hanuman/automation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci(forgejo): bundle runner-and-actions infrastructure fixes #3

Merged
pappi merged 3 commits from agent/fix-actions-resolution into main 2026-05-09 15:54:29 +00:00
Conversation 0 Commits 3 Files changed 4 +240 -5
pappi commented 2026-05-09 10:23:16 +00:00
Owner
Copy link

What

Three commits, three concerns, all in the runner / CI infrastructure
domain.

  1. ci(forgejo): use full URLs for Forgejo Action references

    • Updates forgejo/templates/branch-policy/.forgejo/workflows/branch-policy.yml
      (canonical) and .forgejo/workflows/branch-policy.yml
      (automation's own) to reference
      https://code.forgejo.org/actions/checkout@v4 and
      https://code.forgejo.org/actions/setup-node@v4 instead of
      bare actions/checkout@v4 / actions/setup-node@v4.
    • This PR's CI uses the head branch's workflow, so the fix is
      in place when CI runs against this PR — i.e. no break-glass
      on protection is needed.

  2. chore(forgejo): add forgejo-runner-1 to runner label set

    • Extends forgejo_runner_labels in
      forgejo/ansible/roles/forgejo-runner/defaults/main.yml
      with forgejo-runner-1:docker://node:22-bookworm.
    • The branch-policy workflow targets runs-on: forgejo-runner-1,
      and Forgejo Actions matches runs-on against labels (not
      names). Until this commit, no runner had a forgejo-runner-1
      label — jobs would queue indefinitely.

  3. docs(forgejo): add runner-recovery runbook

    • New file at forgejo/docs/runner-recovery-runbook.md.
    • Captures the half-state symptoms, root cause (single-use
      registration tokens), and the API-driven recovery sequence
      used on 2026-05-09. Documents the runs-on/label contract
      and the Forgejo Actions resolution gotcha now fixed.

Why

Tonight the runner was offline and jobs accumulated unrunnable. The
root causes:

  • Stale registration token in vault. Forgejo registration tokens
    are single-use; a prior register attempt consumed it, and re-runs
    saw runner registration token not found. The runbook documents
    fetching a fresh token via /api/v1/admin/runners/registration-token
    using a temp read:admin-scoped token, sidestepping the
    copy-paste-from-UI loop.

  • Label/runs-on mismatch. B3 distribution shipped
    runs-on: forgejo-runner-1 but the role only configured
    ubuntu-24.04 and ubuntu-latest labels. Even after registration,
    no runner would match. Adding forgejo-runner-1 as a label paired
    with docker://node:22-bookworm aligns runner config with the
    workflow contract.

  • Forgejo Actions resolution. uses: actions/checkout@v4
    resolves against the local Forgejo (git.hanumanapps.io/actions/)
    by default. There's no actions/checkout repo there, so jobs
    fail in ~1s with a 404 on git-upload-pack. Switching to full URLs
    at code.forgejo.org (the official Forgejo Actions mirror)
    resolves correctly and matches the recommended Forgejo idiom.

How verified

  • Runner brought online on 2026-05-09 with all three labels declared
    ([ubuntu-24.04 ubuntu-latest forgejo-runner-1]); daemon log
    confirmed via docker logs forgejo-runner --tail 5.
  • code.forgejo.org/actions/checkout and code.forgejo.org/actions/setup-node
    exist with v4 tags — verified via
    GET https://code.forgejo.org/api/v1/repos/actions/<name>/tags/v4 → 200.
  • yamllint clean on both updated workflow files and the role
    defaults.
  • This PR's branch-policy CI run is the live test of the action-URL
    fix; if it passes, the canonical template is ready for distribution
    to the other 5 repos via
    automation/forgejo/scripts/distribute-branch-policy.sh.

Follow-up after merge

After this lands on automation/main, the canonical template fix
needs to propagate to the other 5 repos (machine-protocol,
platform, verticals, portal-build, portal-operations). Run:

cd automation/forgejo
FORGEJO_ADMIN_TOKEN="..." scripts/distribute-branch-policy.sh --apply

Each PR opens on agent/add-branch-policy-workflow (the script's
default), runs CI on its head branch (which has the fixed workflow),
and is mergeable on green. Foundation PR (#3 on platform) re-runs
its CI after platform/main is fixed.

Refs: B3 (platform/docs/wip/B3-git-policy.md); B3 D26 (force-push
on feature branches allowed); runner-recovery-runbook (this PR).

