`bin/console addon enable` returns rc=0 with empty stderr in two failure
modes: (1) when the Friendica DB is mid-migration ("Database isn't ready or
populated yet" on stderr) and (2) occasionally on a fresh stack where the
command installs nothing — no config entry, no hooks registered. The
second mode leaves ldapauth silently inert and every LDAP login is
rejected.
Add a dedicated DB-ready probe that exercises the same code path as
enable/disable (`addon list all`) and only proceeds once stderr is clean.
Then replace the thin rc-based until with an effective-state check: run
enable/disable, swallow idempotent "already enabled/disabled" errors, and
verify the addon appears (or does not appear) in `addon list enabled`.
Retry the whole cycle — the second invocation reliably registers hooks.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add copy task in tasks/main.yml to stage patch_decidim.py into build context
- Pass HOST_REL and DOCKER path as build ARGs via compose.yml.j2
- Use COPY + RUN in Dockerfile with no inline code
- patch_decidim.py remains single source of truth for unit tests
Swap size was free(/)-25, which took ~99 GB on the 145 GB root fs.
Remaining ~25 GB then ran out mid-deploy during Playwright image
pulls (ENOSPC). Replace with a fixed 16 GB cap and use mountpoint
to detect a real /mnt partition instead of [ -d /mnt ], which
matched the empty placeholder dir on single-partition runners.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Three orthogonal CI flakes addressed after autonomous iteration via the
Role Loop protocol (3 fresh-purged/reuse-kept cycles, all green on final).
web-app-matrix/files/playwright.spec.js
DM block retries=0 -> 1. rc_login exhaustion (the original reason for
retries=0) is obsolete: the 120s drain wait before admin's signin
already eliminates that class of failure. The dominant failure mode is
now CI infra pressure surfacing as "Target page, context or browser has
been closed" mid-navigation under the combined Synapse + Element +
bridges + Keycloak + Mailu + Matomo load on a standard runner. One
retry tolerates those transient crashes without burning 3x the budget.
web-app-joomla/tasks/02_install.yml
Delete stale stub configuration.php before install. The joomla
5.4.5-php8.3-apache image populates /var/www/html asynchronously: the
test -f configuration.php check races with a stub landing ~0.7s later.
CLI installer then refuses with "configuration.php already present\!".
Scoped to joomla_installed.rc \!= 0 so an existing install is never
touched.
web-app-joomla/tasks/06_reset_admin_password.yml
Add retries: 6 delay: 5 to reset-password. First post-install
invocation transiently reports "The user administrator does not exist\!"
even though user:list shows the user. Looks like a race between the
install's DB commit and the CLI's user lookup on a fresh Symfony boot.
A truly missing user still fails after all retries.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Surfaces df, failed units, and hlth-disc-space status/journal from
inside the infinito container so failure-time dumps reflect the same
filesystem view that the disk-space health check evaluates, not just
the host.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Extracts disk/memory/docker/swap dump into a reusable helper,
calls it pre/post swap resize, and runs it on deploy failure
across all four deploy workflows. Also adds SKIP_SWAP=1
short-circuit for A/B probing swap-related regressions.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
All OIDC env vars (OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET)
must be present - fail fast with KeyError if missing rather than
silently passing nil to the provider
- Add bootstrap send before biber invite-accept poll. Element only creates
the DM (and dispatches the invite) once admin sends; without this the
invite tile never appears for biber and the poll times out.
- Tighten attachDiagnostics regex from /content security policy|csp/i to
/content security policy/i. The `|csp` alternative false-positived on
base58 strings inside matrix_sdk_crypto decrypt warnings (e.g. event_ids
containing the substring "csP"), breaking the OIDC-login tests on dirty
state. Real browser CSP violations always include the full phrase; the
securitypolicyviolation DOM event in installCspViolationObserver remains
the canonical source.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The 11 mailu sub-containers (admin, imap, smtp, antispam, antivirus,
oletools, webdav, fetchmail, webmail, resolver, front) are internal
to mailu's multi-container decomposition, not shared with other
roles. Add explicit shared=false so the service shared/enabled
consistency lint passes.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Introduce scripts/github/enlarge_swap.sh that consumes all remaining
space on / minus a 25 GB buffer (Docker layers, checkout, runtime
state), falling back to /mnt when / is too small. Replaces the
default ~4 GB runner swap so transient memory spikes (e.g. peertube
plugin install, issue #162) don't trip the host OOM-killer on the
16 GB GitHub-hosted runner.
Wire the script into all four deploy test workflows (local, universal,
server, workstation) and flip free-disk-space to the aggressive config
(tool-cache, large-packages, docker-images, swap-storage all true):
the deploy actually runs inside the infinito container, so host-side
toolchains, language runtimes, and the default Docker layer cache are
dead weight. Update the workflow SPOT doc accordingly.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace the hardcoded 1024 MB ceiling for PEERTUBE_OIDC_PLUGIN_INSTALL_MAX_OLD_SPACE_MB
with a dynamic value via node_max_old_space_size (pct=0.125, min=256, hardcap=1024).
The plugin installer runs inside the peertube cgroup via container exec, so its
budget is a share of the parent container, not a separate service claim. Keeps
the install heap well below the runtime heap to leave headroom for npm's forked
workers (node-gyp, postinstall) on constrained CI runners (#162).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Expose INFINITO_MEM_LIMIT/INFINITO_MEMSWAP_LIMIT/INFINITO_CPUS on the
infinito service so operators can cap local runs to GitHub-hosted runner
specs and reproduce OOM failures like #162. Document the compose.yml as
a dev/CI-only artefact under docs/contributing/artefact/files/ and link
to it from the CI debugging guide.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds a container-shaped heuristic so non-shared compose.services entries
that declare neither resource fields (mem_*/pids_limit/cpus) nor
container-identifying fields (image/name/version/container) are treated
as feature flags and excluded from the resource table. Keeps the
keycloak recaptcha toggle and similar booleans out of the per-role
footprint. Adds unit coverage for the helper and recursion behavior.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Fills in mem_reservation/mem_limit/pids_limit/cpus on service entries
that previously had none, so the role resource aggregator reports a
realistic per-role footprint. Sets light caps on static/SPA providers
(asset, cdn, file, dashboard) and flips mailu sub-services (admin,
imap, smtp, antispam, antivirus, oletools, webdav, fetchmail, webmail,
resolver, front) to enabled: true so the existing values are picked up
during the shared-service walk.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds a CLI that reports per-container resource budgets (mem_reservation,
mem_limit, pids_limit, cpus) for an Ansible role, recursively following
enabled shared services via the service registry. Aggregation rules:
mem_* and pids_limit are summed; cpus is MAX (shared across containers,
not additive). Includes text + JSON output, cycle protection, and unit
tests covering parsing helpers, aggregation, recursion, rendering, and
end-to-end CLI invocation.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add repo root to sys.path before importing utils.runtime_lookup_data
so the script works when invoked as a subprocess (e.g. from
tests/unit/cli/validate/test_inventory.py) without PYTHONPATH set.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- iam/{common,ldap,oidc}.md: point at 11_oidc.yml and 12_ldap.yml
(renamed from 13_/14_ in group_vars numbering).
- requirements/003-*.md: repoint iteration.md links to
docs/agents/action/iteration/{role,workflow}.md.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
