39dfb45925
Read Forge through the credential helper and public authority endpoint, treat API failures as failures, and evaluate every workflow attached to the newest candidate SHA. A green source gate can no longer hide a red package rail. Include RedFlag in the deliberate repository inventory.
143 lines
5.5 KiB
Shell
Executable file
143 lines
5.5 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
# What did CI actually do? Ask Gitea, not the runner journal.
|
|
#
|
|
# ci-status.sh # infer the repo from the cwd's git remote
|
|
# ci-status.sh souveraine # name it
|
|
# ci-status.sh souveraine 10 # last 10 runs instead of 3
|
|
# ci-status.sh --all # newest run for every repo we own
|
|
#
|
|
# Exit 0 when the newest run of every workflow is green or still going, 1 when
|
|
# any workflow's newest run failed, so this is usable as a gate as well as a
|
|
# report. A green source workflow must not hide a red package workflow from the
|
|
# same push.
|
|
#
|
|
# WHY THIS EXISTS. On 2026-07-28 a pinned action SHA rotted, `rust-test` died
|
|
# before compiling anything, and `aarch64-artifact` was therefore SKIPPED rather
|
|
# than failed — so the run looked unremarkable while the phone quietly kept
|
|
# installing a build from days earlier. It went unnoticed for a working day.
|
|
# The whole answer was in this API the entire time. What was being read instead
|
|
# was `journalctl -u gitea-runner`, which logs task PICKUP and never OUTCOME,
|
|
# and which produced three confident wrong diagnoses in a row.
|
|
#
|
|
# THE RUNNER JOURNAL IS NOT A STATUS SOURCE. This is.
|
|
#
|
|
# See docs/tasks/42-build-outcomes-are-invisible.md.
|
|
set -uo pipefail
|
|
|
|
GITEA="${GITEA_URL:-https://gitea.wiuf.net}"
|
|
OWNER="${GITEA_OWNER:-Fimeg}"
|
|
|
|
# Token, in order of preference: the environment, then the credential helper
|
|
# git already uses for this host. No third copy of a secret in the tree.
|
|
if [ -z "${GITEA_TOKEN:-}" ]; then
|
|
GITEA_TOKEN=$(printf 'protocol=https\nhost=gitea.wiuf.net\n\n' \
|
|
| git credential fill 2>/dev/null \
|
|
| sed -n 's/^password=//p' | head -1)
|
|
fi
|
|
if [ -z "${GITEA_TOKEN:-}" ]; then
|
|
GITEA_TOKEN=$(git -C "$HOME/Projects/Pixel3Arch" remote -v 2>/dev/null \
|
|
| sed -n 's|.*http://\([0-9a-f]\{40\}\)@.*|\1|p' | head -1)
|
|
fi
|
|
[ -n "${GITEA_TOKEN:-}" ] || { echo "ci-status: no token (set GITEA_TOKEN)" >&2; exit 2; }
|
|
|
|
api() { curl -sS --max-time 20 -H "Authorization: token $GITEA_TOKEN" "$GITEA/api/v1$1"; }
|
|
|
|
# Gitea ignores ?limit on this endpoint and returns the full history, so the
|
|
# slice happens here. Found the hard way: a "last 3 runs" call printed 120.
|
|
summarize() {
|
|
python3 -c '
|
|
import json, sys
|
|
limit = int(sys.argv[1])
|
|
try:
|
|
d = json.load(sys.stdin)
|
|
except Exception:
|
|
print("ERR"); raise SystemExit
|
|
runs = d.get("workflow_runs", d) if isinstance(d, dict) else d
|
|
if not runs:
|
|
print("NONE"); raise SystemExit
|
|
for r in runs[:limit]:
|
|
c = r.get("conclusion")
|
|
mark = "ok" if c == "success" else ("FAILED" if c == "failure" else (c or "running"))
|
|
workflow = (r.get("path") or r.get("name") or "workflow").split("@", 1)[0]
|
|
print("DETAIL", r.get("id"), workflow, r.get("head_branch"),
|
|
(r.get("head_sha") or "")[:8], mark)
