Preserve supplied Sourcebot install ID on first boot

Merged
MS
2mo ago
+211-22

Summary

  • preserve a non-empty SOURCEBOT_INSTALL_ID supplied through the environment on first boot
  • generate an ID with uuidgen only when no value is supplied, while propagating generator failures
  • safely construct persisted state and PostHog payloads with jq --arg so arbitrary supplied values cannot corrupt JSON
  • retain the existing behavior where .installedv3 is authoritative after first boot
  • add an entrypoint regression harness covering supplied, generated, persisted, escaped, restart, upgrade-telemetry, and generation-failure paths

This enables callers such as setup-sourcebot to hand an installation identity into a newly created Sourcebot deployment, allowing setup telemetry and deployment telemetry to use the same ID.

Testing

  • .github/scripts/test-entrypoint-install-id.sh
  • /bin/sh -n entrypoint.sh
  • bash -n .github/scripts/test-entrypoint-install-id.sh
  • shellcheck -e SC3037 entrypoint.sh .github/scripts/test-entrypoint-install-id.sh
  • git diff --check

[!NOTE]
Medium Risk
Changes container startup identity and telemetry HTTP behavior; mistakes could mis-attribute installs or break first-boot when uuidgen fails, but scope is limited to entrypoint.sh with new regression tests.

Overview
First-boot install identity now honors a non-empty SOURCEBOT_INSTALL_ID from the environment instead of always calling uuidgen, while still generating an ID when unset and leaving .installedv3 authoritative on later boots.

Safer persistence and telemetry: .installedv3 and PostHog install/upgrade payloads are built with jq --arg so special characters in install IDs cannot break JSON, and telemetry curl calls add --proto-redir '=https' to avoid following insecure redirects.

CI: adds .github/scripts/test-entrypoint-install-id.sh (fake uuidgen/curl harness) and wires it into the vulnerability-automation workflow to cover supplied, generated, persisted, upgrade, redirect-policy, and uuidgen-failure paths.

Reviewed by Cursor Bugbot for commit 7ddc3d2010fbcc8bc20da0cc6339be5cbb1c91fa. Bugbot is set up for automated code reviews on this repo. Configure here.

Summary by CodeRabbit

  • Bug Fixes

    • Preserves a provided SOURCEBOT_INSTALL_ID during initial startup.
    • Generates a new install ID only when none is supplied.
    • Retains the persisted install ID on subsequent startups.
    • Safely preserves special characters in install IDs sent through telemetry.
    • Prevents incomplete installation metadata when ID generation fails.
    • Blocks insecure HTTP redirects during telemetry submission.

  • Tests

    • Expanded automated coverage for install-ID selection, telemetry payloads, redirect handling, and generation failures.
    • Added workflow automation to run these checks.