mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5
2d283ed39a
moby/buildkit was hardcoded in four places across two workflows and catthehacker/ubuntu in two act scripts, none of them reachable by the image mirror: utils/docker/image/discovery.py only scans roles/**/meta/services.yml. So the one image the CI build cannot proceed without was pulled straight from Docker Hub, unmirrored, which is what broke the fedora build in run 30160077828. Declare both as mirror-only services on svc-runner, following the test-e2e-playwright precedent, so the existing mirror pipeline picks them up unchanged. New scripts/meta/resolve/image/service_ref.sh reads image+version back out of the declaration and is the single source for consumers outside Ansible; its mode argument is mandatory (upstream never touches the network, mirror prefers the GHCR tag and falls back to upstream). The fallback is why the mirror job can keep running in parallel with the build instead of gating it. ACT_PLATFORM_IMAGE moves to an env handler so act consumers read the declared value via BASH_ENV, and workflow.sh now demands it instead of defaulting to a literal. Operator overrides still win through eb.setdefault. Verified: service_ref.sh in all four paths (upstream, mirror hit, missing mode, invalid mode); the mirror path matches GHCRProvider.image_base() character for character and resolves against the live registry anonymously; ACT_PLATFORM_IMAGE resolves through the real BASH_ENV mechanism; make quality green on all four targets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
83 lines
2.8 KiB
Bash
Executable File
83 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
: "${ACT_WORKFLOW:?ACT_WORKFLOW is not set (e.g. .github/workflows/test-environment.yml)}"
|
|
: "${ACT_EVENT:=workflow_dispatch}"
|
|
: "${ACT_JOB:=}"
|
|
: "${ACT_MATRIX:=}"
|
|
: "${ACT_CONTAINER_OPTIONS:=--privileged}"
|
|
: "${ACT_NETWORK:=host}"
|
|
: "${ACT_PULL:=false}"
|
|
: "${ACT_RM:=true}"
|
|
: "${ACT_PLATFORM_IMAGE:?ACT_PLATFORM_IMAGE is not set; source scripts/meta/env/load.sh or invoke via make}"
|
|
: "${ACT_BIND:=false}"
|
|
: "${ACT_INPUTS:=}"
|
|
: "${ACT_ENV:=}"
|
|
|
|
if [[ "${ACT_PLATFORM_IMAGE}" == local/act-runner-fixed:latest ]] &&
|
|
! docker image inspect "${ACT_PLATFORM_IMAGE}" >/dev/null 2>&1; then
|
|
bash "$(dirname "${BASH_SOURCE[0]}")/build_runner_image.sh"
|
|
fi
|
|
|
|
_act_cache_path="${ACT_ACTION_CACHE_PATH:-/tmp/actcache/act}" # nocheck: act-tool cache path, not a stack variable
|
|
_stale_mounts=$(mount | grep -E " on ${_act_cache_path}/[^ ]+ type devtmpfs " || true)
|
|
if [[ -n "${_stale_mounts}" ]]; then
|
|
echo "ERROR: stale devtmpfs bind-mounts inside ${_act_cache_path} block act from refreshing the actions cache." >&2
|
|
echo "Affected mountpoints:" >&2
|
|
echo "${_stale_mounts}" | awk '{print " " $3}' >&2
|
|
echo "Fix (run on the host, outside the agent sandbox):" >&2
|
|
echo " mount | awk -v p='${_act_cache_path}/' '\$5==\"devtmpfs\" && index(\$3,p)==1 {print \$3}' | sudo xargs -r umount" >&2
|
|
echo " sudo rm -rf ${_act_cache_path}" >&2
|
|
exit 3
|
|
fi
|
|
|
|
echo "=== act: workflow=${ACT_WORKFLOW} event=${ACT_EVENT} job=${ACT_JOB:-<all>} matrix=${ACT_MATRIX:-<none>} inputs=${ACT_INPUTS:-<none>} ==="
|
|
|
|
cmd=(act "${ACT_EVENT}" -W "${ACT_WORKFLOW}")
|
|
cmd+=(-P "ubuntu-latest=${ACT_PLATFORM_IMAGE}")
|
|
cmd+=(-P "ubuntu-24.04=${ACT_PLATFORM_IMAGE}")
|
|
cmd+=(-P "ubuntu-22.04=${ACT_PLATFORM_IMAGE}")
|
|
cmd+=(-P "ubuntu-20.04=${ACT_PLATFORM_IMAGE}")
|
|
|
|
if [[ -n "${ACT_JOB}" ]]; then
|
|
cmd+=(-j "${ACT_JOB}")
|
|
fi
|
|
if [[ -n "${ACT_MATRIX}" ]]; then
|
|
IFS=';' read -ra _act_matrix_filters <<<"${ACT_MATRIX}"
|
|
for pair in "${_act_matrix_filters[@]}"; do
|
|
cmd+=(--matrix "${pair}")
|
|
done
|
|
fi
|
|
if [[ -n "${ACT_INPUTS}" ]]; then
|
|
for pair in ${ACT_INPUTS}; do
|
|
cmd+=(--input "${pair}")
|
|
done
|
|
fi
|
|
if [[ -n "${ACT_ENV}" ]]; then
|
|
IFS=';' read -ra _act_env_pairs <<<"${ACT_ENV}"
|
|
for pair in "${_act_env_pairs[@]}"; do
|
|
cmd+=(--env "${pair}")
|
|
done
|
|
fi
|
|
if [[ -n "${ACT_CONTAINER_OPTIONS}" ]]; then
|
|
cmd+=(--container-options "${ACT_CONTAINER_OPTIONS}")
|
|
fi
|
|
if [[ -n "${ACT_NETWORK}" ]]; then
|
|
cmd+=(--network "${ACT_NETWORK}")
|
|
fi
|
|
cmd+=(--concurrent-jobs "1")
|
|
|
|
cmd+=(--pull="${ACT_PULL}")
|
|
cmd+=(--action-offline-mode)
|
|
cmd+=(--action-cache-path "${ACT_ACTION_CACHE_PATH:-/tmp/actcache/act}") # nocheck: act-tool cache path, not a stack variable
|
|
if [[ "${ACT_RM}" == "true" ]]; then
|
|
cmd+=(--rm)
|
|
fi
|
|
cmd+=(--cache-server-addr 127.0.0.1)
|
|
cmd+=(--artifact-server-addr 127.0.0.1)
|
|
if [[ "${ACT_BIND}" == "true" ]]; then
|
|
cmd+=(--bind)
|
|
fi
|
|
|
|
"${cmd[@]}"
|