Skip to content

Repository navigation

claude-update.tf: a daily claude update as ubuntu on the jumpboxes and metal boxes - #704

Merged
ejc3 merged 2 commits into
mainfrom
metal-claude-update
Oct 27, 2026
Merged

claude-update.tf: a daily claude update as ubuntu on the jumpboxes and metal boxes#704
ejc3 merged 2 commits into
mainfrom
metal-claude-update

Conversation

@ejc3

@ejc3 ejc3 commented Oct 27, 2026

Copy link
Copy Markdown
Owner

Nothing updated the native Claude Code on the jumpboxes and metal boxes. The boot scripts run the installer only when ~/.local/bin/claude is missing. Claude's own background updater does not run in pool sessions, because claw-master connect (which t-claude launches every pool session through) sets DISABLE_AUTOUPDATER=1. On 2026-10-27, fcvm-metal-arm was on 2.1.296 while 2.1.311 was out.

What changes

  • claude-update.tf: a daily SSM association, following the pattern of codex-update.tf. It runs at 08:00 UTC on both jumpboxes, fcvm-metal-arm and fcvm-metal-x86.
    • It runs claude update as ubuntu (runuser), from ubuntu's home, with stdin closed and DISABLE_AUTOUPDATER removed, and prints the version before and after.
    • A box without a native copy is reported and left alone, since installing is the boot script's job.
    • A failed update fails the run.
    • It restarts nothing: running sessions keep their binary, and the next session starts the new one.
  • scripts/test-claude-update.py (added to lambda-tests.yml):
    • It renders the commands from the Terraform and runs them against a fake runuser and claude, covering the update, a failure and a box with no copy.
    • It checks that the update call itself goes through runuser -u ubuntu and that DISABLE_AUTOUPDATER does not leak through.
    • It pins the four targets and the schedule, and checks that nothing is restarted or downloaded.
  • README.md and AGENTS.md: one line each, next to the Codex refresh.

The nextjs-ct containers are outside this association. Their nightly agent-update covers them, and #703 makes it run claude update.

Testing

  • All 113 offline suites from lambda-tests.yml pass. The runuser check fails with the wrapper removed from the update line.
  • terraform fmt -check claude-update.tf passes. The plan is the jumpbox's to run.
  • By hand on 2026-10-27, claude update as ubuntu on fcvm-metal-arm went from 2.1.296 to 2.1.311.

Codex: reviewed origin/main..09049ba (a P2 on the test's runuser check and a P3 on the container wording, both fixed in 40f6e5e), then 09049ba..40f6e5e (no findings).

ejc3 added 2 commits October 27, 2026 04:00
@ejc3
claude-update.tf: a daily claude update as ubuntu on the jumpboxes …
09049ba 
…and metal boxes

Nothing updated the native Claude Code on these boxes: the boot scripts run
the installer only when it is missing, and Claude's own updater does not run
in pool sessions, because `claw-master connect` sets DISABLE_AUTOUPDATER=1
for the Claude it launches. fcvm-metal-arm was on 2.1.296 while 2.1.311 was
out (2026-10-27).

- claude-update.tf: an SSM association (AWS-RunShellScript, the pattern of
  codex-update.tf) at 08:00 UTC daily on both jumpboxes, fcvm-metal-arm and
  fcvm-metal-x86. It runs `claude update` as ubuntu (runuser), from its home,
  stdin closed, DISABLE_AUTOUPDATER removed, and prints before -> after. A box
  without a native copy is reported and left alone; a failed update fails the
  run. It restarts nothing.
- scripts/test-claude-update.py: renders the commands from the Terraform and
  runs them against a fake runuser and claude (update, failure, no copy), and
  pins the targets, the schedule and that nothing is restarted or downloaded.
  Added to lambda-tests.yml.
- README.md and AGENTS.md: one line each, beside the Codex refresh.
@ejc3
claude-update: the test checks the update call itself runs as ubuntu;…
40f6e5e 
… the container note does not overclaim

- test-claude-update.py: the fake runuser exports who it ran as and the
  fake claude logs it with the update, so dropping the update's runuser
  wrapper fails the test (it passed before: the version probes alone logged
  ubuntu). Seen failing with the wrapper removed.
- claude-update.tf and AGENTS.md: the nextjs-ct containers are outside this
  association and covered by their own agent-update, without claiming what
  that job does.
@ejc3
ejc3 marked this pull request as ready for review October 27, 2026 04:05
@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: b855bfbb-dfa8-4623-9be1-994dc7824618
Commits

Reviewing files that changed from the base of the PR and between 126b09c and 40f6e5e.

Files selected for processing: 5
  • .github/workflows/lambda-tests.yml
  • AGENTS.md
  • README.md
  • claude-update.tf
  • scripts/test-claude-update.py
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-27T04:14:21.937726Z 40f6e5e Manual request
🔒 Security Review ✅ Completed 2026-10-27T04:16:07.929419Z 40f6e5e Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@ejc3

ejc3 commented Oct 27, 2026

Copy link
Copy Markdown
Owner Author

@codex review
@codex security review
@coderabbitai review
@greptileai review

@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@ejc3

ejc3 commented Oct 27, 2026

Copy link
Copy Markdown
Owner Author

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 27, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 40f6e5e2cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 27, 2026

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 40f6e5e2cd

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@ejc3

ejc3 commented Oct 27, 2026

Copy link
Copy Markdown
Owner Author

Reviewed exact head 40f6e5e2cd0dd1aa5e808832e7ef9d40c5e82902 at high for code and security. The daily SSM association updates the native Claude binary as ubuntu on the two jumpboxes and two metal boxes, from the account home with DISABLE_AUTOUPDATER cleared. It does not restart sessions, copy logins, add IAM permissions, or run package-manager commands.

Terraform validation and offline CI passed, including the six new updater tests. Codex code and security reviews completed with no findings, and all comments and review threads were checked. CodeRabbit was requested but is quota-limited; Greptile has not responded. Neither is counted as a sign-off. The recent-push quiet period has elapsed.

@ejc3
ejc3 merged commit b28ba10 into main Oct 27, 2026
3 checks passed
@ejc3

ejc3 commented Oct 27, 2026

Copy link
Copy Markdown
Owner Author

Merged and applied as b28ba10. The reviewed fresh full plan contained only the new daily updater association; apply succeeded and a full follow-up plan is empty. Both jumpboxes and the running ARM host executed it successfully and have Claude Code 2.1.311 installed. The x86 host is stopped and was not woken. Active sessions retain their existing process; /infra/applied-status is clean for this main commit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ejc3