From 05eb12595eaae42074a36784d9a95474e9e2926c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Bompard?= <aurelien@bompard.org>
Date: Fri, 22 May 2026 16:44:18 +0200
Subject: [PATCH] Apply hotfix patches to pagure.io too (staging for now)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>
---
 inventory/group_vars/pagure     |  2 ++
 inventory/group_vars/pagure_stg |  7 +++++++
 roles/pagure/tasks/main.yml     |  6 ++++++
 roles/pagure/tasks/patches.yml  | 35 +++++++++++++++++++++++++++++++++
 4 files changed, 50 insertions(+)
 create mode 100644 roles/pagure/tasks/patches.yml

diff --git a/inventory/group_vars/pagure b/inventory/group_vars/pagure
index eb711ff83c..5145af1cdf 100644
--- a/inventory/group_vars/pagure
+++ b/inventory/group_vars/pagure
@@ -72,6 +72,8 @@ vpn: true
 zabbix_host: zabbix01.vpn.fedoraproject.org
 zabbix_macros:
   'VFS.DEV.WRITE.AWAIT.WARN': 60 # frequently saturated writes overnight
+# Hotfixes
+pagure_patches: []
 
 notes: |
   Run the pagure instances for fedora
diff --git a/inventory/group_vars/pagure_stg b/inventory/group_vars/pagure_stg
index a63e991bc9..b1a01ec7b3 100644
--- a/inventory/group_vars/pagure_stg
+++ b/inventory/group_vars/pagure_stg
@@ -41,6 +41,13 @@ zabbix_host: zabbix01.vpn.fedoraproject.org
 zabbix_server: "{{ zabbix_hostname }}"
 zabbix_auth_key: "{{ zabbix_apikey }}" # ansible-private repo
 zabbix_tls_psk: "{{ zabbix_tls_prod_psk }}" # in ansible-private repo, pagure-stg is weird...
+# Hotfixes
+pagure_patches:
+  - b50d32b7c92f131ebcc3b633de6c6e91e28297ec
+  - 5529
+  - readme-include
+  - 26bc9746
+  - 5553
 
 notes: |
   Run the pagure instances for fedora
diff --git a/roles/pagure/tasks/main.yml b/roles/pagure/tasks/main.yml
index 3d7b874e26..96cdb5f381 100644
--- a/roles/pagure/tasks/main.yml
+++ b/roles/pagure/tasks/main.yml
@@ -429,6 +429,12 @@
   - fedora-messaging
 
 
+- name: Apply patches
+  ansible.builtin.import_tasks: patches.yml
+  tags:
+  - pagure
+  - patches
+
 # Set-up Pagure
 
 - name: Create the folders used for releases and archives
diff --git a/roles/pagure/tasks/patches.yml b/roles/pagure/tasks/patches.yml
new file mode 100644
index 0000000000..1c3b4495b6
--- /dev/null
+++ b/roles/pagure/tasks/patches.yml
@@ -0,0 +1,35 @@
+---
+- name: Install patch and filterdiff
+  ansible.builtin.dnf:
+    name:
+      - patch
+      - patchutils
+
+- name: Prepare the patches directory
+  ansible.builtin.file:
+    path: /opt/patches
+    state: directory
+    mode: "0755"
+
+- name: Download patches
+  ansible.builtin.copy:
+    src: /srv/web/infra/bigfiles/hotfixes/pagure/{{ item }}.patch
+    dest: /opt/patches/{{ item }}.patch
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ pagure_patches }}"
+
+- name: Apply patches
+  ansible.builtin.shell:
+    chdir: "{{ ansible_facts['python3']['sitelib'] }}"
+    cmd: filterdiff --include '?/pagure/*' /opt/patches/{{ item }}.patch | patch -p1 --forward --fuzz=0 --reject-file=- --batch
+  loop: "{{ pagure_patches }}"
+  register: result
+  ignore_errors: true
+  changed_when:
+    - "'Reversed (or previously applied) patch detected!' not in result.stdout"
+    - result.rc == 0
+  failed_when: "'FAILED' in result.stdout"
+  notify:
+  - Restart apache