From 98a6af7d9ee82e867780e338dd2153bc00f057ab Mon Sep 17 00:00:00 2001
From: marshmallow <git@althaea.zone>
Date: Fri, 15 May 2026 01:50:27 +0000
Subject: [PATCH] move keys @ preactivation immediately before activation (#490)

---
 CHANGELOG.md | 6 ++++++
 crates/core/src/hive/plan.rs | 39 ++++++++++++---------------------------
 2 file(s) changed, 18 insertion(s)(+), 27 deletion(s)(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@
 
 ## [Unreleased] - yyyy-mm-dd
 
+### Changed
+
+- The pre-activation key stage is now scheduled after the evaluation stage. The
+  rationale for this is that while iterating on evaluation errors it was often quite 
+  annoying to repeatedly enter your password for key deployment.
+
 ### Fixed
 
 - Use `AssertPathExists` instead of conditional path existence checks for key services.
diff --git a/crates/core/src/hive/plan.rs b/crates/core/src/hive/plan.rs
--- a/crates/core/src/hive/plan.rs
+++ b/crates/core/src/hive/plan.rs
@@ -139,17 +139,6 @@
         }));
     }
 
-    if !*no_keys
-        && matches!(
-            &goal,
-            ApplyGoal::Keys | ApplyGoal::SwitchToConfiguration(SwitchToConfigurationGoal::Switch)
-        )
-    {
-        let (pre, post) = apply_plan_keys(args, node, &target);
-        steps.extend(pre);
-        end.extend(post);
-    }
-
     if !matches!(goal, ApplyGoal::Keys) {
         steps.push(Step::Evaluate(Evaluate));
     }
@@ -182,6 +171,17 @@
             substitute_on_destination: *substitute_on_destination,
             target: target.clone(),
         }));
+    }
+
+    if !*no_keys
+        && matches!(
+            &goal,
+            ApplyGoal::Keys | ApplyGoal::SwitchToConfiguration(SwitchToConfigurationGoal::Switch)
+        )
+    {
+        let (pre, post) = apply_plan_keys(args, node, &target);
+        steps.extend(pre);
+        end.extend(post);
     }
 
     if let ApplyGoal::SwitchToConfiguration(goal) = goal {
@@ -303,22 +303,7 @@
 
         assert_eq!(
             plan.steps,
-            vec![
-                Evaluate.into(),
-                Build { target: None }.into() // TODO: this was previously used in an old test, may lose
-                                              // coverage by deleting it.
-                                              // Ping { }.into(),
-                                              // PushKeyAgent { host_platform: "x86_64-linux".into(), substitute_on_destination: true, target: Target::default() }.into(),
-                                              // Keys { .. }.into(),
-                                              // crate::hive::steps::evaluate::Evaluate.into(),
-                                              // crate::hive::steps::build::Build { .. }.into(),
-                                              // crate::hive::steps::push::PushBuildOutput { .. }.into(),
-                                              // SwitchToConfiguration { .. }.into(),
-                                              // Keys {
-                                              //     filter: UploadKeyAt::PostActivation
-                                              // }
-                                              // .into(),
-            ]
+            vec![Evaluate.into(), Build { target: None }.into()]
         );
     }
 

--
tangled.sh