From 9f4c9b77c822c173880060e1b651c476eddb425f Mon Sep 17 00:00:00 2001 From: Denis Bilenko Date: Wed, 7 Oct 2026 08:57:20 +0200 Subject: [PATCH 1/3] acc: stop asserting app job permissions after the first deploy On the direct engine the job permissions and the app (which grants the job permission) can be deployed in either order, so CAN_MANAGE_RUN after the first deploy is order-dependent. The test only removed the direct variant of that output; #6877 renamed the terraform variant to the generic file, so the flaky result is now compared. The second-deploy check, which is what #4309 is about, is unchanged. Co-authored-by: Isaac --- .../job_permissions/out.after_first_deploy.txt | 1 - .../bundle/apps/job_permissions/output.txt | 3 --- acceptance/bundle/apps/job_permissions/script | 16 +++------------- 3 files changed, 3 insertions(+), 17 deletions(-) delete mode 100644 acceptance/bundle/apps/job_permissions/out.after_first_deploy.txt diff --git a/acceptance/bundle/apps/job_permissions/out.after_first_deploy.txt b/acceptance/bundle/apps/job_permissions/out.after_first_deploy.txt deleted file mode 100644 index 27ba77ddaf6..00000000000 --- a/acceptance/bundle/apps/job_permissions/out.after_first_deploy.txt +++ /dev/null @@ -1 +0,0 @@ -true diff --git a/acceptance/bundle/apps/job_permissions/output.txt b/acceptance/bundle/apps/job_permissions/output.txt index ec50e4828c6..db0a6cafed3 100644 --- a/acceptance/bundle/apps/job_permissions/output.txt +++ b/acceptance/bundle/apps/job_permissions/output.txt @@ -15,9 +15,6 @@ Add the following section to the jobs permissions: -=== After first deploy ->>> has_manage_run - === After second deploy >>> [CLI] bundle deploy -qq Warning: app "my_app" references jobs "my_job" which has permissions set. To prevent permission override after deploying the app, please add the app service principal to the jobs permissions diff --git a/acceptance/bundle/apps/job_permissions/script b/acceptance/bundle/apps/job_permissions/script index 62b2886186b..ef4cee37c34 100644 --- a/acceptance/bundle/apps/job_permissions/script +++ b/acceptance/bundle/apps/job_permissions/script @@ -12,19 +12,9 @@ has_manage_run() { | jq 'any(.access_control_list[].all_permissions[]; .permission_level == "CAN_MANAGE_RUN")' } -title "After first deploy" -trace has_manage_run > out.after_first_deploy.txt -# This is flaky on direct, because there are (at least) two ways to complete deployment: -# sequence 1: -# job is deployed -# job permissions are deployed -# app is deployed -# sequence 2: -# job is deployed -# app is deployed, updates job permissions -# job permissions are deployed -# (It does not appear flaky on TF, maybe there is enough delay in one of the resources) -rm -f out.after_first_deploy.direct.txt +# The first deploy is not asserted: job permissions and the app (which grants the job +# permission) can be deployed in either order, so CAN_MANAGE_RUN may or may not be +# there yet. The second deploy must keep it (the bug this test covers). title "After second deploy" trace $CLI bundle deploy -qq From d2e11800ec6c83ae16bbab9f05fd57c862e9a47f Mon Sep 17 00:00:00 2001 From: Denis Bilenko Date: Wed, 7 Oct 2026 09:31:35 +0200 Subject: [PATCH 2/3] Keep the original explanation of the deploy orders Co-authored-by: Isaac --- acceptance/bundle/apps/job_permissions/script | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/acceptance/bundle/apps/job_permissions/script b/acceptance/bundle/apps/job_permissions/script index ef4cee37c34..22aad7aca48 100644 --- a/acceptance/bundle/apps/job_permissions/script +++ b/acceptance/bundle/apps/job_permissions/script @@ -12,9 +12,16 @@ has_manage_run() { | jq 'any(.access_control_list[].all_permissions[]; .permission_level == "CAN_MANAGE_RUN")' } -# The first deploy is not asserted: job permissions and the app (which grants the job -# permission) can be deployed in either order, so CAN_MANAGE_RUN may or may not be -# there yet. The second deploy must keep it (the bug this test covers). +# The permissions after the first deploy are not checked. This is flaky on direct, +# because there are (at least) two ways to complete deployment: +# sequence 1: +# job is deployed +# job permissions are deployed +# app is deployed +# sequence 2: +# job is deployed +# app is deployed, updates job permissions +# job permissions are deployed title "After second deploy" trace $CLI bundle deploy -qq From 588cb303026fe450557b6ba5fe51c1ae2ec1a491 Mon Sep 17 00:00:00 2001 From: Denis Bilenko Date: Wed, 7 Oct 2026 09:56:53 +0200 Subject: [PATCH 3/3] Keep the original comment wording Co-authored-by: Isaac --- acceptance/bundle/apps/job_permissions/script | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/acceptance/bundle/apps/job_permissions/script b/acceptance/bundle/apps/job_permissions/script index 22aad7aca48..191a5af55fe 100644 --- a/acceptance/bundle/apps/job_permissions/script +++ b/acceptance/bundle/apps/job_permissions/script @@ -12,8 +12,7 @@ has_manage_run() { | jq 'any(.access_control_list[].all_permissions[]; .permission_level == "CAN_MANAGE_RUN")' } -# The permissions after the first deploy are not checked. This is flaky on direct, -# because there are (at least) two ways to complete deployment: +# This is flaky on direct, because there are (at least) two ways to complete deployment: # sequence 1: # job is deployed # job permissions are deployed