Files
plex-playlist/scripts/gitea-actions/runner-prechange-capture.xsh
Xlorep DarkHelm f3698b095b
All checks were successful
CICD / Build and Publish CICD Base Image (push) Successful in 6m8s
CICD / Build and Push CICD Image (push) Successful in 23m14s
CICD / Build CICD Image Failure Postmortem (push) Has been skipped
CICD / Backend Tests (push) Successful in 7m10s
CICD / Frontend Tests (push) Successful in 45s
CICD / Backend Doctests (push) Successful in 18s
CICD / Pre-commit Checks (push) Successful in 14m57s
CICD / Source Lanes Failure Postmortem (push) Has been skipped
CICD / CICD Tests Complete (push) Successful in 3s
CICD / Build Backend Base Image (push) Successful in 18s
CICD / Build Integration Tester Image (push) Successful in 1m5s
CICD / Build Backend Main Image (push) Successful in 1m52s
CICD / Build Frontend Base Image (push) Successful in 10m42s
CICD / Build Frontend Main Image (push) Successful in 33s
CICD / Build E2E Tester Image (push) Successful in 32m17s
CICD / Production Images Complete (push) Successful in 5s
CICD / Production Image Failures Postmortem (push) Has been skipped
CICD / Runtime Black-Box Integration Tests (push) Successful in 1m13s
CICD / Integration Tests Failure Postmortem (push) Has been skipped
CICD / End-to-End Tests (push) Successful in 11m23s
CICD / E2E Tests Failure Postmortem (push) Has been skipped
Stabilize self-hosted CI workflows and resolve issue #62 (#73)
## Summary

Hardens CI workflows for self-hosted Gitea runners by stabilizing E2E execution and Renovate behavior across internal/external network paths.

Closes #62

## What Changed

### E2E workflow reliability
- Fixed E2E workspace handoff to ensure expected repository contents are present during test execution.
- Added stricter preflight checks for required frontend files before running E2E.
- Reduced mount/path fragility while preserving runtime image pull and compose flow.

### Renovate workflow hardening
- Added internal-first endpoint reachability selection with fallback handling.
- Added token preflight checks for repository access.
- Added explicit host-rule auth handling for API/git paths.
- Added container-level connectivity preflight diagnostics.
- Added git URL override aligned with selected endpoint context.
- Removed incorrect forced Dogar host-IP pinning that broke HTTPS clone routing.

## Why

CI behavior was sensitive to runner networking and Renovate clone/auth interactions. These changes make the workflow deterministic in our runner topology and address recurring CI failures.

## Scope

- Workflow logic only (`cicd.yaml`, `renovate.yml`)
- No app feature or API behavior changes

## Validation

- Workflow YAML validation passed during updates.
- Changes were applied and verified iteratively from real failing run diagnostics.

Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #73
2026-07-13 11:16:16 -04:00

