mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 20:26:33 +00:00
kevinveenbirkenbachandClaude Opus 5
5b8465260f
An image bump in a provider redeployed every variant of every consumer, including the variants that switch that provider off and therefore never deploy the bumped image at all. The diff-derived whitelist now narrows each affected role to the variants whose own round closure still reaches a seed, emitted as `role#0,2` selection tokens. That closure is walked on the same variant-merged services maps the matrix planner builds its rounds from, so the narrowing follows a parent's variant choice across every generation of the chain. It covers every auto-derived whitelist: the weekly update PRs, Dependabot, and any other diff-driven run. The narrowing never shrinks the matrix on partial information. A seed role keeps every variant, because its own files changed. A role reached only through a run_after edge keeps every variant too, because the round closure does not follow that edge and a role whose hits are empty is therefore unnarrowed rather than dropped. A pinned token naming a role the discovery query does not return now warns instead of aborting the run. The diff-derived whitelist legitimately names roles the lifecycle envelope filters out, and once it pins variants such a token would abort every chunk; role names are still checked against roles/ before the run starts, so a typo is caught one layer earlier. The round's variant merge moves out of the deploy inventory package into utils/roles/applications/variants.py. The CI selection has to build the same maps, and importing the deploy package for them pulls in a module that reads INFINITO_SRC_DIR at import time, which the runner host does not set. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Application Utilities (utils/roles/applications/) 🧩
This package contains shared Python helpers that operate on the central applications configuration dictionary.
Purpose 🎯
Modules in utils/roles/applications/ MUST provide reusable helpers for reading, resolving, and validating application configuration.
Helpers MUST stay independent of Ansible plugin entrypoints so the same code can be imported from filter plugins, lookup plugins, and library modules.
Example Import ✍️
from utils.roles.applications import config
value = config.get(
applications,
application_id,
"features.oidc",
strict=False,
default=False,
)
Design Guidelines 📐
- Helpers SHOULD be focused, composable, and free of side effects during import.
- Helpers MUST NOT depend on Ansible plugin loader behavior at import time.
- Helpers SHOULD raise typed exceptions (e.g.
AppConfigKeyError) so callers can react to missing keys in strict mode. - Public functions SHOULD use concise names (e.g.
get) and rely on module-qualified access at call sites (config.get(...)) for clarity.
What Does Not Belong Here 🚫
- Standalone executable modules MUST live in
library/. - Ansible plugin entrypoints MUST live under
plugins/*. - Cross-cutting helpers that are not application-specific SHOULD live in the parent
utils/package instead.