mirror of
https://github.com/GoodOlClint/PSProxmoxVE.git
synced 2026-09-04 03:05:32 +00:00
goodolclint-claude[bot]
b90791e2bf
D001-D021 become ADR 0001-0021 in docs/decisions/, one decision per file. D017's PESTER_VERSION amendment was a second decision in one entry and becomes ADR 0022. ADR 0023 records the migration and reverses the lane2-change-plan ruling that deliberately kept DECISIONS.md until the CI lane work landed. DECISIONS.md is reduced to a stub with a D-to-ADR redirect table, so the four released CHANGELOG entries and older issue bodies that cite it degrade to a redirect rather than a dead reference. docs/review/ and docs/lane2-change-plan.md are deleted (ADR 0024). Of 91 findings, 83 were resolved and six of the seven still open were already GitHub issues; F021 was the exception and is now #130. CLAUDE.md's Key Conventions list gains the two rules it was missing and becomes the checklist, with the ADRs carrying rationale.
299 lines
11 KiB
YAML
299 lines
11 KiB
YAML
name: PVE Package Currency
|
|
|
|
# Lane 2 of the two-lane CI split (see docs/decisions/0017-ci-runs-two-lanes-a-pinned-gating-lane-and-a-report-only-currency-lane.md).
|
|
#
|
|
# Lane 1 (integration-tests.yml) pins the nested nodes to what the ISO ships
|
|
# and never upgrades — that pin is what makes it a stable merge gate.
|
|
# This lane does the opposite: it dist-upgrades the nested nodes to current
|
|
# PVE, reboots onto the new kernel, records the package set, and runs the full
|
|
# suite against it.
|
|
#
|
|
# REPORT-ONLY. Test failures here do NOT fail the job — this lane never gates
|
|
# a merge, and a red weekly cron nobody can action becomes noise. The signal is
|
|
# the recorded package set and (from commit 3) the rolling issue, not the check
|
|
# colour. A failure of the lane's own machinery — provisioning, upgrade, reboot
|
|
# — still fails the job, because that means the lane learned nothing.
|
|
#
|
|
# Shares the `integration-tests` concurrency group: both lanes drive the same
|
|
# nested VMIDs on the same parent node, so they must never run at once.
|
|
|
|
concurrency:
|
|
group: integration-tests
|
|
cancel-in-progress: false
|
|
|
|
on:
|
|
schedule:
|
|
# Mondays 06:00 UTC. Weekly is deliberate: this lane exists to notice
|
|
# upstream drift, and PVE's no-subscription repo does not move hourly.
|
|
- cron: '0 6 * * 1'
|
|
workflow_dispatch:
|
|
inputs:
|
|
keep_vms:
|
|
description: 'Skip cleanup so the nested PVE VMs survive for inspection'
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
|
|
# packages: write is granted per-job to container-image, the only job that
|
|
# pushes. The self-hosted jobs get read-only tokens: they SSH into freshly
|
|
# upgraded nodes and should not be able to overwrite published GHCR images.
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
|
|
env:
|
|
SCRIPTS_DIR: tests/infrastructure/scripts
|
|
TEST_IMAGE: ghcr.io/goodolclint/psproxmoxve-integration
|
|
CACHE_DIR: /opt/pve-integration
|
|
PVE_VERSIONS: '9'
|
|
PVE9_ISO: proxmox-ve_9.2-1.iso
|
|
|
|
jobs:
|
|
# ── Build module artifact (GitHub-hosted) ────────────────────────
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Setup .NET
|
|
uses: actions/setup-dotnet@v6
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
|
|
- name: Build module
|
|
run: dotnet publish src/PSProxmoxVE/PSProxmoxVE.csproj --configuration Release --framework netstandard2.0 --output ./publish/netstandard2.0
|
|
|
|
- name: Clean publish output
|
|
run: rm -f ./publish/netstandard2.0/*.deps.json
|
|
|
|
- name: Upload module artifact
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: module-currency
|
|
path: ./publish/netstandard2.0/
|
|
|
|
# ── Build test container image (GitHub-hosted) ───────────────────────
|
|
container-image:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Log in to GHCR
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
file: tests/Dockerfile.test
|
|
target: dev-infra
|
|
push: true
|
|
tags: ${{ env.TEST_IMAGE }}:${{ github.sha }}
|
|
|
|
# ── Provision, dist-upgrade, reboot (self-hosted) ────────────────────
|
|
provision:
|
|
needs: [build, container-image]
|
|
runs-on: psproxmoxve
|
|
timeout-minutes: 60
|
|
container:
|
|
image: ghcr.io/goodolclint/psproxmoxve-integration:${{ github.sha }}
|
|
credentials:
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
volumes:
|
|
- /opt/pve-integration:/opt/pve-integration
|
|
|
|
steps:
