mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
9d940f4040
ONLYOFFICE listed onlyoffice 10.2.0 in the Nextcloud appstore on 2026-09-18 at 10:16:31Z and never published the matching GitHub artifact; the tag itself does not exist. `occ app:install` takes the newest compatible release, so it dies on a 404 that no retry can heal. CI proved that twice independently: upstream run 35329488812 and fork run 35330645276 both fail Nextcloud#4 at that task after six attempts, on the same commit, for the same reason. The fault had three layers, each visible only once the one above it was gone. Install. meta/addons/onlyoffice.yml pins `config.archive` to v10.1.2, whose artifact answers 200 and which the appstore also lists for this server major. 01_install.yml stages that archive on the node and unpacks it into custom_apps through a stdin pipe: the webroot is a named volume, so the node can only reach the app directory through the container, and piping avoids both `container cp` and a cleanup step that would have to run as a user which does not own the file. Enable and configure needed no change at all. With the release already on disk `occ app:install` reports "already installed", which nextcloud_install_status has always mapped to runnable, so 02_enable.yml and 03_configure.yml proceed as they always did. That is why this commit adds no branch to the plugin pipeline. Update. `occ app:update --all` then dragged the pinned app back to the broken 10.2.0 and killed the deploy. occ offers no exclusion flag, but it does offer `--showonly` and single app ids, so a pinned app is simply not updated. The old `--all` call stays byte-identical and now carries a `when`: with nothing pinned, thirteen of the fourteen variants take exactly the path they took before. This layer cannot appear in CI at all, because it needs a second deploy with the app already installed, and the install always died first. The classifier test is inverted rather than deleted: test_an_advertised_release_whose_artifact_is_gone_stays_fatal pins the decision that a dead artifact fails loudly instead of degrading to a silent skip. Verified by a local compose deploy of variant 4: ok=2508 changed=149 failed=0 and `✓ 36 tests/addons/onlyoffice.spec.js:12:1`, which drives the whole JWT-authenticated round trip to the document server over its onion address, not merely an enabled plugin. In the live container beforehand: `occ app:enable` returned "onlyoffice 10.1.2 enabled", `occ app:install` returned "already installed", and `occ app:update onlyoffice` reproduced the 404 that the pin now avoids. The loop expression was wrong before this commit and is fixed here: Jinja reads '\1' as an octal escape, so the backreference produced chr(1) instead of an app id. Evaluated against ansible-core's own filters over four shapes, the tail is now cut instead of captured, which removes the escaping hazard entirely. occ output is not localised: with default_language=de and a de_DE.UTF-8 locale the strings are unchanged, so parsing them is as safe as the five markers the role already relied on. Residual: the per-app update branch has never run with a real item inside a deploy. Its chain and `occ app:update <id>` are each verified separately. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>