write_canary_env.py: add OLLAMA_API_KEY + OLLAMA_BASE_URL as proper Infisical specs #529

New issue

Closed

opened 2026-05-28 00:05:26 +02:00 by claude · 1 comment

claude commented

2026-05-28 00:05:26 +02:00

Collaborator

Context

During pdurlej/platform#527 smoke validation (post-#524 wave end-to-end test, 2026-05-28 00:00), patchwarden review-run reached cloud Ollama via newly-added bearer auth (pdurlej/patchwarden#60) and posted findings to the PR successfully. Smoke-confirmed end-to-end:

patchwarden-client-dry-run / dry-run    Successful in 1m6s
PR #527 comment: "No Patchwarden findings to render."

Problem

To wire this, I manually appended two aliases to /opt/forgejo-runner/data/platformctl/canary.env:

# Aliases for Patchwarden cloud Ollama (manual; should be added to write_canary_env.py specs)
OLLAMA_API_KEY=$OLLAMA_CLOUD_API_KEY
OLLAMA_BASE_URL=https://ollama.com

The file header explicitly says Generated by platformctl canary Infisical bridge. Next time write_canary_env.py regenerates the file, these two lines will be lost — silently breaking the Patchwarden Ollama flow on the next runner deploy or canary refresh.

Proposed fix

Update the spec list that write_canary_env.py consumes so that OLLAMA_API_KEY and OLLAMA_BASE_URL are first-class entries. Two reasonable shapes:

A) Sourced from Infisical (preferred — single source of truth):

OLLAMA_API_KEY=/home-platform/providers:OLLAMA_CLOUD_API_KEY
OLLAMA_BASE_URL=/home-platform/providers:OLLAMA_BASE_URL   # add this secret to Infisical, value "https://ollama.com"

B) Alias-style (mirror what I did manually but baked into the generator):

Generator post-processing adds OLLAMA_API_KEY=$OLLAMA_CLOUD_API_KEY and OLLAMA_BASE_URL=https://ollama.com to the rendered file when OLLAMA_CLOUD_API_KEY is present.

(A) is cleaner — no hidden post-processing magic. (B) avoids adding a new Infisical entry but couples the generator to a specific OLLAMA contract.

Out of scope

The temporary manual aliases on the live runner stay in place until this issue ships — do not remove them without a replacement.
runner config.yaml + valid_volumes change (also applied manually on runner) is tracked in a separate follow-up issue.

Validation

After the change, regenerate canary.env, grep for both keys, then re-trigger pdurlej/platform#527's dry-run (push empty commit or re-run) — expect identical success + comment.

Refs: pdurlej/platform#524 #527 #528, pdurlej/patchwarden#60

## Context During `pdurlej/platform#527` smoke validation (post-#524 wave end-to-end test, 2026-05-28 00:00), `patchwarden review-run` reached cloud Ollama via newly-added bearer auth (`pdurlej/patchwarden#60`) and posted findings to the PR successfully. Smoke-confirmed end-to-end: ``` patchwarden-client-dry-run / dry-run Successful in 1m6s PR #527 comment: "No Patchwarden findings to render." ``` ## Problem To wire this, I manually appended two aliases to `/opt/forgejo-runner/data/platformctl/canary.env`: ```sh # Aliases for Patchwarden cloud Ollama (manual; should be added to write_canary_env.py specs) OLLAMA_API_KEY=$OLLAMA_CLOUD_API_KEY OLLAMA_BASE_URL=https://ollama.com ``` The file header explicitly says `Generated by platformctl canary Infisical bridge`. Next time `write_canary_env.py` regenerates the file, **these two lines will be lost** — silently breaking the Patchwarden Ollama flow on the next runner deploy or canary refresh. ## Proposed fix Update the spec list that `write_canary_env.py` consumes so that `OLLAMA_API_KEY` and `OLLAMA_BASE_URL` are first-class entries. Two reasonable shapes: **A) Sourced from Infisical** (preferred — single source of truth): ``` OLLAMA_API_KEY=/home-platform/providers:OLLAMA_CLOUD_API_KEY OLLAMA_BASE_URL=/home-platform/providers:OLLAMA_BASE_URL # add this secret to Infisical, value "https://ollama.com" ``` **B) Alias-style** (mirror what I did manually but baked into the generator): - Generator post-processing adds `OLLAMA_API_KEY=$OLLAMA_CLOUD_API_KEY` and `OLLAMA_BASE_URL=https://ollama.com` to the rendered file when `OLLAMA_CLOUD_API_KEY` is present. (A) is cleaner — no hidden post-processing magic. (B) avoids adding a new Infisical entry but couples the generator to a specific OLLAMA contract. ## Out of scope - The temporary manual aliases on the live runner stay in place until this issue ships — do not remove them without a replacement. - `runner config.yaml` + `valid_volumes` change (also applied manually on runner) is tracked in a separate follow-up issue. ## Validation After the change, regenerate canary.env, grep for both keys, then re-trigger `pdurlej/platform#527`'s `dry-run` (push empty commit or re-run) — expect identical success + comment. Refs: `pdurlej/platform#524 #527 #528`, `pdurlej/patchwarden#60`

claude added the

ready-for-agent

tier/lite

labels

2026-05-28 00:05:26 +02:00

codex added this to the 03 - Secrets and access hardening milestone

2026-05-28 01:21:51 +02:00

codex referenced this issue

2026-05-28 01:21:52 +02:00

chore(m03): triage secrets/access backlog into active, deferred, superseded #538

codex referenced this issue from a pull request that will close it,

2026-05-29 15:44:40 +02:00

fix(ci): render ollama canary env aliases #605

pdurlej commented

2026-05-29 15:48:11 +02:00

Owner

Closed by PR #605 / main merge commit 3da8f3c08038ae89adc911ead1d6b09ecf2e741a.

What changed:

write_canary_env.py now renders OLLAMA_CLOUD_API_KEY, OLLAMA_API_KEY, and OLLAMA_BASE_URL from the default Infisical map.
OLLAMA_API_KEY is sourced from /home-platform/providers:OLLAMA_CLOUD_API_KEY.
OLLAMA_BASE_URL exists in /home-platform/providers as provider configuration.
live read-check verified key presence without printing values.

Closed by PR #605 / main merge commit `3da8f3c08038ae89adc911ead1d6b09ecf2e741a`. What changed: - `write_canary_env.py` now renders `OLLAMA_CLOUD_API_KEY`, `OLLAMA_API_KEY`, and `OLLAMA_BASE_URL` from the default Infisical map. - `OLLAMA_API_KEY` is sourced from `/home-platform/providers:OLLAMA_CLOUD_API_KEY`. - `OLLAMA_BASE_URL` exists in `/home-platform/providers` as provider configuration. - live read-check verified key presence without printing values.

pdurlej closed this issue

2026-05-29 15:48:11 +02:00

codex referenced this issue

2026-05-29 16:49:41 +02:00

chore(m03): triage secrets/access backlog into active, deferred, superseded #538