Frank
8001132744
New seams (written first, red against the pre-merge tree): - llm_units.bats: every scripts/*.service unit points at files that exist in this repo (the merged checkout path), env files included - llm_secrets.bats: the live sudo password is never tracked (the vllmScripts AGENTS.md once documented it) - deployment_flow.bats: deploy.sh must restart the LLM services on both targets and health-check both endpoints (7770, 52625) - helpers.bash: has_no_leaked_sudo_pw (two-part assembly, same pattern as the gitea check)
16 lines
567 B
Bash
16 lines
567 B
Bash
#!/usr/bin/env bash
|
|
# Seam: LLM fleet secret hygiene.
|
|
# The live sudo password for the fleet hosts must never appear in any
|
|
# tracked file (the vllmScripts AGENTS.md once documented it; the merged
|
|
# repo forbids it). Headless deploys pass the password via the
|
|
# FRANK_SUDO_PW environment variable; the repo never stores it.
|
|
|
|
load helpers
|
|
|
|
@test "the live sudo password is never tracked" {
|
|
local f
|
|
while IFS= read -r f; do
|
|
has_no_leaked_sudo_pw "$f"
|
|
done < <(find "$REPO_ROOT" -type f -not -path '*/.git/*' -not -path '*/.pi-subagents/*' | sort)
|
|
}
|