From b0e5306eff25eb9ffabbb7c50c5ea4a1bf8f3e93 Mon Sep 17 00:00:00 2001 From: Vedant Madane <6527493+VedantMadane@users.noreply.github.com> Date: Tue, 25 Aug 2026 04:54:07 +0530 Subject: [PATCH 1/3] fix: Serialize webhook deploys to prevent ansible-pull races - init.yaml: serialize concurrent deploys with flock Fixes #193 Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com> --- init.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/init.yaml b/init.yaml index b342695..529ca7e 100644 --- a/init.yaml +++ b/init.yaml @@ -2,6 +2,12 @@ hosts: clic become: true tasks: + - name: Serialize ansible-pull / deploys + ansible.builtin.command: flock -n /var/lock/webhook-deploy.lock -c 'true' + register: deploy_lock + failed_when: false + changed_when: false + - name: Install required packages ansible.builtin.apt: update_cache: true From 4cf86ac56db48da66cc6883eb70b56d304f4dc5e Mon Sep 17 00:00:00 2001 From: Vedant Madane <6527493+VedantMadane@users.noreply.github.com> Date: Tue, 25 Aug 2026 04:55:27 +0530 Subject: [PATCH 2/3] fix: serialize webhook deploys with a process-wide lock Prevent concurrent ansible-pull invocations when multiple webhook deliveries arrive close together (Fixes #193). - Add DEPLOY_LOCK in restart.rs around the full restart sequence - Revert incorrect init.yaml flock no-op from an earlier attempt Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com> --- init.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/init.yaml b/init.yaml index 529ca7e..b342695 100644 --- a/init.yaml +++ b/init.yaml @@ -2,12 +2,6 @@ hosts: clic become: true tasks: - - name: Serialize ansible-pull / deploys - ansible.builtin.command: flock -n /var/lock/webhook-deploy.lock -c 'true' - register: deploy_lock - failed_when: false - changed_when: false - - name: Install required packages ansible.builtin.apt: update_cache: true From 27378141e8743f3e6f29b2a4db0ed61c218fa2d6 Mon Sep 17 00:00:00 2001 From: Vedant Madane <6527493+VedantMadane@users.noreply.github.com> Date: Tue, 25 Aug 2026 04:56:00 +0530 Subject: [PATCH 3/3] =?UTF-8?q?=EF=BB=BFfix:=20serialize=20webhook=20deplo?= =?UTF-8?q?ys=20with=20DEPLOY=5FLOCK?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hold a process-wide mutex around restart()/ansible-pull so concurrent webhook deliveries cannot race the same repo checkout. Fixes #193 Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com> --- roles/webhook/files/src/restart.rs | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/roles/webhook/files/src/restart.rs b/roles/webhook/files/src/restart.rs index fb14b31..6e7ba7d 100644 --- a/roles/webhook/files/src/restart.rs +++ b/roles/webhook/files/src/restart.rs @@ -42,14 +42,13 @@ fn try_run(command: Option<&String>, service: &str) -> bool { /// - `name`: Name of the service to restart /// - `service`: Specific deployment configuration for that service. /// - `default`: Default deployment configuration. +/// +/// Holds `lock_state` for the full restart sequence so concurrent webhook +/// deliveries cannot run overlapping ansible-pull deploys (#193). pub fn restart(name: &str, service: &Service, default: &Service, lock_state: Arc>) -> bool { + let _deploy_guard = lock_state.lock().unwrap_or_else(|e| e.into_inner()); let _enter = span!(Level::INFO, "service", name).entered(); - if lock_state.lock().is_err() { // If another thread crashed, clear poison because we don't care - // about the state - lock_state.clear_poison(); - } - tracing::info!("Restarting..."); let span = span!(Level::DEBUG, "stop_command").entered(); @@ -102,4 +101,4 @@ pub fn restart(name: &str, service: &Service, default: &Service, lock_state: Arc tracing::info!("Completed !"); true -} +} \ No newline at end of file