fix(lasuite-drive): re-assert SECRET_COLLABORA_P_VERSION (abra pinned app-new regen drops it) #46

2026-10-26T17:10:18Z

autonomic-bot commented

2026-10-26 17:10:18 +00:00

What changed

tests/lasuite-drive/recipe_meta.py: EXTRA_ENV now re-asserts SECRET_COLLABORA_P_VERSION: "v1"; a focused unit test pins it.

Why

abra 0.13.0-beta (deployed with the Sunday host update) regenerates the app .env on a pinned-version app new from generation hints and drops SECRET_COLLABORA_P_VERSION (the .env.sample ships that line manually — collabora_p is not a generatable secret). With the line gone, every secret-touching abra command for the app FATAs missing version for secret? (collabora_p):

the weekly canonical sweep's cold tests of the new releases (2026-10-25) never got past install_steps.sh (the oidc_rpcs insert), so the STALE state in report.ci week-2026-10-23 persists;
the upgrade BASE deploy (warm-canonical reattach at the pinned version) hits the same regen path.

Evidence it works

Deterministic repro on cc-ci: pinned-mode abra app new lasuite-drive <domain> <version> -S produces a .env without the collabora_p version line; chaos-mode app new keeps it (only the pinned path regenerates).
The 4 failing unit tests fail identically on main — pre-existing drift, not introduced here; the new test passes (320 passed on the branch).
After merge + deploy: cold-seed the lasuite canonicals past the removed docker.io/minio/minio pin (the report's operator: refresh the canonical minio pin), then re-post !testme on lasuite-docs #11 + lasuite-drive #8.

CC @notplants for human awareness.

Recipe PRs are never agent-merged; this is cc-ci infrastructure and can be merged on a green adversary verdict, per AGENTS.md.

## What changed `tests/lasuite-drive/recipe_meta.py`: `EXTRA_ENV` now re-asserts `SECRET_COLLABORA_P_VERSION: "v1"`; a focused unit test pins it. ## Why abra 0.13.0-beta (deployed with the Sunday host update) regenerates the app `.env` on a pinned-version `app new` from generation hints and **drops `SECRET_COLLABORA_P_VERSION`** (the `.env.sample` ships that line manually — `collabora_p` is not a generatable secret). With the line gone, every secret-touching abra command for the app FATAs `missing version for secret? (collabora_p)`: - the weekly canonical sweep's cold tests of the new releases (2026-10-25) never got past `install_steps.sh` (the `oidc_rpcs` insert), so the **STALE** state in report.ci week-2026-10-23 persists; - the upgrade BASE deploy (warm-canonical reattach at the pinned version) hits the same regen path. ## Evidence it works - Deterministic repro on cc-ci: pinned-mode `abra app new lasuite-drive <domain> <version> -S` produces a `.env` without the `collabora_p` version line; chaos-mode `app new` keeps it (only the pinned path regenerates). - The 4 failing unit tests fail identically on `main` — pre-existing drift, not introduced here; the new test passes (320 passed on the branch). - After merge + deploy: cold-seed the lasuite canonicals past the removed `docker.io/minio/minio` pin (the report's operator: refresh the canonical minio pin), then re-post `!testme` on lasuite-docs #11 + lasuite-drive #8. CC @notplants for human awareness. Recipe PRs are never agent-merged; this is cc-ci infrastructure and can be merged on a green adversary verdict, per AGENTS.md.

autonomic-bot added 1 commit 2026-10-26 17:10:19 +00:00

fix(lasuite-drive): re-assert SECRET_COLLABORA_P_VERSION in EXTRA_ENV

continuous-integration/drone/push Build is passing

Details

521cd01c1c

abra's pinned-version 'app new' regenerates the app .env from generation
hints and drops SECRET_COLLABORA_P_VERSION (the .env.sample ships the line
manually — not a generatable secret). Every secret-touching abra command
for the app then FATAs 'missing version for secret? (collabora_p)' and the
cold base deploy goes RED at install (first seen in the 2026-10-25 weekly
sweep's cold tests of the new releases: lasuite-drive never got past
install_steps' oidc_rpcs insert). Re-asserting the shipped version pin via
EXTRA_ENV restores the sample's contract.

Verified live on cc-ci: abra app check passes for the pinned sample env
collabora_p only with the line present; repro via 'abra app new -S' on
0.12.0+v0.21.0 dropped the line deterministically.

All checks were successful

continuous-integration/drone/push Build is passing

Details

Checking for merge conflicts…

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/lasuite-drive-collabora-p-env:fix/lasuite-drive-collabora-p-env

git checkout fix/lasuite-drive-collabora-p-env

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#46