136 lines
4.8 KiB
Plaintext
Executable File

#!/usr/bin/env xonsh
"""Capture runner restart/OOM/log baseline from all hosts before rollout changes."""
import os
import sys
from datetime import datetime
HOSTS = {
"kankali.darkhelm.lan": "/home/darkhelm/Projects/DarkHelm.org/gitea",
"zhokq.darkhelm.lan": "/home/darkhelm/Projects/DarkHelm.org/gitea-runner",
"urtzul.darkhelm.lan": "/home/darkhelm/Projects/DarkHelm.org/gitea-runner",
"pi-desktop.darkhelm.lan": "/home/darkhelm/Projects/DarkHelm.org/gitea-runner",
}
TAIL_LINES = 40
if len(sys.argv) > 1:
try:
TAIL_LINES = int(sys.argv[1])
except ValueError:
print("Invalid tail line count, using default 40")
BATCH_MODE = "--batch" in sys.argv[1:]
def ssh(host, cmd):
if BATCH_MODE:
out = !(ssh -o BatchMode=yes -o ConnectTimeout=20 -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o ControlMaster=auto -o ControlPersist=2h -o ControlPath=~/.ssh/cm-%r@%h:%p @(host) @(cmd))
else:
out = !(ssh -o ConnectTimeout=60 -o ServerAliveInterval=30 -o ServerAliveCountMax=6 -o ControlMaster=auto -o ControlPersist=2h -o ControlPath=~/.ssh/cm-%r@%h:%p @(host) @(cmd))
return out.returncode, str(out.out).rstrip("\n")
def section(title, body):
sep = "=" * 80
return f"\n{sep}\n{title}\n{sep}\n{body}\n"
def list_runner_containers(host):
rc, text = ssh(
host,
"docker ps -a --filter name=gitea-act-runner --format '{{.Names}}'",
)
if rc != 0 or not text:
return []
return [line.strip() for line in text.splitlines() if line.strip()]
report_dir = f"/tmp/runner-prechange-{datetime.now().strftime('%Y%m%d_%H%M%S')}"
mkdir -p @(report_dir)
report_path = os.path.join(report_dir, "capture.txt")
print("Runner pre-change capture started")
print(f"Report directory: {report_dir}")
print(f"SSH mode: {'batch' if BATCH_MODE else 'interactive'}")
entries = {}
for host, root in HOSTS.items():
print(f"Collecting: {host}")
data = {"root": root}
rc, output = ssh(host, f"test -d {root}")
data["path"] = "EXISTS" if rc == 0 else "NOT_FOUND"
rc, ps_text = ssh(host, "docker ps -a --format 'table {{.Names}}\t{{.Status}}'")
data["ps"] = ps_text
runner_containers = list_runner_containers(host)
data["runner_containers"] = runner_containers
inspect_lines = []
oom_lines = []
if not runner_containers:
inspect_lines.append("no-runner-containers-found")
oom_lines.append("no-runner-containers-found")
for container in runner_containers:
rc, inspect_text = ssh(
host,
f"docker inspect {container} --format '{container} restart={{{{.RestartCount}}}} oom={{{{.State.OOMKilled}}}} status={{{{.State.Status}}}} started={{{{.State.StartedAt}}}} finished={{{{.State.FinishedAt}}}}'",
)
if rc != 0:
inspect_text = f"{container}-inspect-unavailable"
inspect_lines.append(inspect_text)
rc, oom_text = ssh(
host,
f"docker inspect {container} --format '{{{{.Name}}}} oom={{{{.State.OOMKilled}}}} exit={{{{.State.ExitCode}}}} error={{{{.State.Error}}}}'",
)
if rc != 0:
oom_text = f"{container}-oom-scan-unavailable"
oom_lines.append(oom_text)
data["inspect"] = "\n".join(inspect_lines)
data["oom_scan"] = "\n".join(oom_lines)
rc, mem = ssh(host, "free -h")
data["mem"] = mem
runner_logs = {}
for container in runner_containers:
rc, log_text = ssh(host, f"docker logs --tail={TAIL_LINES} {container}")
if rc != 0:
log_text = f"{container}-logs-unavailable"
runner_logs[container] = log_text
data["runner_logs"] = runner_logs
entries[host] = data
with open(report_path, "w", encoding="utf-8") as handle:
handle.write("RUNNER PRE-CHANGE CAPTURE\n")
handle.write(f"Timestamp: {datetime.now().isoformat()}\n")
handle.write(f"Tail lines: {TAIL_LINES}\n")
for host, data in entries.items():
handle.write("\n" + ("#" * 80) + "\n")
handle.write(f"# HOST: {host}\n")
handle.write(f"# PATH: {data['root']}\n")
handle.write(("#" * 80) + "\n")
handle.write(section("1. PATH", data.get("path", "")))
handle.write(section("2. DOCKER PS", data.get("ps", "")))
handle.write(section("3. INSPECT RESTART/OOM", data.get("inspect", "")))
handle.write(section("4. OOM SCAN", data.get("oom_scan", "")))
handle.write(section("5. MEMORY", data.get("mem", "")))
containers = data.get("runner_containers", [])
if not containers:
handle.write(section("6. RUNNER LOGS", "no-runner-containers-found"))
else:
for idx, container in enumerate(containers, start=6):
handle.write(section(f"{idx}. RUNNER LOGS ({container})", data.get("runner_logs", {}).get(container, "")))
print("Capture complete")
print(f"Report: {report_path}")