mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
93cbd2045e
manage.py create-profile and update-profile parse their options with
argparse, and `-p <value>` reads a value that starts with `-` as the next
option. A generated password with a leading dash therefore fails both
commands with exit 2 ("argument -p/--password: expected one argument")
before they reach the backend, and the bootstrap task retries until it
gives up. On main this broke the guide run of Penpot#2 in run
39668792538: the Docker events of the rescue snapshot show eight
create-profile execs ending with exit 2 while the backend was healthy
and its prepl received no call.
Without -p, manage.py reads the password with getpass, which falls back
to stdin when the exec has no TTY. Both tasks now feed the password to
`container exec -i` on stdin. This also keeps the password out of the
exec command line, which Docker writes into its event stream and
therefore into the rescue diagnostics artifacts.
The password-quote lint masked only block `stdin: |` / `stdin: >`
values and flagged the inline `stdin: "{{ PENPOT_ADMIN_PASSWORD }}"` as
an unquoted password in a shell command. stdin never reaches a shell, so
the lint now masks every `stdin:` form; an unquoted password in `cmd`
is still reported.
Fixes #1139
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Identity & Access Integration Tests 🔐
Integration tests for identity and access surfaces: OAuth2 / OIDC configuration invariants (mutual exclusion, ACL shape, proxy port allocation, RBAC group-path declarations) and password / secret quoting rules.
Each child directory pins one IAM surface; see the per-directory README for scope. Generic OIDC-redirect URI checks and domain rules live under meta/domains/; port allocations live under tests/integration/ports/ once introduced.
For framework and make test-integration usage see integration.md.