jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(ci): staging's app check installs the app's own Galaxy dependencies #287

Open
jfraeys wants to merge 2 commits from jfraeys/fix/app-check-installs-app-roles into main
pull from: jfraeys/fix/app-check-installs-app-roles
merge into: jfraeys:main
Conversation 0 Commits 2 Files changed 1 +15
jfraeys commented 2026-10-19 13:35:40 -04:00
Owner
Copy link

Summary

 run_app_check
   generate_staging_tailscale_key tag:web
   _deploy_web_base_layer
+  _install_app_requirements
+    ansible-galaxy collection install -r <app>/ansible/requirements.yml
+    ansible-galaxy role install -r <app>/ansible/requirements.yml -p ansible/roles
   _run_check "app"

<app>/ansible is the directory of APP_CHECK_PLAYBOOK. No requirements.yml there means no-op; a failed install fails the app check.

Evidence

  • Before: staging-validate run #855 (workflow_dispatch with an app repo) — base layer failed=0, then
    ERROR! the role 'app_base' was not found from app/ansible/staging-deploy.yml line 36 → [ERROR] app deploy FAILED.
    After: not yet run on a runner; needs a re-dispatch with the same app_repo after merge. Checked here only against a stubbed ansible-galaxy: 
    requirements.yml present, galaxy ok   -> installs collections then roles, rc=0
requirements.yml present, galaxy fails -> "[ERROR] ansible-galaxy install ... failed", rc=1
no requirements.yml (playbooks/web.yml) -> rc=0, nothing run

Merge Danger

Door: two-way

Blast Radius: staging-only

Push-triggered runs skip the app step (SKIP_APP_CHECK=true), so they are unaffected. Only dispatches with an app_repo change behaviour: they now fail earlier if the app's Galaxy sources are unreachable.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

## Summary ```diff run_app_check generate_staging_tailscale_key tag:web _deploy_web_base_layer + _install_app_requirements + ansible-galaxy collection install -r <app>/ansible/requirements.yml + ansible-galaxy role install -r <app>/ansible/requirements.yml -p ansible/roles _run_check "app" ``` `<app>/ansible` is the directory of `APP_CHECK_PLAYBOOK`. No `requirements.yml` there means no-op; a failed install fails the app check. ## Evidence - **Before:** staging-validate run #855 (`workflow_dispatch` with an app repo) — base layer `failed=0`, then `ERROR! the role 'app_base' was not found` from `app/ansible/staging-deploy.yml` line 36 → `[ERROR] app deploy FAILED`. **After:** not yet run on a runner; needs a re-dispatch with the same `app_repo` after merge. Checked here only against a stubbed `ansible-galaxy`: ```text requirements.yml present, galaxy ok -> installs collections then roles, rc=0 requirements.yml present, galaxy fails -> "[ERROR] ansible-galaxy install ... failed", rc=1 no requirements.yml (playbooks/web.yml) -> rc=0, nothing run ``` ## Merge Danger **Door:** two-way **Blast Radius:** staging-only Push-triggered runs skip the app step (`SKIP_APP_CHECK=true`), so they are unaffected. Only dispatches with an `app_repo` change behaviour: they now fail earlier if the app's Galaxy sources are unreachable. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
fix(ci): staging's app check installs the app's own Galaxy dependencies
All checks were successful
Lint / lint (pull_request) Successful in 2m54s
Details
Secret scan / scan (pull_request) Successful in 16s
Details
e9303ab2aa
 
The app's staging-deploy.yml needs roles (app_base) declared in its
ansible/requirements.yml; the runner only installed infra's, so a dispatch
with an app failed with "role 'app_base' was not found".

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Merge remote-tracking branch 'origin/main' into jfraeys/fix/app-check-installs-app-roles
All checks were successful
Lint / lint (pull_request) Successful in 3m6s
Details
Secret scan / scan (pull_request) Successful in 15s
Details
eaeab36ae8
All checks were successful
Lint / lint (pull_request) Successful in 3m6s
Details
Secret scan / scan (pull_request) Successful in 15s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin jfraeys/fix/app-check-installs-app-roles:jfraeys/fix/app-check-installs-app-roles
git switch jfraeys/fix/app-check-installs-app-roles

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff jfraeys/fix/app-check-installs-app-roles
git switch jfraeys/fix/app-check-installs-app-roles
git rebase main
git switch main
git merge --ff-only jfraeys/fix/app-check-installs-app-roles
git switch jfraeys/fix/app-check-installs-app-roles
git rebase main
git switch main
git merge --no-ff jfraeys/fix/app-check-installs-app-roles
git switch main
git merge --squash jfraeys/fix/app-check-installs-app-roles
git switch main
git merge --ff-only jfraeys/fix/app-check-installs-app-roles
git switch main
git merge jfraeys/fix/app-check-installs-app-roles
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!287
No description provided.