From cf041195e3c6573a6f9856d96a418f1976cd59b2 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 24 Sep 2026 18:05:32 +0000 Subject: [PATCH 1/2] docs: give ci-bot organization-template-admin in staging setup ci-show-provisioner-errors.sh needs to read provisioner jobs, which the site-wide template-admin role doesn't allow. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017LNV7pCH3fCUkVkhto13Ev --- docs/admin/server-setup.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/admin/server-setup.md b/docs/admin/server-setup.md index b9e3f89..773c09c 100644 --- a/docs/admin/server-setup.md +++ b/docs/admin/server-setup.md @@ -1238,9 +1238,12 @@ Get a fresh registration token for each batch from **GitHub → Settings → Act ```bash coder users create --email ci@staging-coder.ddev.com --username ci-bot --login-type none coder users edit-roles ci-bot --roles template-admin --yes +coder organizations members edit-roles ci-bot organization-template-admin coder tokens create --user ci-bot --lifetime 8760h ``` +The site-wide `template-admin` role lets `ci-bot` push templates and create workspaces. The org role `organization-template-admin` is also needed, so that `ci-bot` can read provisioner jobs. When `coder create` fails in the server-side Terraform step, the CLI often prints only `initialize terraform: exit status 1`. The workflows' "Show provisioner errors if workspace creation failed" step (`scripts/ci-show-provisioner-errors.sh`) then fetches the failed job's logs to show the real Terraform error. Without this role, that step can only print a warning. + Store the token in 1Password at `op://test-secrets/TEST_CODER_SESSION_TOKEN/credential`. #### 3. Push the `ci-lock` template From 5a1abb109121317442eab2306149e9b106edbeb5 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 24 Sep 2026 18:19:50 +0000 Subject: [PATCH 2/2] openspec: mark staging integration and manual runner checks done Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017LNV7pCH3fCUkVkhto13Ev --- openspec/changes/add-user-startup-hook/tasks.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/openspec/changes/add-user-startup-hook/tasks.md b/openspec/changes/add-user-startup-hook/tasks.md index 2142a29..eab0c40 100644 --- a/openspec/changes/add-user-startup-hook/tasks.md +++ b/openspec/changes/add-user-startup-hook/tasks.md @@ -6,7 +6,8 @@ ## 2. Validation - [x] 2.1 `terraform fmt -check -recursive`, `make validate` and `make test-templates` pass - [x] 2.2 Integration test: `freeform/scripts/test-freeform-startup-hook.sh` installs a hook before the GH freeform job's workspace restart and verifies it after -- [ ] 2.3 Integration test passes on staging +- [x] 2.3 Integration test passes on staging +- [x] 2.4 Manual check on staging: a `~/.coder-startup.sh` that starts a Claude self-hosted runner in tmux brings the runner up after a workspace restart with no terminal open, and a session lands on it ## 3. Image - [x] 3.1 Install `claude-code@latest` instead of `claude-code` in `image/Dockerfile` (VERSION unchanged)