## What Three commits, three concerns, all in the runner / CI infrastructure domain. 1. **`ci(forgejo): use full URLs for Forgejo Action references`** - Updates `forgejo/templates/branch-policy/.forgejo/workflows/branch-policy.yml` (canonical) and `.forgejo/workflows/branch-policy.yml` (automation's own) to reference `https://code.forgejo.org/actions/checkout@v4` and `https://code.forgejo.org/actions/setup-node@v4` instead of bare `actions/checkout@v4` / `actions/setup-node@v4`. - This PR's CI uses the head branch's workflow, so the fix is in place when CI runs against this PR — i.e. no break-glass on protection is needed. 2. **`chore(forgejo): add forgejo-runner-1 to runner label set`** - Extends `forgejo_runner_labels` in `forgejo/ansible/roles/forgejo-runner/defaults/main.yml` with `forgejo-runner-1:docker://node:22-bookworm`. - The branch-policy workflow targets `runs-on: forgejo-runner-1`, and Forgejo Actions matches `runs-on` against labels (not names). Until this commit, no runner had a `forgejo-runner-1` label — jobs would queue indefinitely. 3. **`docs(forgejo): add runner-recovery runbook`** - New file at `forgejo/docs/runner-recovery-runbook.md`. - Captures the half-state symptoms, root cause (single-use registration tokens), and the API-driven recovery sequence used on 2026-05-09. Documents the `runs-on`/label contract and the Forgejo Actions resolution gotcha now fixed. ## Why Tonight the runner was offline and jobs accumulated unrunnable. The root causes: - **Stale registration token in vault.** Forgejo registration tokens are single-use; a prior register attempt consumed it, and re-runs saw `runner registration token not found`. The runbook documents fetching a fresh token via `/api/v1/admin/runners/registration-token` using a temp `read:admin`-scoped token, sidestepping the copy-paste-from-UI loop. - **Label/`runs-on` mismatch.** B3 distribution shipped `runs-on: forgejo-runner-1` but the role only configured `ubuntu-24.04` and `ubuntu-latest` labels. Even after registration, no runner would match. Adding `forgejo-runner-1` as a label paired with `docker://node:22-bookworm` aligns runner config with the workflow contract. - **Forgejo Actions resolution.** `uses: actions/checkout@v4` resolves against the local Forgejo (`git.hanumanapps.io/actions/`) by default. There's no `actions/checkout` repo there, so jobs fail in ~1s with a 404 on `git-upload-pack`. Switching to full URLs at `code.forgejo.org` (the official Forgejo Actions mirror) resolves correctly and matches the recommended Forgejo idiom. ## How verified - Runner brought online on 2026-05-09 with all three labels declared (`[ubuntu-24.04 ubuntu-latest forgejo-runner-1]`); daemon log confirmed via `docker logs forgejo-runner --tail 5`. - `code.forgejo.org/actions/checkout` and `code.forgejo.org/actions/setup-node` exist with `v4` tags — verified via `GET https://code.forgejo.org/api/v1/repos/actions/<name>/tags/v4` → 200. - `yamllint` clean on both updated workflow files and the role defaults. - This PR's `branch-policy` CI run is the live test of the action-URL fix; if it passes, the canonical template is ready for distribution to the other 5 repos via `automation/forgejo/scripts/distribute-branch-policy.sh`. ## Follow-up after merge After this lands on `automation/main`, the canonical template fix needs to propagate to the other 5 repos (`machine-protocol`, `platform`, `verticals`, `portal-build`, `portal-operations`). Run: ```sh cd automation/forgejo FORGEJO_ADMIN_TOKEN="..." scripts/distribute-branch-policy.sh --apply ``` Each PR opens on `agent/add-branch-policy-workflow` (the script's default), runs CI on its head branch (which has the fixed workflow), and is mergeable on green. Foundation PR (#3 on `platform`) re-runs its CI after `platform/main` is fixed. --- Refs: B3 (`platform/docs/wip/B3-git-policy.md`); B3 D26 (force-push on feature branches allowed); runner-recovery-runbook (this PR).
Forgejo Actions resolves bare 'actions/<name>' against the local
instance, which has no actions/* org. Use full URLs at code.forgejo.org
so the runner can fetch checkout and setup-node from the official
Forgejo Actions mirror.

Without this fix, every PR's branch-policy CI fails in ~1 second with:
  GET /actions/checkout/info/refs ... 404 Not Found
  GET /actions/setup-node/info/refs ... 404 Not Found
branch-policy.yml workflow uses runs-on: forgejo-runner-1, but
Forgejo Actions matches runs-on against labels (not the runner's name).
Pair the label with docker://node:22-bookworm so jobs targeting it
run inside the same Node 22 container as ubuntu-24.04 and ubuntu-latest.
docs(forgejo): add runner-recovery runbook
All checks were successful
Branch policy / branch-policy (pull_request) Successful in 1m11s
Details
31e6d7a262 
Captures the half-state symptoms, root cause (single-use registration
tokens), and the API-driven recovery sequence used on 2026-05-09. Also
documents the runs-on/label contract and the Forgejo Actions
resolution gotcha now fixed by the full-URL convention.
pappi merged commit b39f3ad59b into main 2026-05-09 15:54:29 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
hanuman/automation!3
No description provided.