Port RUN_BASH_SUDO_PASSWORD_FILE (Plan 00073) onto F44 - #34
Merged
Conversation
F44's headless run.bash (PR #33, GITHUB_ACCOUNTS=none) and the RUN_BASH_SUDO_PASSWORD_FILE mechanism (Plan 00073) lived on two commits with no common descendant: 86ba6ae carries the sudo-password fallback but only exists on the unmerged, diverged plan-00066-ccy-ci-runner branch, whose own run.bash still rejects GITHUB_ACCOUNTS=none. This was found downstream, in lts-infra's Plan 00045: its live proof of GITHUB_ACCOUNTS=none cannot run against any guest under that estate's no-NOPASSWD:ALL policy without this mechanism present on the same commit. Manually merged Plan 00073's isolated run.bash patch onto current F44 (a raw cherry-pick conflicted on a plan-number collision and PR #33's own nearby edits): the _sudo/hl_sudo_askpass_start/hl_sudo_probe_password helpers, headless_preflight's sudo-credential decision composed with the existing GITHUB_ACCOUNTS branch, main()'s HL_SUDO_OPTS/HL_SUDO_PW_FILE init, --help/--help-run-headless docs, both Ansible invocation sites' become-password-file branch, and all 14 bare sudo -> _sudo call sites. Also fixed docs/headless-provisioning.md, found stale while porting its own doc diff: it still described GITHUB_ACCOUNTS=none as an unshipped follow-up and its secrets table contradicted run.bash --help-run-headless, the doc's own stated authority. bash -n and shellcheck -x run.bash clean; ./scripts/qa-all.bash passed, 537 files checked. Plan 00084: port sudo password file onto F44 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Independent review (standing in for this repo's required qa-reviewer pass) returned MERGE-READY conditional on one fix: this PR's own table-reflow in docs/headless-server-install.md re-emitted a row claiming GitHub is unconditionally mandatory in headless v1, contradicting run.bash --help-run-headless. Fixed to state the account-or-none choice. Also brings PLAN.md's task status and Delivery section back in sync with the actual commit/PR state. The review's other finding (Plan 00073's _sudo acceptance harness wasn't ported) is non-blocking: the reviewer independently re-derived and ran its core property against this PR's run.bash and confirmed it holds. Recorded as a follow-up, not acted on here. Plan 00084: port sudo password file onto F44 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Plan 00082's PLAN.md and Plan 00078's PLAN.md/journal named real VM hostnames and a private deployment repo from an internal stack that consumes fedora-desktop. This repo is public; those identifiers have no business here regardless of severity. Replaced with generic descriptions of the same facts (a downstream deployment repo running the proof, a fenced CI runner VM) — no information about what this repo needs to say is lost, only which private host/repo it names. Content-only fix: the same strings remain in older commit messages in this repo's history (this is not a history rewrite). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Cross-references the commits (cae9a0c, 676a7d7) that removed two real VM hostnames from this public repo's tracked content, and the consuming repo's own follow-up guardrail (its Plan 00077) -- without naming the consuming repo or repeating any of the removed detail, per the rule that incident produced. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This was referenced Aug 24, 2026
LTSCommerce
added a commit
that referenced
this pull request
Aug 24, 2026
Live-proved before merge (pinned at branch tip 8fd8725): the PATH fix plus the underlying PR #33/#34 composition all got past ansible-galaxy and through playbook-main.yml's Preflight Sanity + DNF Upgrade plays, stopping only at an unrelated, pre-existing kernel-modules enumeration defect (Plan 00086). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
F44's headlessrun.bash(PR #33 / Plan 00082,RUN_BASH_GITHUB_ACCOUNTS=none) and the sudo-password-file fallback (Plan 00073,86ba6ae) currently live on two commits with no common descendant —86ba6aeonly exists on the unmerged, divergedplan-00066-ccy-ci-runnerbranch, whose ownrun.bashstill rejectsGITHUB_ACCOUNTS=none.This was discovered downstream, in the
lts-infraconsumer repo (Plan 00045): its live proof ofGITHUB_ACCOUNTS=nonecannot run against any guest under that estate's no-NOPASSWD:ALLpolicy without the sudo-password mechanism present on the same commit asGITHUB_ACCOUNTS=none.This PR manually ports Plan 00073's isolated
run.bashpatch onto currentF44(a rawgit cherry-pickconflicted on a stale plan-number collision and PR #33's own nearby edits, so this was merged by hand instead):_sudo/hl_sudo_askpass_start/hl_sudo_probe_passwordhelpersheadless_preflight's sudo-credential decision, composed with the existingGITHUB_ACCOUNTSbranch (untouched)main()'sHL_SUDO_OPTS/HL_SUDO_PW_FILEinit--help/--help-run-headlessdoc text--become-password-filebranchsudo→_sudocall-site swapsAlso fixed
docs/headless-provisioning.md, found stale while porting its own doc diff: it still describedGITHUB_ACCOUNTS=noneas an unshipped follow-up, and its secrets-required table contradictedrun.bash --help-run-headless(the doc's own stated authority).Tracked by Plan 00084.
Test plan
bash -n run.bashcleanshellcheck -x run.bash— 0 findings./scripts/qa-all.bash— QA passed, 537 files checkedlts-infra's Plan 00045 live proof once this merges (this repo's CCY container cannot runrun.bashor serve as a target host — seeCLAUDE/ContainerRules.md)🤖 Generated with Claude Code