fix(staging): generated staging secrets get a valid ALERTMANAGER_NTFY_TOPIC #271

Merged

jfraeys merged 3 commits from jfraeys/fix/staging-ntfy-topic into main

2026-10-17 15:50:56 -04:00

jfraeys commented

2026-10-17 15:28:20 -04:00

Owner

staging-validate on 4460c44 (run 1003) failed in the services deploy at `alertmanager : Fail if the ntfy topic is unsafe to use in a URL or too guessable`. Regenerating `secrets/staging.sops.yml` for the key rename (#269) was the first time `ALERTMANAGER_NTFY_TOPIC` appeared in the staging file, and `gen-staging-secrets.py` gave it the catch-all `staging-unused` (14 chars); the role requires 16-64 characters of `A-Za-z0-9_-`.

Fix: the generator returns `staging-` + 24 random hex characters for that key (valid, random, so nobody subscribes to it). Test: `scripts/tests/test_gen_staging_secrets.py`, in lint; it also asserts the role still has the rule it assumes.

Needs the operator before merge (the staging file on main is the broken one):

check out this branch in a worktree, run `scripts/secrets/gen-staging-secrets.py`
`git add secrets/staging.sops.yml && git commit -m "chore(secrets): regenerate staging file" && git push`
merge, then staging-validate runs again.

I checked the other format rules in the roles (`grep 'is match('`): only this one applies to a vault-sourced value that staging exercises. Later tasks in the services play have not run yet in this failure, so another surprise is possible.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

staging-validate on 4460c44 (run 1003) failed in the services deploy at \`alertmanager : Fail if the ntfy topic is unsafe to use in a URL or too guessable\`. Regenerating \`secrets/staging.sops.yml\` for the key rename (#269) was the first time \`ALERTMANAGER_NTFY_TOPIC\` appeared in the staging file, and \`gen-staging-secrets.py\` gave it the catch-all \`staging-unused\` (14 chars); the role requires 16-64 characters of \`A-Za-z0-9_-\`. Fix: the generator returns \`staging-\` + 24 random hex characters for that key (valid, random, so nobody subscribes to it). Test: \`scripts/tests/test_gen_staging_secrets.py\`, in lint; it also asserts the role still has the rule it assumes. **Needs the operator before merge** (the staging file on main is the broken one): 1. check out this branch in a worktree, run \`scripts/secrets/gen-staging-secrets.py\` 2. \`git add secrets/staging.sops.yml && git commit -m "chore(secrets): regenerate staging file" && git push\` 3. merge, then staging-validate runs again. I checked the other format rules in the roles (\`grep 'is match('\`): only this one applies to a vault-sourced value that staging exercises. Later tasks in the services play have not run yet in this failure, so another surprise is possible. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 1 commit

2026-10-17 15:28:20 -04:00

fix(staging): generated staging secrets get a valid ALERTMANAGER_NTFY_TOPIC

Lint / lint (pull_request) Successful in 2m32s

Details

Secret scan / scan (pull_request) Successful in 13s

Details

6cd74a358e

The generator wrote 'staging-unused' (14 chars) for it; the alertmanager role requires 16-64 chars of
A-Za-z0-9_-, so the staging services deploy failed on the regenerated staging.sops.yml (run 1003).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 2 commits

2026-10-17 15:42:16 -04:00

Merge remote-tracking branch 'origin/main' into jfraeys/fix/staging-ntfy-topic 9d3a250e55

chore(secrets): regenerate staging file with a valid ntfy topic

Lint / lint (pull_request) Successful in 2m33s

Details

Secret scan / scan (pull_request) Successful in 28s

Details

8fd86b382a

jfraeys merged commit 3852fa91d2 into main

2026-10-17 15:50:56 -04:00

jfraeys referenced this pull request from a commit