across roles/, group_vars/, inventories/, and
tasks/ that accumulated from the make-test setup phase regenerating
generated artefacts during recent test runs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Marks each role's primary entity (`mastodon`, `friendica`, `pixelfed`)
as `shared: true; enabled: true` in meta/services.yml so the variant-
aware service registry resolves them. Consumer roles can now pull any
of the three in via `services.<entity>.enabled: true; shared: true`
(e.g. from a variant) without listing the role under
`meta/main.yml.dependencies` and without committing every deploy of
the consumer role to a heavyweight Fediverse pull-in.
To pass the service-role schema lint each tasks/main.yml now collapses
to a thin wrapper that includes a new tasks/01_core.yml under a
`run_once_<role_slug>` guard, and 01_core.yml ends with the role's
existing setup pipeline. The pre-existing step files are renumbered
to leave 01 free for the canonical entry point:
web-app-mastodon
00_overrides.yml -> 02_overrides.yml
01_setup.yml -> 03_setup.yml
02_wait.yml -> 04_wait.yml
03_cleanup.yml -> 05_cleanup.yml
04_administrator.yml -> 06_administrator.yml
web-app-friendica
01_ldap.yml -> 02_ldap.yml
02_patch_config.yml -> 03_patch_config.yml
03_addons.yml -> 04_addons.yml
web-app-pixelfed
00_bootstrap.yml -> 02_bootstrap.yml
01_administrator.yml -> 03_administrator.yml
02_oidc_mapping.yml -> 04_oidc_mapping.yml
Each role's 01_core.yml wires the renumbered files via include/import
exactly where the previous main.yml did. No behaviour change for
direct deploys (APPS=web-app-<role>) — load_app.yml already gates on
`run_once_<role>`, so the wrapper is invariant under the existing
direct-deploy path. Variant-driven service-registry pull-ins now work
end-to-end for these three roles.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 4.8