From afe7a107581e834e1449a64277c76ac49e37acae Mon Sep 17 00:00:00 2001
From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone>
Date: Mon, 21 Sep 2026 17:00:29 +0000
Subject: [PATCH] =?UTF-8?q?drone:=20scope=20have=5Fsecret=20to=20the=20new?=
 =?UTF-8?q?=20stack=20=E2=80=94=20old=20stack's=20secrets=20satisfied=20th?=
 =?UTF-8?q?e=20check=20post-rename?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 nix/modules/drone.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nix/modules/drone.nix b/nix/modules/drone.nix
index 09d0074..aad5b2e 100644
--- a/nix/modules/drone.nix
+++ b/nix/modules/drone.nix
@@ -52,7 +52,10 @@ let
       set_env DRONE_ENV_VERSION "v1"
       set_env COMPOSE_FILE '"compose.yml:compose.gitea.yml"'
 
-      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "_$1_v1$"; }
+      # Stack-scoped: secret names are prefixed with the app's stack name, so during the
+      # 2026-09 domain rename the OLD stack's *_rpc_secret_v1 must not satisfy this check.
+      DRONE_STACK="drone_ci_autonomic_zone"
+      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "^${DRONE_STACK}_$1_v1$"; }
       have_secret rpc_secret    || abra app secret insert "$DRONE_DOMAIN" rpc_secret    v1 /run/secrets/drone_rpc_secret          -f -n
       have_secret client_secret || abra app secret insert "$DRONE_DOMAIN" client_secret v1 /run/secrets/drone_gitea_client_secret -f -n