mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
d86913225b
compare_application_keys skips generated credentials because no default exists for a secret, but it recognised them by the pre-rename prefix. Once the generator started writing them again, every credential arrived as secrets.credentials.<key> and the exemption stopped matching, so validation rejected three keys per credential -- the leaf and both intermediate nodes, which recursive_keys emits separately -- and aborted the deploy before the playbook ran. The condition now admits the bare secrets node and the secrets.credentials subtree, leaving a sibling such as secrets.other flagged. The check in the inventory manager stays on the bare prefix on purpose: it walks meta/secrets.yml, whose own root key is credentials. test_credentials_keys_are_skipped fed the validator the old shape, so it kept passing while real inventories were being rejected. Evidence: run 31655559799, job 94311023723, "Missing default for web-app-dashboard: secrets.credentials.sso_proxy_cookie_secret". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>