allod secret and patch: read the repository registry through INVENTORY, not a hard-coded public path #217

New issue

Closed

opened 2026-09-19 14:00:01 +01:00 by allod-agent · 0 comments

allod-agent commented

2026-09-19 14:00:01 +01:00

Member

On a private deployment, allod secret rotate finds the public template's secrets checkout instead of the operator's own, and prints deploy steps against ~/work/allod/deploy when the deployment's composition root is elsewhere, because the repository registry is read from a literal ~/work/allod/inventory/scripts/repositories.json. The host already declares where inventory lives (nexus.provisioning.inventoryCheckout, rendered into the operator session as INVENTORY), every nexus script resolves the registry through that variable, and allod secret declare honors it for its machine-type lookup; only the registry reader in cmd/allod/registry.go ignores it.

Primary goals:

One pointer, derived everything — registryCheckout reads $INVENTORY/scripts/repositories.json when INVENTORY is set, and falls back to <work>/allod/inventory/scripts/repositories.json otherwise, so a public checkout still needs no configuration and a private deployment configures nothing beyond the inventory pointer it already has.
Every consumer follows — secrets, deploy, and inventory resolution in allod secret, and the registry-id resolution in allod patch, all go through the same reader, so there is no second place to configure.
No recursion — inventoryCheckout falls back to the registry for the inventory alias; the reader must not call it back.

Observed

On nexus with INVENTORY=/home/vnprc/work/inventory set and the private secrets checkout at ~/work/secrets on a non-default branch, allod secret rotate --dry-run forgejo-https-token-svelte-dev refused with /home/vnprc/work/allod/secrets is on its default branch 'master'. Passing the checkout as the trailing argument works around it; refresh-local-auth needs no workaround because it reads INVENTORY.

Scope

In: the registry reader, its tests, and the docs/allod-secret.md sentence on where things are found. Out: new per-repo variables (a secrets or deploy path beside the registry would be a second source of truth), and the nexus side, which already renders the pointer.

Refs allod/nexus#52

On a private deployment, `allod secret rotate` finds the public template's secrets checkout instead of the operator's own, and prints deploy steps against `~/work/allod/deploy` when the deployment's composition root is elsewhere, because the repository registry is read from a literal `~/work/allod/inventory/scripts/repositories.json`. The host already declares where inventory lives (`nexus.provisioning.inventoryCheckout`, rendered into the operator session as `INVENTORY`), every nexus script resolves the registry through that variable, and `allod secret declare` honors it for its machine-type lookup; only the registry reader in `cmd/allod/registry.go` ignores it. Primary goals: - **One pointer, derived everything** — `registryCheckout` reads `$INVENTORY/scripts/repositories.json` when `INVENTORY` is set, and falls back to `<work>/allod/inventory/scripts/repositories.json` otherwise, so a public checkout still needs no configuration and a private deployment configures nothing beyond the inventory pointer it already has. - **Every consumer follows** — `secrets`, `deploy`, and `inventory` resolution in `allod secret`, and the registry-id resolution in `allod patch`, all go through the same reader, so there is no second place to configure. - **No recursion** — `inventoryCheckout` falls back to the registry for the inventory alias; the reader must not call it back. ### Observed On nexus with `INVENTORY=/home/vnprc/work/inventory` set and the private secrets checkout at `~/work/secrets` on a non-default branch, `allod secret rotate --dry-run forgejo-https-token-svelte-dev` refused with `/home/vnprc/work/allod/secrets is on its default branch 'master'`. Passing the checkout as the trailing argument works around it; `refresh-local-auth` needs no workaround because it reads `INVENTORY`. ### Scope In: the registry reader, its tests, and the `docs/allod-secret.md` sentence on where things are found. Out: new per-repo variables (a secrets or deploy path beside the registry would be a second source of truth), and the nexus side, which already renders the pointer. Refs allod/nexus#52

allod-agent referenced this issue from a pull request that will close it,

2026-09-19 14:34:56 +01:00

allod: read the repository registry through INVENTORY, falling back to the public path #218

allod-agent referenced this issue from a commit

2026-09-19 14:34:57 +01:00

allod: registry reader honors INVENTORY

allod-agent referenced this issue from a commit

2026-09-19 14:34:57 +01:00

allod: fix registry review findings