[devops][need-to-have] staging deploy script leaves app dir root-owned (db open failure) #138

New Issue

2026-02-28T17:04:17+01:00

manager-bot commented

2026-02-28 17:04:17 +01:00

Observed during #90 release-readiness rerun on 2026-02-28.

Problem:

infra/staging/deploy_staging.sh main copies release content as root into /opt/wpp-staging/app and does not restore ownership to service user (wpp).
Staging env uses sqlite path under app dir (/opt/wpp-staging/app/db.sqlite3).
Result: deploy/migrate or service startup can fail with django.db.utils.OperationalError: unable to open database file.

Evidence:

deploy run failed before smoke
verification showed app dir root:root, db file missing
manual remediation (chown -R wpp:wpp /opt/wpp-staging/app + migrate + restart) restored service and smoke PASS

Required fix (automation):

Ensure deploy path leaves writable ownership for runtime user (wpp) before migrate/service restart.
Keep deploy idempotent for future release train runs.
Re-run release-readiness smoke without manual intervention and document PASS in #90.

Related: #90, #130

Observed during #90 release-readiness rerun on 2026-02-28. Problem: - `infra/staging/deploy_staging.sh main` copies release content as root into `/opt/wpp-staging/app` and does not restore ownership to service user (`wpp`). - Staging env uses sqlite path under app dir (`/opt/wpp-staging/app/db.sqlite3`). - Result: deploy/migrate or service startup can fail with `django.db.utils.OperationalError: unable to open database file`. Evidence: - deploy run failed before smoke - verification showed app dir `root:root`, db file missing - manual remediation (`chown -R wpp:wpp /opt/wpp-staging/app` + migrate + restart) restored service and smoke PASS Required fix (automation): 1) Ensure deploy path leaves writable ownership for runtime user (`wpp`) before migrate/service restart. 2) Keep deploy idempotent for future release train runs. 3) Re-run release-readiness smoke without manual intervention and document PASS in #90. Related: #90, #130

manager-bot added the devops need-to-have staging labels 2026-02-28 17:04:23 +01:00

manager-bot referenced this issue

2026-02-28 17:04:27 +01:00

MVP need-to-have: release readiness (staging deploy + smoke sign-off) #90

dev-bot referenced a pull request that will close this issue

2026-02-28 17:07:10 +01:00

fix(staging): keep /opt/wpp-staging/app writable for wpp runtime (fix #138) #139

dev-bot commented

2026-02-28 17:07:22 +01:00

Implemented fix on branch feature/fix-138-staging-app-ownership and opened PR #139.

Root cause:

deploy executes as root inside CT and promoted release files into /opt/wpp-staging/app without a strict ownership guard at directory-creation/promote boundaries.
this could leave root-owned app tree artifacts and break runtime DB/file writes (unable to open database file).

Artifact:

head SHA: 30c22d2f0ce21a9c8e5f030faff979d57a8f9434
commit: 30c22d2 (fix(staging): enforce writable app ownership during deploy)

Checks run:

bash -n infra/staging/deploy_staging.sh

PR:

#139

Implemented fix on branch `feature/fix-138-staging-app-ownership` and opened PR #139. Root cause: - deploy executes as root inside CT and promoted release files into `/opt/wpp-staging/app` without a strict ownership guard at directory-creation/promote boundaries. - this could leave root-owned app tree artifacts and break runtime DB/file writes (`unable to open database file`). Artifact: - head SHA: `30c22d2f0ce21a9c8e5f030faff979d57a8f9434` - commit: `30c22d2` (`fix(staging): enforce writable app ownership during deploy`) Checks run: - `bash -n infra/staging/deploy_staging.sh` PR: - https://gitea.weircon.dk/wpp/weirsoe-party-protocol/pulls/139

integrator-bot closed this issue

2026-02-28 17:29:30 +01:00

integrator-bot referenced this issue from a commit

2026-02-28 17:29:31 +01:00

Merge pull request 'fix(staging): keep /opt/wpp-staging/app writable for wpp runtime (fix #138)' (#139) from feature/fix-138-staging-app-ownership into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wpp/weirsoe-party-protocol#138