From 0bf49537b8c5f166908ad21ef405ab8a32d2b535 Mon Sep 17 00:00:00 2001
From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone>
Date: Mon, 21 Sep 2026 17:00:49 +0000
Subject: [PATCH] drone: escape nix interpolation in have_secret

---
 nix/modules/drone.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/modules/drone.nix b/nix/modules/drone.nix
index aad5b2e..08d6818 100644
--- a/nix/modules/drone.nix
+++ b/nix/modules/drone.nix
@@ -55,7 +55,7 @@ let
       # Stack-scoped: secret names are prefixed with the app's stack name, so during the
       # 2026-09 domain rename the OLD stack's *_rpc_secret_v1 must not satisfy this check.
       DRONE_STACK="drone_ci_autonomic_zone"
-      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "^${DRONE_STACK}_$1_v1$"; }
+      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "^''${DRONE_STACK}_$1_v1$"; }
       have_secret rpc_secret    || abra app secret insert "$DRONE_DOMAIN" rpc_secret    v1 /run/secrets/drone_rpc_secret          -f -n
       have_secret client_secret || abra app secret insert "$DRONE_DOMAIN" client_secret v1 /run/secrets/drone_gitea_client_secret -f -n