coulomb/fluid-telegram
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

send-post: run inside warden's attended login envelope

Browse source 
warden replaces HOME and fails closed on output: resolve paths from the
script, keep Go caches at the real home, document the silent invocation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
This commit is contained in:
tegwick 2026-10-08 09:44:41 +02:00
parent e6d80ad69b
commit 84cc31bfda
1 changed files with 20 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

27
scripts/send-post.sh
View file

@ -2,19 +2,32 @@
# Send one prepared post (pr-hall-of-helix/posts/<file>.yaml) through a
# short-lived local adapter, then stop it.
#
# Run it yourself, logged in to OpenBao (BAO_ADDR/BAO_TOKEN set). The bot token
# goes from OpenBao straight into the adapter's environment and is never
# printed. The adapter's store is in memory, so idempotency on post_id holds
# only within one run: do not re-run for a post that already went out.
# The bot token goes from OpenBao straight into the adapter's environment and
# is never printed. The adapter's store is in memory, so idempotency on post_id
# holds only within one run: do not re-run for a post that already went out.
#
# scripts/send-post.sh ~/pr-hall-of-helix/posts/2026-10-08-test-outlet-parametrization.yaml test
# Run it yourself inside the attended OpenBao login. warden fails closed on any
# output, so redirect both streams, and use absolute paths (HOME is replaced):
#
# warden access openbao-platform-admin-login --exec -- bash -c \
# '/home/worsch/fluid-telegram/scripts/send-post.sh \
# /home/worsch/pr-hall-of-helix/posts/<post>.yaml test \
# > /home/worsch/send-post.log 2>&1'
set -euo pipefail
post=$(realpath "$1")
channel=${2:-test}
spec=${SPEC:-$HOME/pr-hall-of-helix/presence/telegram.yaml}
port=${PORT:-18089}
cd "$(dirname "$0")/.."
cd "$(dirname "$(realpath "$0")")/.."
spec=${SPEC:-$(realpath ../pr-hall-of-helix/presence/telegram.yaml)}
# Under `warden access ... --exec`, HOME is a throwaway session directory that
# holds the OpenBao token helper. Keep Go's caches at the real home so the
# build does not start from nothing there.
realhome=$(getent passwd "$(id -u)" | cut -d: -f6)
export GOPATH=${GOPATH:-$realhome/go}
export GOMODCACHE=${GOMODCACHE:-$GOPATH/pkg/mod}
export GOCACHE=${GOCACHE:-$realhome/.cache/go-build}
read -r want reviewed < <(python3 -c '
import sys, yaml