Zayin/Ekklesia
3
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases 9 Wiki Activity

fix(ci): confine the sweep self-test to its own run #96

Merged
Zayin_Admin merged 1 commits from fix/ci-sweep-self-test-scope into main 2026-10-14 03:55:35 +00:00
Conversation 0 Commits 1 Files Changed 3
+60 -7
ekklesia-bot commented 2026-10-14 03:46:39 +00:00
Member
Copy Link
Copy Source

Fixes the CI sweep self-test tearing down other jobs' live stacks on the shared runner.

What happened. scripts/test-ci-sweep.sh (run by infrastructure-smoke on every Core run) called ci-sweep.sh --stale --max-age-seconds 0 against the shared Docker daemon. A zero threshold matches every ekklesia-ci- stack, so it removed whatever was running at that moment, while reporting "CI sweep checks passed". It removed Zayin/Signage run 288's integration stack twice: attempt 1 during Core run 289, and attempt 2 during Core run 290 at 03:40:56, one second before connectivity-blip failed and the stack's _edge network vanished.

Fix.

  • ci-sweep.sh --stale accepts --prefix P. P must begin with the CI prefix, so it can only narrow a sweep. --job refuses it. The workflow's sweeps are unchanged.
  • The self-test confines every stale sweep to its own fake run, and adds a bystander stack from another run that must survive even the zero threshold.
  • tests/ci-scripts.test.ts gains a Docker-free guard: every stale sweep in the self-test is confined, and the workflow's keep the default threshold.

Verified.

  • Reproduced locally: main's self-test removes an unrelated ekklesia-ci-… container and still passes. With this change the same container survives and all 15 checks pass.
  • The new guard fails against main's self-test.
  • pnpm ci:verify passes (2,639 tests).

🤖 Generated with Claude Code

Fixes the CI sweep self-test tearing down other jobs' live stacks on the shared runner. **What happened.** `scripts/test-ci-sweep.sh` (run by `infrastructure-smoke` on every Core run) called `ci-sweep.sh --stale --max-age-seconds 0` against the shared Docker daemon. A zero threshold matches *every* `ekklesia-ci-` stack, so it removed whatever was running at that moment, while reporting "CI sweep checks passed". It removed Zayin/Signage run 288's integration stack twice: attempt 1 during Core run 289, and attempt 2 during Core run 290 at 03:40:56, one second before `connectivity-blip` failed and the stack's `_edge` network vanished. **Fix.** - `ci-sweep.sh --stale` accepts `--prefix P`. P must begin with the CI prefix, so it can only narrow a sweep. `--job` refuses it. The workflow's sweeps are unchanged. - The self-test confines every stale sweep to its own fake run, and adds a bystander stack from another run that must survive even the zero threshold. - `tests/ci-scripts.test.ts` gains a Docker-free guard: every stale sweep in the self-test is confined, and the workflow's keep the default threshold. **Verified.** - Reproduced locally: `main`'s self-test removes an unrelated `ekklesia-ci-…` container and still passes. With this change the same container survives and all 15 checks pass. - The new guard fails against `main`'s self-test. - `pnpm ci:verify` passes (2,639 tests). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
ekklesia-bot added 1 commit 2026-10-14 03:46:39 +00:00
fix(ci): confine the sweep self-test to its own run
CI / verify (pull_request) Successful in 1m10s
Details
CI / infrastructure-smoke (pull_request) Successful in 42s
Details
CI / package-release (pull_request) Successful in 49s
Details
CI / migration-smoke (pull_request) Successful in 2m21s
Details
CI / image-build (pull_request) Successful in 59s
Details
CI / deploy-smoke (same-origin) (pull_request) Successful in 52s
Details
CI / deploy-smoke (split) (pull_request) Successful in 2m35s
Details
CI / package-publication (pull_request) Successful in 1m3s
Details
94fa7a17a8 
scripts/test-ci-sweep.sh proves the stale sweep by running
`ci-sweep.sh --stale --max-age-seconds 0` on the runner's shared Docker
daemon. With a zero threshold that removes every `ekklesia-ci-` stack on
the daemon, not just the test's own: any job running at that moment
loses its containers, networks, and volumes. It reported "CI sweep
checks passed" while doing it. Core's infrastructure-smoke job runs the
self-test on every run, and twice tore down Signage's integration stack
mid-scenario (Zayin/Signage run 288: its first attempt, and the second
one during connectivity-blip).

`ci-sweep.sh --stale` now takes `--prefix P`, which narrows the sweep to
stacks whose names begin with P and must itself begin with the CI
prefix, so it can only narrow a sweep, never widen one. The self-test
confines every stale sweep to its own fake run and proves that another
run's stack survives even the zero threshold. The workflow's own sweeps
are unchanged.

Regression: a bystander stack from another run in the self-test, and a
Docker-free guard that every stale sweep in the self-test is confined
and the workflow's keep the default threshold.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Zayin_Admin merged commit 63fda0f8d6 into main 2026-10-14 03:55:35 +00:00
Zayin_Admin deleted branch fix/ci-sweep-self-test-scope 2026-10-14 03:55:35 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Zayin_Admin
Labels
Clear labels
found-by-claude
Found by Claude while working on another task
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Joey Zayin_Admin ekklesia-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Zayin/Ekklesia#96