Zayin/Signage
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 4 Wiki Activity

ci: the integration job removes its stacks even when the runner kills it #8

Merged
Zayin_Admin merged 3 commits from ci/stack-cleanup into main 2026-10-06 02:58:11 +00:00
Conversation 1 Commits 3 Files Changed 4
+73 -2
3 Commits
Author SHA1 Message Date
ekklesiaandClaude Opus 5.5 6869ae433a ci: pin the platform at the merged sweep, 874deab on main
CI / lint (pull_request) Successful in 14s
Details
CI / typecheck (pull_request) Successful in 14s
Details
CI / test (pull_request) Successful in 19s
Details
CI / build (pull_request) Successful in 18s
Details
CI / integration (pull_request) Successful in 3m49s
Details 
Ekklesia #60 was rebase-merged, so the PR head 00e5441 never became part
of main, and ci/assemble.sh rightly refuses it. 874deab is #60's merge on
main. ci-sweep.sh, ci-project.sh and smoke-deploy.sh are byte-identical
to the old pin, no package file changed, and the assembled lockfile
still passes a frozen install.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-05 21:19:57 -05:00
ekklesiaandClaude Opus 5.5 cbf2a8ee39 ci: the integration job removes its stacks even when the runner kills it
CI / typecheck (pull_request) Failing after 3s
Details
CI / test (pull_request) Failing after 4s
Details
CI / build (pull_request) Failing after 4s
Details
CI / integration (pull_request) Skipped
Details
CI / lint (pull_request) Failing after 3s
Details 
The platform's rule (its ci-sweep.sh, docs/development/security.md),
applied to the one Signage job that starts Docker stacks:
- it has its own EKKLESIA_CI_JOB_KEY;
- it sweeps stale CI stacks from the runner before it starts;
- it removes its own stacks in a final `if: always()` step, which
  tolerates a failed assembly, since nothing was started then;
- the image ci/integration.sh builds is named and labeled as a CI stack
  of this run and job, with the time CI built it, so the sweep finds it.

ci/platform.env moves to the platform commit that adds the sweep
(Ekklesia #60). The assembled lockfile is unchanged, and still passes a
frozen install.

Verified: SIGKILL of the integration script's whole process group
mid-run left 11 resources (2 containers, 4 networks, 4 volumes and the
image). `ci-sweep.sh --job` removed exactly those 11. A normal run
passes, and the job sweep after it finds nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-05 21:05:15 -05:00
ekklesiaandClaude Opus 5.5 cfa4628f8c test(ci): the integration job must clean up its stacks even when killed 
The platform leaked a whole CI stack for two days: a job the runner
kills never runs its cleanup trap. The platform's rule now applies here:
the job that starts Docker stacks (integration) has its own
EKKLESIA_CI_JOB_KEY, sweeps stale CI stacks first, removes its own in a
final if: always() step, and labels the image it builds.

ci/check-cleanup.sh checks that, and the lint job runs it. It fails
today on all five counts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-05 20:58:04 -05:00