2026-06-18 19:12:57 +00:00
|
|
|
package main
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
|
"os"
|
|
|
|
|
"os/exec"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
// runStreaming executes name with args, wiring std streams to this process so
|
|
|
|
|
// the caller sees live output, and returns the command's error (non-nil on
|
|
|
|
|
// non-zero exit — preserved so homelab's own exit code reflects the child's).
|
|
|
|
|
func runStreaming(name string, args ...string) error {
|
homelab: add tf verbs + stack/git-crypt substrate
Adds the tf verb-group and the resolver substrate beneath it, continuing the
v0.1 infra-loop build.
- substrate: findInfraRoot (walk up to terragrunt.hcl + stacks/), stack→dir
resolver, and repo/remote/git-crypt detection (preferRemote forgejo>origin,
hasGitCryptAttr, gitCryptFlags) — the last is for `work` next.
- tf plan/validate/fmt/force-unlock/apply, resolving the stack from cwd and
delegating to scripts/tg (which owns state decrypt/encrypt, the Vault lock,
and the ingress auth-comment check) rather than calling terragrunt directly.
- tf apply is presence-coupled: claims stack:<name>, ALWAYS releases on exit
(normal, error, or SIGINT/SIGTERM via sync.Once + signal handler) — fixing
the documented ~200-claim leak — and prints an out-of-band reminder since CI
applies canonically on push.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 19:16:33 +00:00
|
|
|
return runStreamingIn("", name, args...)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// runStreamingIn is runStreaming with a working directory (empty = inherit).
|
|
|
|
|
func runStreamingIn(dir, name string, args ...string) error {
|
2026-06-18 19:12:57 +00:00
|
|
|
cmd := exec.Command(name, args...)
|
homelab: add tf verbs + stack/git-crypt substrate
Adds the tf verb-group and the resolver substrate beneath it, continuing the
v0.1 infra-loop build.
- substrate: findInfraRoot (walk up to terragrunt.hcl + stacks/), stack→dir
resolver, and repo/remote/git-crypt detection (preferRemote forgejo>origin,
hasGitCryptAttr, gitCryptFlags) — the last is for `work` next.
- tf plan/validate/fmt/force-unlock/apply, resolving the stack from cwd and
delegating to scripts/tg (which owns state decrypt/encrypt, the Vault lock,
and the ingress auth-comment check) rather than calling terragrunt directly.
- tf apply is presence-coupled: claims stack:<name>, ALWAYS releases on exit
(normal, error, or SIGINT/SIGTERM via sync.Once + signal handler) — fixing
the documented ~200-claim leak — and prints an out-of-band reminder since CI
applies canonically on push.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-18 19:16:33 +00:00
|
|
|
cmd.Dir = dir
|
2026-06-18 19:12:57 +00:00
|
|
|
cmd.Stdout = os.Stdout
|
|
|
|
|
cmd.Stderr = os.Stderr
|
|
|
|
|
cmd.Stdin = os.Stdin
|
|
|
|
|
return cmd.Run()
|
|
|
|
|
}
|