amadan
deploy: ops ship --expedite — the encoded bake-window override (#1342)
The incident path ('update run --ignore-bake' after an operator stable
promote) existed only as a hand-run precedent; tonight's mesh fix needed it
again. ship --expedite passes --ignore-bake through to each box's updater —
still a stated, deliberate override, now a verb instead of prose.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2 files changed,
+14
−4
deploy/ops-release.sh+6 −2deploy/release-server.sh+8 −2
diff --git a/deploy/ops-release.sh b/deploy/ops-release.sh| index b8566dc..300e972 100755 |
| --- a/deploy/ops-release.sh |
| +++ b/deploy/ops-release.sh |
| @@ -26,7 +26,7 @@ root="$(CDPATH= cd -- "$here/.." && pwd)" |
| BOXES="${LCHAT_BOXES:-elevenbox kepler}" |
| usage() { |
| - echo "usage: ops publish [notes...] | ops promote <ver> edge|beta|stable | ops ship [box...]" >&2 |
| + echo "usage: ops publish [notes...] | ops promote <ver> edge|beta|stable | ops ship [--expedite] [box...]" >&2 |
| exit 2 |
| } |
| @@ -79,6 +79,10 @@ ship) |
| # Ship converges the WHOLE fleet: one release-server.sh ship pass per box |
| # (each box runs its own updater). Naming boxes limits the sweep; the |
| # default is every fleet box, so nobody has to remember there are two. |
| + # `ship --expedite [box...]` overrides the supply-chain bake window — the |
| + # encoded form of the update-run --ignore-bake incident precedent. |
| + EXPEDITE="" |
| + if [ "${1:-}" = "--expedite" ]; then EXPEDITE="--expedite"; shift; fi |
| [ $# -gt 0 ] && BOXES="$*" |
| failed="" |
| for box in $BOXES; do |
| @@ -86,7 +90,7 @@ ship) |
| # One box lagging (GitHub's CDN serves fresh manifests stale for a few |
| # minutes) must not stop the others from converging — finish the sweep, |
| # then report. |
| - LCHAT_BOX="$box" "$here/release-server.sh" ship || failed="$failed $box" |
| + LCHAT_BOX="$box" "$here/release-server.sh" ship $EXPEDITE || failed="$failed $box" |
| done |
| echo |
| echo "note: this opened operator SSH sessions — the public access ledger wants a" |
diff --git a/deploy/release-server.sh b/deploy/release-server.sh| index 7ef7721..71903e3 100755 |
| --- a/deploy/release-server.sh |
| +++ b/deploy/release-server.sh |
| @@ -427,13 +427,19 @@ promote) |
| ;; |
| ship) |
| + # --expedite: pass --ignore-bake through to the box updater — the deliberate |
| + # operator override of the supply-chain bake window (docs/server-releases.md), |
| + # for shipping an incident fix the moment it's promoted. The hold is the |
| + # default for a reason; expediting is a stated decision, never routine. |
| + EXPEDITE="" |
| + if [ "${1:-}" = "--expedite" ]; then EXPEDITE="--ignore-bake"; shift; fi |
| VER="${1:-$(git rev-parse --short HEAD)}" |
| BOX="${LCHAT_BOX:-}" |
| [ -n "$BOX" ] || { echo "release-server: set LCHAT_BOX (e.g. <box-ip>; user comes from ssh config) to ship" >&2; exit 1; } |
| - echo "ship: updating instances on $BOX until current (feed target: $VER)" |
| + echo "ship: updating instances on $BOX until current (feed target: $VER${EXPEDITE:+, expedited past the bake window})" |
| DEADLINE=$(( $(date +%s) + 600 )) |
| while :; do |
| - ssh "$BOX" sudo -n /opt/lchat/lchat update run || true |
| + ssh "$BOX" sudo -n /opt/lchat/lchat update run $EXPEDITE || true |
| STATUS="$(ssh "$BOX" sudo -n /opt/lchat/lchat update status || true)" |
| # Done when no un-pinned instance with a known channel head is behind, and |
| # at least one row proves a feed landed at all. Pinned rows are someone's |