From 0b247ed96f3722deca1f0a6fc1af58f9334e0230 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Mon, 20 Jul 2026 10:05:58 -0400 Subject: [PATCH] CI: run GitHub Actions on self-hosted arc-runner-set The org IP allow list blocks GitHub-hosted runner IPs (checkout 403), so point all jobs at the self-hosted arc-runner-set. Drop the rsync dependency in build-site.sh (cp + bytecode prune; the ARC runner image has no rsync) and remove the migrations-mysql job - ARC/Kubernetes has no service containers, so that MySQL 8 coverage stays on the internal CI. --- .github/workflows/ci.yml | 90 ++++++++-------------------------------- scripts/build-site.sh | 9 ++-- 2 files changed, 23 insertions(+), 76 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d0d4c6a..239888a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,13 +12,19 @@ name: CI +# Jobs run on the org's self-hosted "arc-runner-set" (enterprise +# ge-aerospace-runner-group, Linux). GitHub-hosted runners are blocked by the +# org IP allow list (hosted Azure runner IPs are not allow-listed -> checkout +# 403), so ubuntu-latest cannot be used here. arc-runner-set checks out from an +# internal allow-listed IP and, being Linux, still supports service containers. + on: push: pull_request: jobs: backend: - runs-on: ubuntu-latest + runs-on: arc-runner-set steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 @@ -29,13 +35,13 @@ jobs: - run: python -m pytest -q naming: - runs-on: ubuntu-latest + runs-on: arc-runner-set steps: - uses: actions/checkout@v4 - run: bash scripts/check-naming-and-style.sh frontend: - runs-on: ubuntu-latest + runs-on: arc-runner-set defaults: run: working-directory: frontend @@ -54,7 +60,7 @@ jobs: # ADR-013 Phase 5: prove a per-site build carries only its chosen plugins. # Builds a lean site (machines + printers) and asserts an omitted plugin's # code is absent from the bundle - the delete-a-plugin guarantee in CI. - runs-on: ubuntu-latest + runs-on: arc-runner-set steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 @@ -91,72 +97,10 @@ jobs: test ! -d /tmp/leansite/plugins/printedparts echo "lean build verified: only chosen plugins present" - migrations-mysql: - runs-on: ubuntu-latest - services: - mysql: - image: mysql:8.0 - env: - MYSQL_ROOT_PASSWORD: root - MYSQL_DATABASE: shopdb_ci - ports: - - 3306:3306 - options: >- - --health-cmd="mysqladmin ping -h localhost -uroot -proot" - --health-interval=5s --health-timeout=5s --health-retries=20 - env: - FLASK_APP: shopdb - DATABASE_URL: mysql+pymysql://root:root@127.0.0.1:3306/shopdb_ci?charset=utf8mb4 - SECRET_KEY: ci-secret - JWT_SECRET_KEY: ci-jwt-secret - steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 - with: - python-version: '3.13' - cache: pip - - run: pip install -r requirements.txt - - name: Force utf8mb4 on the CI database - # pymysql speaks MySQL 8's caching_sha2_password via the cryptography - # package (a requirements.txt dependency), so no auth-plugin change - # is needed here. - run: | - mysql -h 127.0.0.1 -uroot -proot -e \ - "ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" - - name: Fresh core upgrade from empty - run: flask db upgrade - - name: Install every bundled plugin (runs its chain) - run: | - for p in computers employees geenforce knowledgebase machines \ - measuringtools network notifications printedparts printers \ - slides usb warranty; do - flask plugin install "$p" - done - flask plugin upgrade-all - - name: Seed platform data (catches strict-mode data violations) - # Runs the real seeders on strict MySQL 8. A seeded row that exceeds a - # column width is a hard error 1406 here (not the silent truncation - # older/relaxed MySQL gives), so this is what catches over-length - # setting descriptions and similar before they reach a fresh box. - run: | - flask seed permissions - flask seed settings - flask seed reference-data - - name: Assert schema built + utf8mb4 - run: | - python - <<'PY' - from shopdb import create_app - from shopdb.extensions import db - from sqlalchemy import text - app = create_app() - with app.app_context(): - tables = db.inspect(db.engine).get_table_names() - assert len(tables) >= 70, f'only {len(tables)} tables built' - row = db.session.execute(text( - "SELECT default_character_set_name FROM information_schema.schemata " - "WHERE schema_name = 'shopdb_ci'")).first() - assert row[0] == 'utf8mb4', f'charset is {row[0]}, not utf8mb4' - print(f'OK: {len(tables)} tables, charset {row[0]}') - PY - - name: Second core upgrade must be a clean no-op - run: flask db upgrade + # NOTE: the MySQL-8 migration/seed job (fresh `flask db upgrade` + every + # plugin chain + strict-mode seeders on a real MySQL 8) runs on the internal + # CI server, which supports service containers. The org's arc-runner-set is + # Kubernetes/ARC without docker-in-docker, so GitHub Actions service + # containers ("services: mysql") are unavailable here ("Job Container is + # required"). That coverage stays on the internal CI rather than being + # duplicated on GitHub. diff --git a/scripts/build-site.sh b/scripts/build-site.sh index a4f151e..de38160 100755 --- a/scripts/build-site.sh +++ b/scripts/build-site.sh @@ -57,12 +57,15 @@ echo "==> Building frontend (SITE_PLUGINS=$CLOSURE) ..." echo "==> Staging backend into $OUT ..." rm -rf "$OUT" mkdir -p "$OUT/plugins" -rsync -a --exclude '__pycache__' --exclude '*.pyc' "$REPO/shopdb" "$OUT/" +# cp (not rsync) so a minimal runner/deploy box without rsync can stage; +# bytecode is pruned afterwards to match the old --exclude filters. +cp -a "$REPO/shopdb" "$OUT/" for name in ${CLOSURE//,/ }; do - rsync -a --exclude '__pycache__' --exclude '*.pyc' \ - "$REPO/plugins/$name" "$OUT/plugins/" + cp -a "$REPO/plugins/$name" "$OUT/plugins/" done cp -r "$REPO/frontend/dist" "$OUT/frontend-dist" +find "$OUT" -type d -name '__pycache__' -prune -exec rm -rf {} + +find "$OUT" -type f -name '*.pyc' -delete echo "" echo "Lean site staged at: $OUT"