Authenticate site deploys before building

allod-agent commented

2026-09-06 23:26:01 +01:00

Member

Site deploy now logs in to the hosting remote before building, so a bad credential fails immediately instead of wasting a full build.
Missing remotes, unreadable configuration, rejected usernames or passwords, and unreachable hosts each get one actionable sentence; raw rclone probe output stays hidden.
The destination, exclusion rules, build, sync, dry-run, and HTTPS verification behavior are unchanged after a successful preflight.
Configure no longer tells the operator to run rclone, which is unavailable on their PATH; it says the next deploy will perform the check.
Focused success and sabotage tests cover probe ordering, exact arguments, every diagnosis, selected-config remedies, reserved exit status 7, and truthful sync failure wording; all tagged and untagged Go tests and vet checks pass.
The repository flake gate remains blocked by an unrelated baseline failure in PR-explain component test 23, described under Validation.
Rollback is one revert; deploys then return to the previous name-only remote check.

Closes allod/tools#162

The shared siteRemoteCheck(configPath string) probe runs rclone lsd shared: against the default configuration, or adds --config <path> when a later caller supplies one. reportSiteRemoteFailure(result, configPath) contains command-neutral wording so a no-publish credential check can reuse it without redirecting an explicit-path user to the default configuration. A preflight child exit 7 maps to exit 1 because allod reserves 7 for a completed deploy whose HTTPS verification failed; other nonzero child statuses are preserved.

Risk

R2: classification necessarily consumes rclone's human-readable failure text. The known rclone 1.72.1 and live FTP 530 forms are pinned in tests; unfamiliar wording fails closed with a generic check failure before the build. The probe lists the remote root but does not write it.

Validation

nix develop -c sh -c 'go test -tags site ./cmd/allod -run "Test(SiteDeployReportsRemoteFailuresBeforeBuilding|ReportSiteRemoteFailureUsesSelectedConfig|RcloneSiteRemoteCheck)$"'
nix develop -c sh -c 'test -z "$(gofmt -l .)" && go vet ./... && go test ./... && go vet -tags site ./... && go test -tags site ./...'
nix flake check remains blocked by the unchanged allod-parity component test 23: pr-explain/section-prompt.md lacks its expected not decoration phrase. Reproduced directly with a freshly built allod binary; this branch does not modify that file or test.
Confirmed the missing-remote, unreadable-config, and unreachable-host diagnostics emitted by rclone 1.72.1; the issue records the live hosting server's 530 rejection form.

Site deploy now logs in to the hosting remote before building, so a bad credential fails immediately instead of wasting a full build. Missing remotes, unreadable configuration, rejected usernames or passwords, and unreachable hosts each get one actionable sentence; raw rclone probe output stays hidden. The destination, exclusion rules, build, sync, dry-run, and HTTPS verification behavior are unchanged after a successful preflight. Configure no longer tells the operator to run rclone, which is unavailable on their PATH; it says the next deploy will perform the check. Focused success and sabotage tests cover probe ordering, exact arguments, every diagnosis, selected-config remedies, reserved exit status 7, and truthful sync failure wording; all tagged and untagged Go tests and vet checks pass. The repository flake gate remains blocked by an unrelated baseline failure in PR-explain component test 23, described under Validation. Rollback is one revert; deploys then return to the previous name-only remote check. Closes allod/tools#162 The shared `siteRemoteCheck(configPath string)` probe runs `rclone lsd shared:` against the default configuration, or adds `--config <path>` when a later caller supplies one. `reportSiteRemoteFailure(result, configPath)` contains command-neutral wording so a no-publish credential check can reuse it without redirecting an explicit-path user to the default configuration. A preflight child exit 7 maps to exit 1 because allod reserves 7 for a completed deploy whose HTTPS verification failed; other nonzero child statuses are preserved. ## Risk R2: classification necessarily consumes rclone's human-readable failure text. The known rclone 1.72.1 and live FTP 530 forms are pinned in tests; unfamiliar wording fails closed with a generic check failure before the build. The probe lists the remote root but does not write it. ## Validation - `nix develop -c sh -c 'go test -tags site ./cmd/allod -run "Test(SiteDeployReportsRemoteFailuresBeforeBuilding|ReportSiteRemoteFailureUsesSelectedConfig|RcloneSiteRemoteCheck)$"'` - `nix develop -c sh -c 'test -z "$(gofmt -l .)" && go vet ./... && go test ./... && go vet -tags site ./... && go test -tags site ./...'` - `nix flake check` remains blocked by the unchanged `allod-parity` component test 23: `pr-explain/section-prompt.md` lacks its expected `not decoration` phrase. Reproduced directly with a freshly built allod binary; this branch does not modify that file or test. - Confirmed the missing-remote, unreadable-config, and unreachable-host diagnostics emitted by rclone 1.72.1; the issue records the live hosting server's 530 rejection form.

allod-agent added 1 commit

2026-09-06 23:26:01 +01:00

Authenticate site deploys before building 26328df520

allod-agent referenced this pull request

2026-09-06 23:30:26 +01:00

Add named config, hosting layouts and credential lifecycle to allod site #167

allod-agent commented

2026-09-06 23:40:35 +01:00

Author

Member

Independent review found two behavior defects and one validation-claim defect. Please fix these additively before merge; the exact probe argv, output suppression, sync/config wording, and secret handling otherwise passed review.

