pdurlej/platform

Fork 0

fix(ci): render ollama canary env aliases #605

Closed

codex wants to merge 0 commits from codex/m03-canary-ollama-env into main

codex commented

2026-05-29 15:44:40 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Summary

Fixes the canary Infisical bridge so regenerated runner-local canary.env includes Ollama-compatible keys for Patchwarden model review instead of depending on a manual append.

Closes #529

Canary Context Pack

Product story

Patchwarden should keep working after canary.env regeneration. The runner should not rely on hand-written OLLAMA_API_KEY / OLLAMA_BASE_URL aliases that disappear on the next bridge run.

What changed

Added default bridge specs for OLLAMA_CLOUD_API_KEY, OLLAMA_API_KEY, and OLLAMA_BASE_URL.
Kept OLLAMA_API_KEY as an alias sourced from OLLAMA_CLOUD_API_KEY.
Documented the Infisical provider mapping.
Added contract coverage for default rendering through API and CLI backends.

Why it changed

Patchwarden's Ollama lane expects Ollama-compatible environment names. Manual local appends are brittle and bypass the generator metadata contract.

Files touched

control-plane/platformctl/ci/write_canary_env.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
docs/forgejo-agent-operations.md
runbooks/forgejo-actions-runner.md

Relevant context

Issue #529
Canary Infisical Bridge runbook
Forgejo agent operations secret rules

Runtime evidence

Added OLLAMA_BASE_URL under Infisical /home-platform/providers in prod; value not printed.
Verified OLLAMA_CLOUD_API_KEY and OLLAMA_BASE_URL are present by key name and value length only.
Generated a temporary canary env from Infisical Token Auth and verified required key names only; temporary files were deleted.

Known constraints

The generated env file still lives on trusted runner-local state. Provider values are not committed and must not be copied into Forgejo repo secrets.

Explicit out-of-scope

No Patchwarden policy changes.
No model prompt changes.
No issue/comment writer.
No broad Infisical inventory or key map yet.

Requested decision

Merge if checks are green. This is a narrow merge-friction repair.

Merge blockers

Any evidence that OLLAMA_BASE_URL should not live in /home-platform/providers.
Any test or canary failure.

Spec sources read

control-plane/platformctl/ci/write_canary_env.py - generator contract
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py - existing tests
runbooks/forgejo-actions-runner.md - runner canary bridge docs
docs/forgejo-agent-operations.md - Infisical provider contract

Validation

UV_CACHE_DIR=/private/tmp/uv-cache-platform uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py - 42 passed
UV_CACHE_DIR=/private/tmp/uv-cache-platform PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json - exitCode 0, 88 modules ok
Live Infisical read check: required key names present; no secret values printed

Canary status: missing - fire canary 3+3 manually before merge ## Summary Fixes the canary Infisical bridge so regenerated runner-local `canary.env` includes Ollama-compatible keys for Patchwarden model review instead of depending on a manual append. Closes #529 ## Canary Context Pack ### Product story Patchwarden should keep working after `canary.env` regeneration. The runner should not rely on hand-written `OLLAMA_API_KEY` / `OLLAMA_BASE_URL` aliases that disappear on the next bridge run. ### What changed - Added default bridge specs for `OLLAMA_CLOUD_API_KEY`, `OLLAMA_API_KEY`, and `OLLAMA_BASE_URL`. - Kept `OLLAMA_API_KEY` as an alias sourced from `OLLAMA_CLOUD_API_KEY`. - Documented the Infisical provider mapping. - Added contract coverage for default rendering through API and CLI backends. ### Why it changed Patchwarden's Ollama lane expects Ollama-compatible environment names. Manual local appends are brittle and bypass the generator metadata contract. ### Files touched - `control-plane/platformctl/ci/write_canary_env.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `docs/forgejo-agent-operations.md` - `runbooks/forgejo-actions-runner.md` ### Relevant context - Issue #529 - Canary Infisical Bridge runbook - Forgejo agent operations secret rules ### Runtime evidence - Added `OLLAMA_BASE_URL` under Infisical `/home-platform/providers` in `prod`; value not printed. - Verified `OLLAMA_CLOUD_API_KEY` and `OLLAMA_BASE_URL` are present by key name and value length only. - Generated a temporary canary env from Infisical Token Auth and verified required key names only; temporary files were deleted. ### Known constraints The generated env file still lives on trusted runner-local state. Provider values are not committed and must not be copied into Forgejo repo secrets. ### Explicit out-of-scope - No Patchwarden policy changes. - No model prompt changes. - No issue/comment writer. - No broad Infisical inventory or key map yet. ### Requested decision Merge if checks are green. This is a narrow merge-friction repair. ### Merge blockers - Any evidence that `OLLAMA_BASE_URL` should not live in `/home-platform/providers`. - Any test or canary failure. ## Spec sources read - `control-plane/platformctl/ci/write_canary_env.py` - generator contract - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - existing tests - `runbooks/forgejo-actions-runner.md` - runner canary bridge docs - `docs/forgejo-agent-operations.md` - Infisical provider contract ## Validation - `UV_CACHE_DIR=/private/tmp/uv-cache-platform uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py` - 42 passed - `UV_CACHE_DIR=/private/tmp/uv-cache-platform PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` - exitCode 0, 88 modules ok - Live Infisical read check: required key names present; no secret values printed

codex added 1 commit

2026-05-29 15:44:40 +02:00

fix(ci): render ollama canary env aliases

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-pr-sanity / sanity (pull_request) Failing after 2m47s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 24s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 22s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 22s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

python-ci / Python 3.11 (pull_request) Successful in 42s

Details

python-ci / Python 3.13 (pull_request) Successful in 44s

Details

b10d6007f4

pdurlej referenced this pull request from a commit

2026-05-29 15:47:12 +02:00

Merge pull request #605 from codex/m03-canary-ollama-env

pdurlej commented

2026-05-29 15:47:39 +02:00

Owner

Manually integrated because Forgejo checks stayed pending/blocked, while local validation and live Infisical read-check were green.

Integrated on main via merge commit 3da8f3c08038ae89adc911ead1d6b09ecf2e741a.

Validation summary:

test_forgejo_ci_scripts_contract.py: 42 passed
platformctl validate all --json: exitCode 0, 88 modules ok
Infisical /home-platform/providers: OLLAMA_CLOUD_API_KEY and OLLAMA_BASE_URL present by metadata-only check
temporary generated canary.env was deleted after key-name verification

Manually integrated because Forgejo checks stayed pending/blocked, while local validation and live Infisical read-check were green. Integrated on `main` via merge commit `3da8f3c08038ae89adc911ead1d6b09ecf2e741a`. Validation summary: - `test_forgejo_ci_scripts_contract.py`: 42 passed - `platformctl validate all --json`: exitCode 0, 88 modules ok - Infisical `/home-platform/providers`: `OLLAMA_CLOUD_API_KEY` and `OLLAMA_BASE_URL` present by metadata-only check - temporary generated `canary.env` was deleted after key-name verification

pdurlej closed this pull request

2026-05-29 15:47:40 +02:00

pdurlej referenced this pull request

2026-05-29 15:48:11 +02:00

write_canary_env.py: add OLLAMA_API_KEY + OLLAMA_BASE_URL as proper Infisical specs #529

codex referenced this pull request

2026-05-29 16:49:41 +02:00

chore(m03): triage secrets/access backlog into active, deferred, superseded #538

codex referenced this pull request

2026-05-29 16:49:43 +02:00

fix(security): finish Bws/Infisical secrets injection — close 3-thread gap #237