didericis-claude
dee0121e8d
prd-number-check / require-numbered-prds (pull_request) Successful in 13s
tracker-policy-pr / check-pr (pull_request) Successful in 7s
test / image-input-builds (pull_request) Successful in 41s
test / unit (pull_request) Successful in 51s
test / integration-docker (pull_request) Successful in 58s
test / coverage (pull_request) Successful in 41s
test / image-input-builds (push) Successful in 48s
test / unit (push) Successful in 56s
lint / lint (push) Successful in 1m2s
Update Quality Badges / update-badges (push) Successful in 1m4s
test / integration-docker (push) Failing after 2m53s
test / coverage (push) Has been skipped
On a Firecracker gateway cold boot, reconcile every live agent VM against the fresh gateway: push the new mitmproxy CA into each agent's trust store, re-provision git-gate repos/creds from the persisted upstreams snapshot, and restore egress tokens. Per-bottle failures are logged and skipped so one unreachable VM does not block the rest. New modules / changes: - backend/firecracker/reconcile.py: attach_bottled_agents_to_gateway, _push_ca, _reprovision_git_gate, _guest_ip_from_config - git_gate/provision.py: write upstreams.json after key provisioning so the bring-up reconcile can reconstruct the upstream table without the manifest - backend/firecracker/infra.py: call attach_bottled_agents_to_gateway in the cold-boot branch of ensure_running() - backend/base.py: no-op default on BottleBackend - backend/firecracker/consolidated_launch.py: remove superseded _reprovision_running_bottles / _guest_ip_from_config - orchestrator: OrchestratorCore.update_agent_secret + POST /bottles/<id>/secret + client.update_agent_secret (single-secret in-place update, the reusable primitive from the 2026-07-26 hotfix) - tests: 15 new tests in test_firecracker_reconcile.py; updated test_firecracker_infra.py cold-boot cases; stale FC reprovision tests removed from test_backend_secret_reprovision.py Closes #516.
54 lines
2.6 KiB
Markdown
54 lines
2.6 KiB
Markdown
# CI
|
|
|
|
## Required pull-request gate
|
|
|
|
[`.gitea/workflows/test.yml`](../.gitea/workflows/test.yml) runs the unit
|
|
suite, Docker integration suite, combined coverage report, and diff-coverage
|
|
gate when tested package/build inputs change on a pull request or on `main`.
|
|
|
|
The Docker job preflights the backend before discovery. Gitea's `act_runner`
|
|
runs the job in a container with the host Docker socket, so the test process
|
|
reaches control-plane siblings through the job's Docker network and uses named
|
|
Docker volumes for orchestrator/CA state the host daemon must mount. The
|
|
orchestrator runs the package baked into the image built from the checkout; it
|
|
does not bind the job container's invisible workspace into a sibling container.
|
|
Docker integration jobs share fixed singleton names, so required and manual
|
|
runs use one non-cancelling concurrency group. The shared agent/gateway network
|
|
has an explicit subnet, which Docker requires for the pinned source IPs used as
|
|
the isolation/attribution key.
|
|
|
|
`scripts.unittest_gate` enforces the Docker job's contract: all 22 integration
|
|
tests must execute and none may skip. This includes the real gateway-image,
|
|
control-plane authentication, multitenant policy/token isolation,
|
|
sandbox-escape, and orphan-network tests. Backend skip decorators remain useful
|
|
for local runs, but the CI preflight plus execution-count gate prevents a
|
|
missing backend or runner-topology regression from becoming a green job.
|
|
|
|
Combined unit + Docker coverage is informational globally. Two focused gates
|
|
are enforced:
|
|
|
|
- changed executable Python lines must be at least 90% covered; and
|
|
- the validated critical security/logic core must remain at least 90% covered.
|
|
|
|
## Privileged pre-release matrix
|
|
|
|
[`.gitea/workflows/pre-release-test.yml`](../.gitea/workflows/pre-release-test.yml)
|
|
is manually dispatched before a release. It repeats unit and Docker integration
|
|
coverage, then runs:
|
|
|
|
- Firecracker integration on the self-hosted `kvm` runner; and
|
|
- advisory Apple Container integration on the self-hosted `macos` runner.
|
|
|
|
These privileged host-mode runners never execute unreviewed pull-request code
|
|
automatically. Firecracker coverage is combined in the manual pre-release
|
|
report; macOS reports advisory coverage in its own job. The macOS infra
|
|
container is a singleton, so its job uses a concurrency group and always tears
|
|
the service down.
|
|
|
|
## Scheduled canary
|
|
|
|
[`.gitea/workflows/canaries.yml`](../.gitea/workflows/canaries.yml) runs weekly
|
|
and on manual dispatch. It verifies the pinned gitleaks release URL, checksum,
|
|
archive shape, and executable. The same unittest execution gate requires at
|
|
least one executed canary and rejects skips.
|