P1: requireSiteRemote propagates arbitrary rclone exit statuses, including 7, but this command reserves 7 for “sync completed, HTTPS verification failed.” A pre-build authentication failure must never return the post-deploy verification code.
P2: reportSiteRemoteFailure has no selected config path, so the reusable explicit-config path can diagnose a missing/rejected credential and then tell the operator to edit the default file. Remediation must carry the same selected --config path safely.
P3: nix flake check currently fails in unchanged allod-parity test 23 because section-prompt.md lacks the expected not decoration phrase. Update the PR summary/Validation to report that baseline failure rather than saying the full gate passes.

Independent review found two behavior defects and one validation-claim defect. Please fix these additively before merge; the exact probe argv, output suppression, sync/config wording, and secret handling otherwise passed review. - P1: `requireSiteRemote` propagates arbitrary rclone exit statuses, including 7, but this command reserves 7 for “sync completed, HTTPS verification failed.” A pre-build authentication failure must never return the post-deploy verification code. - P2: `reportSiteRemoteFailure` has no selected config path, so the reusable explicit-config path can diagnose a missing/rejected credential and then tell the operator to edit the default file. Remediation must carry the same selected `--config` path safely. - P3: `nix flake check` currently fails in unchanged `allod-parity` test 23 because `section-prompt.md` lacks the expected `not decoration` phrase. Update the PR summary/Validation to report that baseline failure rather than saying the full gate passes.

allod-agent added 1 commit

2026-09-06 23:44:41 +01:00

Address site preflight review findings b705cb02b5

allod-agent commented

2026-09-06 23:45:31 +01:00

Author

Member

Addressed additively in b705cb0.

Pre-build rclone exit 7 now maps to exit 1, while other nonzero statuses remain preserved; the deploy test proves no build, sync, deployed wording, or reserved exit 7 escapes.
reportSiteRemoteFailure(result, configPath) now carries the selected path. Explicit-path remedies quote it safely, stay on one line even with control characters, and never point to default allod site config state.
The PR summary and Validation now disclose the unrelated baseline failure in PR-explain component test 23 instead of claiming the full flake gate passes.

Focused tests plus tagged and untagged Go tests and vet checks pass.

Addressed additively in `b705cb0`. - Pre-build rclone exit 7 now maps to exit 1, while other nonzero statuses remain preserved; the deploy test proves no build, sync, deployed wording, or reserved exit 7 escapes. - `reportSiteRemoteFailure(result, configPath)` now carries the selected path. Explicit-path remedies quote it safely, stay on one line even with control characters, and never point to default `allod site config` state. - The PR summary and Validation now disclose the unrelated baseline failure in PR-explain component test 23 instead of claiming the full flake gate passes. Focused tests plus tagged and untagged Go tests and vet checks pass.

vnprc force-pushed agent/site-auth-preflight from b705cb02b5 to 4215e60a8d

2026-09-09 20:11:44 +01:00

Compare

vnprc merged commit 4215e60a8d into master

2026-09-09 20:11:53 +01:00

vnprc deleted branch agent/site-auth-preflight

2026-09-09 20:11:53 +01:00

allod-agent commented

2026-09-09 20:13:34 +01:00

Author

Member

Status of the gate this chain reports as blocked, measured today.

The allod-parity failure at tests/pr-explain/components.sh test 23 no longer exists on master: f7c57b8 changed that assertion to the section prompt's current wording, so the "not decoration" expectation the four PR bodies name is gone. Nothing in this chain touches that file.

All four branches merge cleanly with current master. As a witness, I merged the chain tip (agent/site-credential-lifecycle, 17 commits over master) with master in a scratch clone and ran the full nix flake check: every check passed, including allod-parity, go-checks, and the cascade and flake-status suites. Nothing was pushed.

So the chain is ready to merge in order: #166, then #167, #168, #169. Each PR's Validation section still says the aggregate flake gate is blocked; that sentence is stale, and the rest of each body stands.

Status of the gate this chain reports as blocked, measured today. The `allod-parity` failure at `tests/pr-explain/components.sh` test 23 no longer exists on master: f7c57b8 changed that assertion to the section prompt's current wording, so the "not decoration" expectation the four PR bodies name is gone. Nothing in this chain touches that file. All four branches merge cleanly with current master. As a witness, I merged the chain tip (`agent/site-credential-lifecycle`, 17 commits over master) with master in a scratch clone and ran the full `nix flake check`: every check passed, including `allod-parity`, `go-checks`, and the cascade and flake-status suites. Nothing was pushed. So the chain is ready to merge in order: #166, then #167, #168, #169. Each PR's Validation section still says the aggregate flake gate is blocked; that sentence is stale, and the rest of each body stands.

Rows
Columns

Authenticate site deploys before building #166

Risk

Validation