fix(scripts): resolve submodule URLs over HTTPS on appliances (NEH-217) - #291
Merged
Merged
Conversation
.gitmodules registers the submodules over SSH, which developers need to push — but appliances have no GitHub key, and the repos are public. The Rionegro unit was found with .gitmodules hand-edited to HTTPS, an edit any branch or tag checkout silently reverts, leaving the next `git submodule update --init` to die mid-update on "Permission denied (publickey)". setup.sh now installs the config-level rewrite (url."https://github.com/".insteadOf "git@github.com:") in DTK_USER's global git config, which survives checkouts regardless of what .gitmodules says. rollback-update.sh's git calls gain env HOME= so the rewrite is read when they run under sudo. .gitmodules stays SSH; developer workflow is untouched.
There was a problem hiding this comment.
Pull request overview
Configures appliances to fetch public GitHub submodules over HTTPS while preserving SSH URLs for development.
Changes:
- Adds an idempotent Git URL rewrite during provisioning.
- Ensures rollback Git commands load the appliance user’s global configuration.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
scripts/setup.sh |
Installs the appliance-user HTTPS URL rewrite. |
scripts/rollback-update.sh |
Sets the user’s HOME for rollback Git operations. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the appliance-side submodule access gap from NEH-217, with option (a) from the issue: a config-level rewrite at provisioning, leaving
.gitmoduleson SSH.The problem
Appliances have no GitHub SSH key, so
git submodule update --initfails withPermission denied (publickey). The Rionegro unit had been worked around by hand-editing.gitmodulesto HTTPS — an edit that any branch/tag checkout silently reverts, at which point the next submodule update dies mid-update on a unit with no console. That exact revert-then-fail was hit during the 2026-08-03 update and worked around live with the global rewrite this PR now installs at provisioning.Changes
setup.sh(new step 0b) installsgit config --global url."https://github.com/".insteadOf "git@github.com:"asDTK_USER. Config-level rewrites apply after URLs are resolved from.gitmodules, so they survive checkouts; the repos are public, so HTTPS fetches need no credentials. Idempotent.rollback-update.shruns its git calls withenv HOME="$DTK_USER_HOME"(matching howupdate.sh/setup.shalready invoke cross-user commands), so the rewrite is reliably read when the script runs under sudo..gitmodulesstays SSH — developers keep pushing over SSH with zero workflow change.Already-provisioned units that will never re-run
setup.shget the same fix as a one-liner (documented in the workspace git-workflow notes): run the samegit config --globalcommand as the unit user. Rionegro already has it from the live fix.Linear: NEH-217 (GitHub mirror #286).