Repository navigation
fix(portal): forget tg in state so it can be re-imported as DCR - #1403
Conversation
The apply of #1402 imported api but failed on tg: with auth_credentials removed from config, provider 5.24 sends an explicit null and the API refuses the PUT (400 7001 "Expected string, received null"). Nothing was written; tg stays ready/connected on DCR. A PUT that omits the field is accepted, but the provider cannot omit a value it holds in state. So tg is dropped from state with a `removed { lifecycle { destroy = false } }` block (no API call), and the follow-up change imports it again; an import reads no auth_credentials, leaving tg in state as DCR like seerrsense and api. tg is on UNMANAGED for that one apply. The ignore_changes rationale moves to the projects resource, since the tg block it lived in is gone. Refs #1363, #1402 Claude-Session: https://claude.ai/code/session_01T5nLoYSquzMsGsdS64wvry
|
Claude finished @mashkovd's task in 2m 25s —— View job Review complete ✅
Verdict: APPROVE — no P1/P2 findings, 1 P3 nit. Summary: Verified the mechanics end-to-end:
P3 (non-blocking): scripts/validate-portal-allowlists.py:178 — the module docstring a few lines above (line 47) still says the |
Antigravity (agy) review — informationalModel: gemini-3.8-flash-medium · commit No significant issues found. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| # `tg` is here for the one apply between forgetting it and importing it back | ||
| # (see the `removed` block in mcp-servers.tf); the change that re-imports it | ||
| # empties this again. | ||
| UNMANAGED: set[str] = {"tg"} |
There was a problem hiding this comment.
P3: the module docstring's existence bullet (line 47) still reads UNMANAGED list ... empty since every mapped server got its resource. That's now stale for the duration of this PR — UNMANAGEDis{"tg"}here, not empty. The inline comment right above this line explains the temporary state correctly; worth a one-line tweak to the docstring too (or leave as-is since the follow-up PR that emptiesUNMANAGED` again will make it briefly true again either way). Non-blocking.
There was a problem hiding this comment.
Right for the life of this PR only. The re-import follow-up empties UNMANAGED again, which makes the docstring true once more, so it is left alone here.
Why
The apply of #1402 (run 36226160494) imported
apibut failed ontg:With
auth_credentialsremoved from config, provider 5.24 sends it as an explicitnull, and the API refuses the whole PUT. Nothing was written. Read back after the failure,tgis stillready/connectedwithauth_config_summary: null.The API does accept a PUT that omits the field; that is how the switch was done. But the provider can't be made to omit a value it holds in state.
What
removed { from = …tg; lifecycle { destroy = false } }dropstgfrom state with no API call. The plan should sayforget, which is notdelete, so the apply guards pass it withoutallow_destroy.tggoes onUNMANAGEDfor this one apply, so the allowlist existence check passes.ignore_changesrationale moves from the removedtgblock toprojects.Next
A follow-up PR re-adds
import+resource "tg". The import reads the server from the API, which returns noauth_credentials, sotglands in state as DCR, the same wayseerrsenseandapidid. The same PR emptiesUNMANAGEDand fixes the "Fourth upstream" description (the P3 from #1402).Until then the nightly registration check may exit 2 for
tg: state still holds the old blob whiletgis onDCR_SERVERS. After this applytgis out of state and the check is quiet.Local checks:
tofu validate,validate-portal-allowlists.pyand its--selftest.Refs #1363, #1402
🤖 Generated with Claude Code
https://claude.ai/code/session_01T5nLoYSquzMsGsdS64wvry