Fix alembic migration crash on a password containing a percent-encoded char

[ckm007]

Summary

alembic/env.py's config.set_main_option("sqlalchemy.url", PG_CONNECTION) writes the value through a ConfigParser, which treats any literal % as the start of %(name)s interpolation syntax. install.sh's urlencode() correctly percent-encodes special characters in POSTGRES_PASSWORD before embedding it in PG_CONNECTION (e.g. @ → %40) — a valid, necessary escape for the connection URL itself — but ConfigParser has no idea that's what it is and raises invalid interpolation syntax the moment such a password is used. This crashes every alembic invocation before any migration or DB connection is attempted, including the stamp head retry fallback in entrypoint.sh (identically, since it hits the same line).

Live crash this fixes:

ValueError: invalid interpolation syntax in 'postgresql+psycopg://mosip:nexus%40123@nexus-postgres:5432/mosipnexus' at position 32

Fix

Escape % as %% before calling set_main_option(). ConfigParser un-escapes %% back to % on read, so this doesn't change the actual URL passed to SQLAlchemy — verified directly by round-tripping the exact failing connection string through configparser.set() + .get() with this escape, producing byte-identical output.

Verification

• python3 -m py_compile — clean
• Direct round-trip test: ConfigParser().set('s','k', url.replace('%','%%')) then .get('s','k') returns the original url unchanged
• Not fixing the adjacent entrypoint.sh stamp-and-retry fallback in this PR — flagged separately, left as-is per explicit request

https://claude.ai/code/session_01A5KE4fZxHqbeiDaUJenSfU

Summary by CodeRabbit

• Bug Fixes

  • Preserved percent-encoded credentials in PostgreSQL connection settings, preventing configuration errors.

• Deployment

  • Simplified server and UI installation commands.
  • Installations now use the nexus namespace and require a local my-values.yaml configuration file.
  • Removed support for specifying a separate values file during installation.

[coderabbitai]

Walkthrough

Alembic now preserves percent-encoded PostgreSQL credentials. Nexus server and UI installers now use local my-values.yaml files, remove optional values-file arguments, and use the nexus namespace for the server deployment.

Changes

Nexus configuration and deployment

Layer / File(s)	Summary
Alembic connection URL escaping MosipNexus/Server/alembic/env.py	Percent signs in PG_CONNECTION are escaped before Alembic stores the URL.
Helm installer configuration MosipNexus/deploy/nexus-server/install.sh, MosipNexus/deploy/nexus-ui/install.sh	Both installers require local my-values.yaml files and remove optional values-file arguments. The server installer uses the nexus namespace.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

Percent signs pass safely through,
Helm finds values where they belong.
Nexus names align anew,
Install scripts stay clear and strong.
Config and charts move along.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary Alembic fix for migration crashes caused by percent-encoded passwords.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-alembic-percent-encoding-crash

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@MosipNexus/deploy/nexus-server/install.sh`:
- Line 36: Update the namespace handling around the NS release configuration to
provide an explicit migration or legacy-release guard when moving from
mosip-nexus to nexus, preventing creation of a second stack. Ensure delete.sh
cleanup handles resources/releases in both namespaces so legacy mosip-nexus
deployments are not left behind.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 557834b1-a155-4248-9df9-01ef020c6267

📥 Commits

Reviewing files that changed from the base of the PR and between 91b7869 and 2d9af6f.

📒 Files selected for processing (3)

• MosipNexus/Server/alembic/env.py
• MosipNexus/deploy/nexus-server/install.sh
• MosipNexus/deploy/nexus-ui/install.sh