From 5232db72897bb4a32016bd501c4a7e1fb71fcbec Mon Sep 17 00:00:00 2001
From: copilotcoder <copilotcoder@darkhelm.org>
Date: Sat, 11 Jul 2026 17:07:58 -0400
Subject: [PATCH] Publish mirrors only from kankali and improve diagnostics

---
 .../gitea-actions/repair_runner_mirror.xsh    | 68 +++++++++++++------
 1 file changed, 47 insertions(+), 21 deletions(-)

diff --git a/scripts/gitea-actions/repair_runner_mirror.xsh b/scripts/gitea-actions/repair_runner_mirror.xsh
index 39c4cad..6904ac0 100755
--- a/scripts/gitea-actions/repair_runner_mirror.xsh
+++ b/scripts/gitea-actions/repair_runner_mirror.xsh
@@ -7,21 +7,42 @@ hosts = [
     "pi-desktop.darkhelm.lan",
 ]
 
-# Pull upstream tags, retag/push to local registry mirrors, and verify pullability.
-remote_code = """
+publisher_host = "kankali.darkhelm.lan"
+
+# Pull upstream tags on the registry host, publish mirror tags there, then verify pullability on every host.
+remote_code_template = """
 mirror_pairs = [
     ("ACT_UBUNTU", "ghcr.io/catthehacker/ubuntu:act-latest", "kankali.darkhelm.lan:3001/darkhelm.org/act-ubuntu:act-latest"),
     ("RENOVATE", "ghcr.io/renovatebot/renovate:41", "kankali.darkhelm.lan:3001/darkhelm.org/renovate:41"),
     ("PLAYWRIGHT", "mcr.microsoft.com/playwright:v1.56.1-jammy", "kankali.darkhelm.lan:3001/darkhelm.org/playwright-browsers:v1.56.1-jammy"),
 ]
 
+is_publisher = __IS_PUBLISHER__
+
 def classify_failure(prefix, log_path):
     mismatch = !(grep -qi "http response to https client" @(log_path))
-    print(f"{prefix}:https-mismatch" if mismatch.returncode == 0 else f"{prefix}:failed")
+    if mismatch.returncode == 0:
+        print(f"{prefix}:https-mismatch")
+    else:
+        print(f"{prefix}:failed")
+    tail = !(tail -n 20 @(log_path) 2> /dev/null)
+    if tail.returncode == 0 and str(tail.out).strip():
+        print(f"{prefix}_LOG_START")
+        print(str(tail.out).rstrip())
+        print(f"{prefix}_LOG_END")
 
-$(docker pull ubuntu:22.04)
+def image_present(image):
+    result = !(docker image inspect @(image) > /dev/null 2>&1)
+    return result.returncode == 0
 
-if $(docker image inspect ubuntu:22.04):
+ubuntu_pull_log = "/tmp/ubuntu22-pull.log"
+ubuntu_pull = !(docker pull ubuntu:22.04 > @(ubuntu_pull_log) 2>&1)
+if ubuntu_pull.returncode == 0:
+    print("UBUNTU22_PULL:ok")
+else:
+    classify_failure("UBUNTU22_PULL", ubuntu_pull_log)
+
+if image_present("ubuntu:22.04"):
     print("UBUNTU22_PRESENT")
 else:
     print("UBUNTU22_MISSING")
@@ -34,24 +55,28 @@ for label, source_image, mirror_image in mirror_pairs:
     mirror_push_log = f"/tmp/{label.lower()}-mirror-push.log"
     mirror_verify_log = f"/tmp/{label.lower()}-mirror-verify.log"
 
-    src_pull = !(docker pull @(source_image) > @(src_pull_log) 2>&1)
-    if src_pull.returncode == 0:
-        print(f"{label}_SOURCE_PULL:ok")
-    else:
-        classify_failure(f"{label}_SOURCE_PULL", src_pull_log)
-        continue
+    if is_publisher:
+        src_pull = !(docker pull @(source_image) > @(src_pull_log) 2>&1)
+        if src_pull.returncode == 0:
+            print(f"{label}_SOURCE_PULL:ok")
+        else:
+            classify_failure(f"{label}_SOURCE_PULL", src_pull_log)
+            continue
 
-    tag = !(docker tag @(source_image) @(mirror_image))
-    if tag.returncode != 0:
-        print(f"{label}_TAG:failed")
-        continue
+        tag = !(docker tag @(source_image) @(mirror_image) > /dev/null 2>&1)
+        if tag.returncode != 0:
+            print(f"{label}_TAG:failed")
+            continue
 
-    push = !(docker push @(mirror_image) > @(mirror_push_log) 2>&1)
-    if push.returncode == 0:
-        print(f"{label}_MIRROR_PUSH:ok")
+        push = !(docker push @(mirror_image) > @(mirror_push_log) 2>&1)
+        if push.returncode == 0:
+            print(f"{label}_MIRROR_PUSH:ok")
+        else:
+            classify_failure(f"{label}_MIRROR_PUSH", mirror_push_log)
+            continue
     else:
-        classify_failure(f"{label}_MIRROR_PUSH", mirror_push_log)
-        continue
+        print(f"{label}_SOURCE_PULL:skipped")
+        print(f"{label}_MIRROR_PUSH:skipped")
 
     # Validate mirror pullability with this host's Docker registry config.
     rm_image = !(docker image rm @(mirror_image) > /dev/null 2>&1)
@@ -61,7 +86,7 @@ for label, source_image, mirror_image in mirror_pairs:
     else:
         classify_failure(f"{label}_MIRROR_PULL", mirror_verify_log)
 
-    if $(docker image inspect @(mirror_image)):
+    if image_present(mirror_image):
         print(f"{label}_MIRROR_PRESENT")
     else:
         print(f"{label}_MIRROR_MISSING")
@@ -69,4 +94,5 @@ for label, source_image, mirror_image in mirror_pairs:
 
 for host in hosts:
     print(f"\n=== {host} ===")
+    remote_code = remote_code_template.replace("__IS_PUBLISHER__", "True" if host == publisher_host else "False")
     ssh @(host) @(remote_code)