Files
plex-playlist/scripts/gitea-actions/collect_runner_diagnostics.xsh
Xlorep DarkHelm f3698b095b
All checks were successful
CICD / Build and Publish CICD Base Image (push) Successful in 6m8s
CICD / Build and Push CICD Image (push) Successful in 23m14s
CICD / Build CICD Image Failure Postmortem (push) Has been skipped
CICD / Backend Tests (push) Successful in 7m10s
CICD / Frontend Tests (push) Successful in 45s
CICD / Backend Doctests (push) Successful in 18s
CICD / Pre-commit Checks (push) Successful in 14m57s
CICD / Source Lanes Failure Postmortem (push) Has been skipped
CICD / CICD Tests Complete (push) Successful in 3s
CICD / Build Backend Base Image (push) Successful in 18s
CICD / Build Integration Tester Image (push) Successful in 1m5s
CICD / Build Backend Main Image (push) Successful in 1m52s
CICD / Build Frontend Base Image (push) Successful in 10m42s
CICD / Build Frontend Main Image (push) Successful in 33s
CICD / Build E2E Tester Image (push) Successful in 32m17s
CICD / Production Images Complete (push) Successful in 5s
CICD / Production Image Failures Postmortem (push) Has been skipped
CICD / Runtime Black-Box Integration Tests (push) Successful in 1m13s
CICD / Integration Tests Failure Postmortem (push) Has been skipped
CICD / End-to-End Tests (push) Successful in 11m23s
CICD / E2E Tests Failure Postmortem (push) Has been skipped
Stabilize self-hosted CI workflows and resolve issue #62 (#73)
## Summary

Hardens CI workflows for self-hosted Gitea runners by stabilizing E2E execution and Renovate behavior across internal/external network paths.

Closes #62

## What Changed

### E2E workflow reliability
- Fixed E2E workspace handoff to ensure expected repository contents are present during test execution.
- Added stricter preflight checks for required frontend files before running E2E.
- Reduced mount/path fragility while preserving runtime image pull and compose flow.

### Renovate workflow hardening
- Added internal-first endpoint reachability selection with fallback handling.
- Added token preflight checks for repository access.
- Added explicit host-rule auth handling for API/git paths.
- Added container-level connectivity preflight diagnostics.
- Added git URL override aligned with selected endpoint context.
- Removed incorrect forced Dogar host-IP pinning that broke HTTPS clone routing.

## Why

CI behavior was sensitive to runner networking and Renovate clone/auth interactions. These changes make the workflow deterministic in our runner topology and address recurring CI failures.

## Scope

- Workflow logic only (`cicd.yaml`, `renovate.yml`)
- No app feature or API behavior changes

## Validation

- Workflow YAML validation passed during updates.
- Changes were applied and verified iteratively from real failing run diagnostics.

Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #73
2026-07-13 11:16:16 -04:00

96 lines
3.3 KiB
Plaintext

# Collect actionable runner diagnostics from all known runner hosts.
# Usage examples:
# source scripts/gitea-actions/collect_runner_diagnostics.xsh
# source scripts/gitea-actions/collect_runner_diagnostics.xsh "2 hours ago"
# source scripts/gitea-actions/collect_runner_diagnostics.xsh "90 minutes ago" "cicd-checks-1234"
from datetime import datetime, UTC
import subprocess
hosts = [
"kankali.darkhelm.lan",
"zhokq.darkhelm.lan",
"urtzul.darkhelm.lan",
"pi-desktop.darkhelm.lan",
]
since = $ARGS[0] if len($ARGS) > 0 else "2 hours ago"
trace = $ARGS[1] if len($ARGS) > 1 else ""
print(f"runner-diagnostics-start={datetime.now(UTC).isoformat()}")
print(f"since={since}")
print(f"trace_filter={trace or 'none'}")
remote_script = """
import subprocess
SINCE = __SINCE__
TRACE = __TRACE__
def run(cmd: str):
proc = subprocess.run(cmd, shell=True, text=True, capture_output=True)
if proc.stdout:
print(proc.stdout, end="")
if proc.stderr:
print(proc.stderr, end="")
return proc.returncode
run('echo "host=$(hostname -f 2>/dev/null || hostname)"')
run('echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"')
run('echo "kernel=$(uname -r 2>/dev/null || echo unknown)"')
print('=== system pressure ===')
run('free -h || true')
run('df -h || true')
run('uptime || true')
print('=== docker runner containers ===')
ps_cmd = "docker ps -a --format '{{.Names}}|{{.Image}}|{{.Status}}' | grep -E 'gitea|runner|act'"
if run(ps_cmd) != 0:
print('no_runner_container_match')
print('=== runner container inspect ===')
names_cmd = "docker ps -a --format '{{.Names}}' | grep -E 'gitea|runner|act' || true"
names_proc = subprocess.run(names_cmd, shell=True, text=True, capture_output=True)
container_names = [line.strip() for line in (names_proc.stdout or '').splitlines() if line.strip()]
for c in container_names:
print(f'--- container={c} ---')
run(f"docker inspect --format 'name={{{{.Name}}}} restart={{{{.RestartCount}}}} state={{{{.State.Status}}}} started={{{{.State.StartedAt}}}} finished={{{{.State.FinishedAt}}}}' {c} || true")
run(f'docker logs --since "{SINCE}" --tail 200 {c} 2>&1 || true')
print('=== docker daemon recent log ===')
if run('command -v journalctl >/dev/null 2>&1') == 0:
run(f'journalctl -u docker --since "{SINCE}" --no-pager -n 400 2>/dev/null || true')
else:
print('journalctl_unavailable=true')
print('=== oom and kill signals ===')
run("dmesg 2>/dev/null | grep -Ei 'killed process|out of memory|oom' | tail -n 80 || true")
if TRACE:
print('=== trace-filtered logs ===')
for c in container_names:
print(f'--- trace search in container={c} ---')
run(f'docker logs --since "{SINCE}" {c} 2>&1 | grep -F "{TRACE}" | tail -n 80 || true')
"""
remote_script = remote_script.replace("__SINCE__", repr(since)).replace("__TRACE__", repr(trace))
for host in hosts:
print(f"\n=== {host} ===")
try:
result = subprocess.run(
["ssh", host],
input=remote_script,
capture_output=True,
text=True,
check=False,
)
if result.stdout:
print(result.stdout, end="")
if result.stderr:
print(result.stderr, end="")
except Exception as exc:
print(f"runner_diagnostics_error host={host} error={exc}")