flan
14ef25e3c6
CI / ci (shell + python 3.11-3.13) (push) Successful in 46s
Two CI failures shared one cause: four jobs starting together on the self-hosted runner. act caches each action as one shared clone under /root/.cache/act/<hash> and re-pulls it per job, so concurrent jobs fight over that directory and the loser dies with "lstat .../<file>: no such file or directory" before any test runs — a different victim each push. And the runner force-pulls its base image per job, so four jobs meant four anonymous Docker Hub pulls per push; that hit 429 Too Many Requests and every job started failing before it began, including the shell job nothing had touched. Installing uv without an action only shrank the surface, since every job still used actions/checkout. Concurrency is the ingredient, so this removes it: one job cannot race itself whatever actions it uses, and one job is one pull. The version sweep moves inside the job and still runs every version after one fails, preserving what fail-fast: false bought.
110 lines
4.5 KiB
YAML
110 lines
4.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main, "feat/**", "fix/**"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# ONE job, deliberately. This was four (shell + a 3-way python matrix) and they
|
|
# started within the same second on the self-hosted Gitea runner, which is what
|
|
# made CI unreliable in two separate ways:
|
|
#
|
|
# 1. The act action-cache race. `act` caches each ACTION as a single shared git
|
|
# clone under /root/.cache/act/<hash> and re-pulls it per job, so concurrent
|
|
# jobs using the same action fight over that directory and the loser dies
|
|
# with `lstat /root/.cache/act/<hash>/<file>: no such file or directory` --
|
|
# a red `main` with zero suite output, and a different victim each push
|
|
# (3.12 on one, 3.11 on the next). Dropping one action only shrank the
|
|
# surface: every job still used actions/checkout. Concurrency is the actual
|
|
# ingredient, so removing it removes the whole class -- a single job cannot
|
|
# race itself, no matter which actions it uses.
|
|
#
|
|
# 2. Docker Hub 429s. The runner force-pulls its base image per job, so four
|
|
# jobs meant four anonymous pulls per push. A few pushes and re-runs in an
|
|
# afternoon exhausted the anonymous limit and every job failed before it
|
|
# started -- including the shell job, which nothing had touched. One job is
|
|
# one pull.
|
|
#
|
|
# The cost is wall-clock parallelism, and this repo does not need it: the suite
|
|
# is ~1.5s, so container start and interpreter downloads dominate either way.
|
|
jobs:
|
|
ci:
|
|
name: ci (shell + python 3.11-3.13)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: bash syntax check
|
|
run: |
|
|
fail=0
|
|
while IFS= read -r f; do
|
|
bash -n "$f" || { echo "::error file=$f::bash syntax error"; fail=1; }
|
|
done < <(find . -name '*.sh' -not -path './.git/*')
|
|
exit $fail
|
|
|
|
# Pinned to a release tag, not @master: a third-party action on a moving
|
|
# branch runs whatever that branch contains at the time CI fires.
|
|
- name: shellcheck
|
|
uses: ludeeus/action-shellcheck@2.0.0
|
|
env:
|
|
SHELLCHECK_OPTS: -S warning -e SC1091
|
|
|
|
# uv-managed interpreters instead of actions/setup-python: the prebuilt-CPython
|
|
# download path setup-python relies on does not work on the self-hosted Gitea
|
|
# runner (all three matrix jobs failed at setup there while passing on GitHub);
|
|
# uv works identically on both.
|
|
#
|
|
# Installed by a plain `run:` step rather than astral-sh/setup-uv: one fewer
|
|
# action is one fewer thing to go wrong, and the action was only ever
|
|
# fetching a binary -- the interpreter is chosen per command by `uvx
|
|
# --python`, never by the action.
|
|
#
|
|
# Pinned for the same reason ruff is pinned below: an unpinned uv means any
|
|
# upstream release can turn main red with no code change here.
|
|
- name: install uv
|
|
env:
|
|
UV_VERSION: "0.11.21"
|
|
run: |
|
|
curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: ruff
|
|
# Pinned: an unpinned ruff means any upstream release can turn main red
|
|
# with no code change.
|
|
run: uvx ruff@0.16.1 check patch tests tools
|
|
|
|
# TrueNAS SCALE middleware runs 3.11+; keep the patch importable across the
|
|
# versions it may be injected into. Every version runs even after one
|
|
# fails -- that is what `fail-fast: false` bought when this was a matrix,
|
|
# and losing it would mean a 3.11 break hides whether 3.12 and 3.13 are
|
|
# fine, which is exactly the information you want at that moment.
|
|
- name: pytest
|
|
env:
|
|
PYTHONS: "3.11 3.12 3.13"
|
|
run: |
|
|
fail=0
|
|
for v in $PYTHONS; do
|
|
echo "::group::pytest on python $v"
|
|
uvx --python "$v" pytest tests -v \
|
|
|| { echo "::error::suite failed on python $v"; fail=1; }
|
|
echo "::endgroup::"
|
|
done
|
|
exit $fail
|
|
|
|
- name: verify injected middleware blocks compile
|
|
# Belt-and-braces: the *_BLOCK strings are appended into live middlewared
|
|
# modules. A syntax error there would break the box at boot.
|
|
env:
|
|
PYTHONS: "3.11 3.12 3.13"
|
|
run: |
|
|
fail=0
|
|
for v in $PYTHONS; do
|
|
uvx --python "$v" pytest tests/test_apply_blocks.py -v \
|
|
|| { echo "::error::injected blocks failed to compile on python $v"; fail=1; }
|
|
done
|
|
exit $fail
|