From 3e220f10d3f3850724d3312f620edb88a9300b35 Mon Sep 17 00:00:00 2001 From: Codex Date: Sat, 11 Jul 2026 11:16:09 +0200 Subject: [PATCH] Use temp script for Tower PowerShell deploy --- CHANGELOG.md | 2 +- .../tests/test_sprint31_unraid_template.py | 8 ++-- docs/CODEX_EXECUTION_LOG.md | 4 +- scripts/deploy_tower.ps1 | 37 ++++++++++++++++--- 4 files changed, 40 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 278aff74..3b7248f9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ - Fixed Tower deploy automation so `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` source the remote `.env` before building the all-in-one image. - Hardened the PowerShell deploy wrapper to stream the remote script through `bash -s`, matching the Bash deploy path and preserving remote shell variable expansion. -- Forced UTF-8 without BOM for the PowerShell SSH stdin stream so Bash receives a clean script. +- The PowerShell wrapper now writes a UTF-8-without-BOM temporary script, copies it with `scp`, runs it with `bash` on Tower and removes the remote temp file while preserving the deploy exit code. - Remote `.env` now controls `GEOINTEL_INSTALL_AI=true` by default, with explicit local deploy overrides still supported. - Added regression coverage so future deploy changes cannot silently build a GIS-only image while runtime YOLO settings are enabled. - No API contract, database migration, provider fetching, fake detections, model download or product feature changed. diff --git a/backend/tests/test_sprint31_unraid_template.py b/backend/tests/test_sprint31_unraid_template.py index f16badbb..82db5188 100644 --- a/backend/tests/test_sprint31_unraid_template.py +++ b/backend/tests/test_sprint31_unraid_template.py @@ -134,9 +134,11 @@ def test_powershell_tower_deploy_streams_remote_script_to_bash() -> None: powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8") assert "[System.Text.UTF8Encoding]::new($false)" in powershell - assert "$OutputEncoding = $utf8NoBom" in powershell - assert "bash -s" in powershell - assert "$remoteScript | ssh" in powershell + assert "[System.IO.File]::WriteAllText($localScriptPath, $remoteScript, $utf8NoBom)" in powershell + assert "& scp @scpArgs" in powershell + assert "& ssh @sshRunArgs" in powershell + assert "bash '$remoteScriptPath'" in powershell + assert "rm -f '$remoteScriptPath'" in powershell assert "REMOTE_PATH='$RemotePath'" in powershell assert "DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi'" in powershell diff --git a/docs/CODEX_EXECUTION_LOG.md b/docs/CODEX_EXECUTION_LOG.md index 0e43a761..4006f353 100644 --- a/docs/CODEX_EXECUTION_LOG.md +++ b/docs/CODEX_EXECUTION_LOG.md @@ -3,7 +3,7 @@ Changed: - Hardened `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` so the remote Tower `.env` is sourced before building the all-in-one image. - Updated the PowerShell deploy wrapper to stream the remote script through `bash -s`, matching the Bash deploy path and preserving Bash variable expansion during `.env`-driven builds. -- Forced UTF-8 without BOM for the PowerShell SSH stdin stream so the first remote Bash command is not prefixed with a BOM. +- The PowerShell wrapper now writes a UTF-8-without-BOM temporary script, copies it with `scp`, runs it with `bash` on Tower and removes the remote temp file while preserving the deploy exit code. - `GEOINTEL_INSTALL_AI=true` in `/mnt/user/appdata/geointel/.env` now drives the automatic image build by default; explicit local overrides remain possible for one-off deploys. - Documented the deploy behavior in `deploy/unraid/README.md`. @@ -16,7 +16,7 @@ Tested: - `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_uses_single_container_unraid_compose backend/tests/test_docker_runtime_config.py::test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env` (`3 passed`). - Red step: `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_powershell_tower_deploy_streams_remote_script_to_bash -q` failed because the PowerShell wrapper passed the remote script as an SSH command argument instead of streaming it to `bash -s`. - `python -m pytest backend/tests/test_sprint31_unraid_template.py::test_powershell_tower_deploy_streams_remote_script_to_bash backend/tests/test_sprint31_unraid_template.py::test_tower_deploy_build_uses_remote_env_ai_setting_by_default backend/tests/test_docker_runtime_config.py::test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env -q` (`3 passed`). -- Red step: the same PowerShell deploy transport test failed until the wrapper set `[System.Text.UTF8Encoding]::new($false)` for native-command stdin. +- Red step: the same PowerShell deploy transport test failed until the wrapper wrote a `[System.Text.UTF8Encoding]::new($false)` temp script, copied it via `scp`, ran it through remote `bash` and propagated the remote exit code. ## Sprint 150 YOLO label visible-ratio gate (2026-07-09) diff --git a/scripts/deploy_tower.ps1 b/scripts/deploy_tower.ps1 index e9b7356a..58c616d7 100644 --- a/scripts/deploy_tower.ps1 +++ b/scripts/deploy_tower.ps1 @@ -58,10 +58,37 @@ if [ -x scripts/verify_browser_runtime.sh ]; then fi '@ -$remoteCommand = "REMOTE_PATH='$RemotePath' REMOTE_BRANCH='$RemoteBranch' REMOTE_REPO='$RemoteRepo' FRONTEND_URL='$FrontendUrl' DEPLOY_BOOTSTRAP='$bootstrapValue' DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi' bash -s" - $utf8NoBom = [System.Text.UTF8Encoding]::new($false) -[Console]::OutputEncoding = $utf8NoBom -$OutputEncoding = $utf8NoBom +$localScriptPath = [System.IO.Path]::GetTempFileName() +$remoteScriptPath = "/tmp/geointel-deploy-$([System.Guid]::NewGuid().ToString('N')).sh" -$remoteScript | ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -i $SshKey $RemoteHost $remoteCommand +try { + [System.IO.File]::WriteAllText($localScriptPath, $remoteScript, $utf8NoBom) + + $scpArgs = @( + "-o", "BatchMode=yes", + "-o", "StrictHostKeyChecking=accept-new", + "-i", $SshKey, + $localScriptPath, + "${RemoteHost}:$remoteScriptPath" + ) + & scp @scpArgs + if ($LASTEXITCODE -ne 0) { + exit $LASTEXITCODE + } + + $remoteRunCommand = "REMOTE_PATH='$RemotePath' REMOTE_BRANCH='$RemoteBranch' REMOTE_REPO='$RemoteRepo' FRONTEND_URL='$FrontendUrl' DEPLOY_BOOTSTRAP='$bootstrapValue' DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi' bash '$remoteScriptPath'; status=`$?; rm -f '$remoteScriptPath'; exit `$status" + $sshRunArgs = @( + "-o", "BatchMode=yes", + "-o", "StrictHostKeyChecking=accept-new", + "-i", $SshKey, + $RemoteHost, + $remoteRunCommand + ) + & ssh @sshRunArgs + if ($LASTEXITCODE -ne 0) { + exit $LASTEXITCODE + } +} finally { + Remove-Item -LiteralPath $localScriptPath -Force -ErrorAction SilentlyContinue +}