fix: add git-scrub and macbash, and clear the open issue residuals - #70
Merged
Conversation
We use git-scrub to rewrite AI residue and leaked secrets out of git history, but nothing in the installer put it on a box -- everyone was fetching it by hand. It goes in contributor rather than soe because it is what clears a gitleaks failure, and gitleaks scans full history: a secret removed from HEAD still fails the gate. soe inherits it through meta/dependencies. Snipeable on its own with --tags git-scrub. GitHub release tarball on every platform. That is the only rung going -- it is not on crates.io, downloads.hyperi.io serves no git-scrub path, and the release ships a git-scrub.rb that is not in our tap yet, so macOS takes the darwin asset until someone taps it. The tarball is kept rather than deleted, and that is what makes the role idempotent: get_url re-reports ok for an unchanged asset so the extract and install stay skipped on a converged box. We cannot ask the binary its version instead -- v1.0.2 reports itself as "git-scrub 1.0.1".
CONTRIBUTING.md asks for macbash on every shell change, and the installer never put it on a box. Same placement as git-scrub: contributor, so an outside contributor gets it and soe inherits it. Linux takes the bare binary from downloads.hyperi.io rather than the .deb/.rpm beside it. Those carry the version in their filename and would need a release lookup; the bare asset does not, so this path makes no GitHub API call at all. macOS taps hyperi-io/tap and installs the formula. Upstream publishes a .sha256 next to each asset, so we verify the digest instead of trusting the transport. That is also what makes it idempotent -- the asset name has no version in it, so nothing else would notice a republished binary. The two single-tool verify blocks we would now have are folded into one loop over git-scrub and macbash.
Every Ansible call site already carries hyperi_github_headers -- checked one by one, and the counts match. hyperi-rust-setup was the one caller the uri module's headers could never cover: it does its own sccache release lookup and had no token handling at all, so it burned anonymous quota on the shared egress address mid-converge. Two halves, because the script alone is not enough. An exported token survives become to the SAME user but is stripped becoming a different one, which is exactly the fleet shape hyperi-infra connects in -- so the task has to hand it over explicitly. hyperi_github_env is the process -environment twin of hyperi_github_headers, empty when no token is set, so a single-laptop install is unchanged. Left alone deliberately: hyperi-update-linux.sh makes the same unauthenticated lookups, but hyperi-update.service runs as actual_user with no Environment=, so patching the script would change nothing until we decide where a fleet box gets a token from.
#59) Four things that all showed up while checking whether the open issues were still true. Most of them were not, so these are the residuals. The build lock waited forever. hyperi-rust-govern is ~/.local/bin/cargo on every SOE box, so a daemon that inherits fd 9 and never lets go wedges every later cargo command with no log line at all. It now waits HYPERI_RUST_GOVERN_LOCK_WAIT (30 min) and then builds unserialised, naming the holder. Serialisation is an optimisation, so degrading beats hanging. The macOS mkdir branch had the same unbounded shape and gets the same bound. An unopenable lock file is now reported as that, rather than as contention. init.yml was being skipped. The include carried tags: ['always'] but no apply block, so the include ran and its tasks kept no tags of their own -- under any narrow --tags run, every fact it sets silently vanished. That is the real reason --tags typescript died on an undefined pnpm_env, and pnpm_env moves into init.yml where the other shared facts live. XDG_RUNTIME_DIR pointed at the wrong user. All four sites derived it from ansible_facts['user_uid'], which is the CONNECTING user -- so on a split-user machine the systemd --user calls targeted an account with no session. It comes from actual_user via getent now. sccache enable and start both had failed_when: false and appended no warning, so a failure said nothing at all -- the exact silence that would hide the lock wedge coming back. alint installs through cargo with no distribution gate, so it runs on macOS with a PATH that lacked /opt/homebrew/opt/rustup/bin. brew's rustup never links its shims into /opt/homebrew/bin, so no cargo resolved there.
catinspace-au
changed the title
This was referenced Aug 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Started as "add git-scrub to the installer", then grew because we went to check whether the open issues were still true and mostly they were not. Four commits: two new tools, and the residuals that survived the check.
The two tools
git-scrub and macbash both go in
contributor, notsoe, so an outside contributor gets them and soe inherits through meta/dependencies. Snipeable as--tags git-scruband--tags macbash..sha256, which is also what makes it idempotent -- the asset name carries no version, so nothing else would notice a republished binary.The issue residuals
We checked each open issue against the code before touching anything, and none of them was true as filed:
hyperi_github_headers. The one real gap washyperi-rust-setup, which does its own release lookup and had no token handling. Needs two halves: an exported token survivesbecometo the SAME user but is stripped becoming a different one, which is the fleet shape, so the task hands it over explicitly.~/.local/bin/cargoon every SOE box, and the lock wait was unbounded. Now bounded, and it degrades to an unserialised build rather than hanging.init.ymlwas included withtags: ['always']and noapplyblock, so its tasks kept no tags and every fact it sets vanished under a narrow--tagsrun.Two extras found on the way: all four
XDG_RUNTIME_DIRsites derived the uid from the CONNECTING user, and the sccache enable/start both swallowed failures with no warning.Done when a converge installs both tools, a second run is green, and a stuck build lock warns instead of hanging.
Verified
okwith the install steps skipping.--tags typescript --checkwent fromfatal: 'pnpm_env' is undefinedtofailed=0.token=[]before the fix and the token after.bash -nunder real bash 3.2 (dockerbash:3.2). Timeout test degrades at exactly 4s instead of hanging. The macOS mkdir branch was forced via a stripped PATH -- uncontended, stale-holder-cleared and live-holder-timeout all correct.cargo --versionruns through the updated deployed shim on a real box.--tags contributor --check: 152 ok, failed=0.tools/ci/run-tests.sh: all available checks passed.Not verified
macOS, at all -- no Mac in reach. That covers the macbash brew tap, the alint PATH fix, and the macOS lock branch beyond the forced-PATH simulation. Three of those changes are macOS-only, so they want a look on real hardware before anyone trusts them.
Caught in review, worth knowing
An earlier draft of the governor wrote
exec 9>"$LOCK" 2>/dev/null. On the success path that redirect persists and silences the build's own stderr -- every compiler error from every cargo build, gone. A test printing to both streams returned only stdout, which is how it was found. Removed.