|
|
|
|
# Gitea returns one interleaved stream for every workflow. Inspect every
|
|
# workflow that ran for the newest candidate SHA; looking only at runs[0] lets
|
|
# a successful ci.yml conceal a failed package.yml from the same push. Limiting
|
|
# this to that SHA avoids resurrecting an old failure from a workflow that
|
|
# does not run on the candidate branch or event.
|
|
candidate = runs[0].get("head_sha")
|
|
seen = set()
|
|
for r in runs:
|
|
if r.get("head_sha") != candidate:
|
|
continue
|
|
workflow = (r.get("path") or r.get("name") or "workflow").split("@", 1)[0]
|
|
if workflow in seen:
|
|
continue
|
|
seen.add(workflow)
|
|
if r.get("conclusion") == "failure":
|
|
print("FAIL", r.get("id"), workflow)
|
|
' "$1"
|
|
}
|
|
|
|
check_repo() {
|
|
local repo="$1" limit="${2:-3}" out failed_run jobs failed_id
|
|
|
|
out=$(api "/repos/$OWNER/$repo/actions/runs" 2>/dev/null | summarize "$limit")
|
|
case "$out" in
|
|
ERR|"") printf 'ci-status: %-20s Actions API unavailable\n' "$repo" >&2; return 2 ;;
|
|
NONE) printf 'ci-status: %-20s no Actions\n' "$repo"; return 0 ;;
|
|
esac
|
|
|
|
printf '%s\n' "$out" | awk -v r="$repo" '$1=="DETAIL"{
|
|
printf "ci-status: %-20s run %-5s [%-12s %-8s] %s -> %s\n", r, $2, $3, $4, $5, $6 }'
|
|
|
|
failed_run=$(printf '%s\n' "$out" | awk '$1=="FAIL"{print $2; exit}')
|
|
[ -n "$failed_run" ] || return 0
|
|
|
|
echo "ci-status: --- run $failed_run: which job ---"
|
|
jobs=$(api "/repos/$OWNER/$repo/actions/runs/$failed_run/jobs")
|
|
printf '%s' "$jobs" | python3 -c '
|
|
import json, sys
|
|
d = json.load(sys.stdin)
|
|
for j in d.get("jobs", d):
|
|
print(" %-22s %s" % (j.get("name"), j.get("conclusion")))
|
|
' 2>/dev/null
|
|
|
|
failed_id=$(printf '%s' "$jobs" | python3 -c '
|
|
import json, sys
|
|
d = json.load(sys.stdin)
|
|
for j in d.get("jobs", d):
|
|
if j.get("conclusion") == "failure":
|
|
print(j.get("id")); break
|
|
' 2>/dev/null)
|
|
|
|
if [ -n "$failed_id" ]; then
|
|
echo "ci-status: --- why ---"
|
|
api "/repos/$OWNER/$repo/actions/jobs/$failed_id/logs" 2>/dev/null \
|
|
| grep -viE "docker (pull|create|run|volume)|Writing entry|Extracting|cloning|Cleaning up|Created container|Start(ed|ing) container|Removed container|ENV ==>|Image exists" \
|
|
| tail -12 | sed 's/^/ /'
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
# Listed, not discovered: a new repo should be a deliberate addition here, and
|
|
# a repo that disappears from the list should be noticed rather than silently
|
|
# stop being checked.
|
|
ALL_REPOS="souveraine Pixel3Arch RedFlag culver souveraine-viewtop souveraine-lens souveraine-player hexagonrpc souveraine-updater"
|
|
|
|
if [ "${1:-}" = "--all" ]; then
|
|
worst=0
|
|
for r in $ALL_REPOS; do check_repo "$r" "${2:-1}" || worst=1; done
|
|
exit $worst
|
|
fi
|
|
|
|
repo="${1:-}"
|
|
if [ -z "$repo" ]; then
|
|
url=$(git remote -v 2>/dev/null | awk 'NR==1{print $2}')
|
|
repo=$(basename "${url%.git}" 2>/dev/null)
|
|
fi
|
|
[ -n "$repo" ] || { echo "ci-status: no repo (pass a name)" >&2; exit 2; }
|
|
|
|
check_repo "$repo" "${2:-3}"
|