mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
ef5ea7cb55
meta/schema.yml held credential definitions and their runtime values, but the name said 'schema' and read like structural metadata next to services.yml and volumes.yml. Nothing in the file is a schema in the sense the other meta files use the word, and a contributor had to open it to learn it holds secrets. 62 role files renamed. ROLE_FILE_META_SCHEMA becomes ROLE_FILE_META_SECRETS and keeps its role as the SPOT the path is built from. Two readers bypassed that constant and spelled the name themselves: utils/cache/applications.py built meta_dir / 'schema.yml' twice, and plugins/lookup/application_gid.py carries the filename in the marker list it detects application roles by. Left behind, the rename would not have raised — credentials would have resolved empty and the role would have stopped counting as an application. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
44 lines
1.5 KiB
Python
44 lines
1.5 KiB
Python
"""Extract literal ``default:`` credential values from a ``meta/secrets.yml``
|
|
``credentials:`` tree.
|
|
|
|
Kept in its own module so ``utils.cache.applications`` stays under the
|
|
repo's per-file line cap. Strictly ansible-free (stdlib only) so the
|
|
runner-host CLI path keeps importing it without ansible installed.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from collections.abc import Mapping
|
|
from typing import Any
|
|
|
|
_LEAF_MARKERS: tuple[str, ...] = ("default", "algorithm", "validation", "description")
|
|
|
|
|
|
def extract_default_credentials(creds_node: Any) -> dict[str, Any]:
|
|
"""Return the subset of a ``credentials:`` tree's leaves that carry a
|
|
literal ``default:`` Jinja string.
|
|
|
|
The shape mirrors the schema tree: nested keys stay nested. The literal
|
|
string is preserved verbatim, with no rendering and no validation. Leaves
|
|
WITHOUT ``default:`` are intentionally absent so the inventory's
|
|
apply_schema-generated values win the merge.
|
|
"""
|
|
if not isinstance(creds_node, Mapping):
|
|
return {}
|
|
|
|
if any(marker in creds_node for marker in _LEAF_MARKERS):
|
|
return {}
|
|
|
|
out: dict[str, Any] = {}
|
|
for key, value in creds_node.items():
|
|
if not isinstance(value, Mapping):
|
|
continue
|
|
if any(marker in value for marker in _LEAF_MARKERS):
|
|
if "default" in value:
|
|
out[key] = value["default"]
|
|
else:
|
|
nested = extract_default_credentials(value)
|
|
if nested:
|
|
out[key] = nested
|
|
return out
|