|
|
# persist-credentials: false on the self-hosted jobs — nothing downstream
|
|
# uses git, and the token would otherwise be written into .git/config on
|
|
# a runner that outlives the job's container.
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Provision PVE instances and dist-upgrade
|
|
shell: bash
|
|
env:
|
|
PVE_ENDPOINT: ${{ secrets.PVE_ENDPOINT }}
|
|
PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
|
|
PVE_TARGET_NODE: ${{ vars.PVE_TARGET_NODE }}
|
|
PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
|
|
STORAGE_VM_FQDN: ${{ vars.STORAGE_VM_FQDN }}
|
|
TF_VAR_disk_storage: ${{ vars.DISK_STORAGE }}
|
|
TF_VAR_iso_storage: ${{ vars.ISO_STORAGE }}
|
|
TF_VAR_network_bridge: ${{ vars.NETWORK_BRIDGE }}
|
|
TF_VAR_pool_id: ${{ vars.POOL_ID }}
|
|
# The one line that separates this lane from lane 1.
|
|
PVE_DIST_UPGRADE: '1'
|
|
run: bash ${SCRIPTS_DIR}/run-integration.sh provision
|
|
|
|
# success() not always(): when provisioning succeeded the package file
|
|
# must exist, and if-no-files-found: error enforces that invariant. When
|
|
# provisioning failed the job is already red, and a missing-artifact
|
|
# error would only bury the real cause.
|
|
- name: Upload recorded package set
|
|
if: success()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: pve-package-set
|
|
path: ${{ env.CACHE_DIR }}/work/*-packages.txt
|
|
if-no-files-found: error
|
|
|
|
# ── Integration tests against the upgraded nodes ─────────────────────
|
|
test:
|
|
needs: [build, provision]
|
|
runs-on: psproxmoxve
|
|
timeout-minutes: 20
|
|
container:
|
|
image: ghcr.io/goodolclint/psproxmoxve-integration:${{ github.sha }}
|
|
credentials:
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
volumes:
|
|
- /opt/pve-integration:/opt/pve-integration
|
|
outputs:
|
|
suite_rc: ${{ steps.suite.outputs.suite_rc }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
pve_version: ['9']
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Download module artifact
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: module-currency
|
|
path: ./publish/netstandard2.0/
|
|
|
|
# Report-only applies to TEST failures, not to the lane's own machinery.
|
|
# cmd_test returns 3 for genuine Pester failures and 4 when it cannot
|
|
# reach or authenticate to a node. A blanket continue-on-error would
|
|
# swallow 4 as well — and an unreachable node is exactly the symptom of a
|
|
# reboot gone wrong, so the lane would go green having learned nothing.
|
|
- name: Run integration tests (PVE ${{ matrix.pve_version }})
|
|
id: suite
|
|
shell: bash
|
|
env:
|
|
PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
|
|
MODULE_ARTIFACT: ./publish/netstandard2.0
|
|
run: |
|
|
set +e
|
|
bash ${SCRIPTS_DIR}/run-integration.sh test ${{ matrix.pve_version }}
|
|
rc=$?
|
|
echo "suite_rc=${rc}" >> "$GITHUB_OUTPUT"
|
|
if [ "${rc}" -eq 0 ]; then
|
|
echo "Suite passed against current PVE."
|
|
elif [ "${rc}" -eq 3 ]; then
|
|
echo "::warning title=Suite failed against current PVE::Report-only - tests failed (rc=3). See the uploaded results."
|
|
else
|
|
echo "::error title=Currency lane machinery failed::run-integration.sh exited ${rc}, which is not a test failure. The lane learned nothing about package currency."
|
|
fi
|
|
[ "${rc}" -eq 0 ] || [ "${rc}" -eq 3 ]
|
|
|
|
- name: Diagnose cluster state
|
|
if: always() && steps.suite.outputs.suite_rc != '0'
|
|
shell: bash
|
|
env:
|
|
PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
|
|
run: bash ${SCRIPTS_DIR}/diagnose-cluster.sh ${{ matrix.pve_version }}
|
|
|
|
- name: Upload test results
|
|
if: always()
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: currency-test-results-pve${{ matrix.pve_version }}
|
|
path: TestResults/
|
|
|
|
# ── Report: diff the package set, keep one rolling issue ─────────────
|
|
report:
|
|
needs: [provision, test]
|
|
# !cancelled() not always(): always() is true on cancellation too, and a
|
|
# run the operator aborted must not publish a baseline or edit the issue.
|
|
if: ${{ !cancelled() && needs.provision.result == 'success' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write # push the ci/package-baseline data branch
|
|
issues: write # maintain the rolling issue
|
|
steps:
|
|
# Credentials persist deliberately: this job pushes the data branch.
|
|
# No pull-requests: write — the baseline goes to an unprotected data
|
|
# branch, not a PR, so nothing here can reach main or the review agent.
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: Download recorded package set
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: pve-package-set
|
|
path: packages/
|
|
|
|
- name: Report package currency
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
SUITE_RC: ${{ needs.test.outputs.suite_rc }}
|
|
run: |
|
|
# Empty means the suite job was skipped or cancelled — that is not the
|
|
# same claim as "failed against current PVE".
|
|
# 3 is the only rc that means "tests ran and failed". Anything else
|
|
# non-zero means the suite never produced a verdict, and the report
|
|
# must not claim the module failed against current PVE.
|
|
if [ -z "${SUITE_RC:-}" ]; then
|
|
outcome=not-run
|
|
elif [ "${SUITE_RC}" = "0" ]; then
|
|
outcome=success
|
|
elif [ "${SUITE_RC}" = "3" ]; then
|
|
outcome=failure
|
|
else
|
|
outcome=inconclusive
|
|
fi
|
|
bash "${SCRIPTS_DIR}/report-package-currency.sh" packages "${outcome}"
|
|
|
|
# ── Cleanup: destroy all VMs (always runs) ──────────────────────
|
|
cleanup:
|
|
needs: [provision, test]
|
|
if: always() && needs.provision.result != 'skipped' && !inputs.keep_vms
|
|
runs-on: psproxmoxve
|
|
timeout-minutes: 15
|
|
container:
|
|
image: ghcr.io/goodolclint/psproxmoxve-integration:${{ github.sha }}
|
|
credentials:
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
volumes:
|
|
- /opt/pve-integration:/opt/pve-integration
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Cleanup PVE instances
|
|
shell: bash
|
|
env:
|
|
PVE_ENDPOINT: ${{ secrets.PVE_ENDPOINT }}
|
|
PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }}
|
|
PVE_TARGET_NODE: ${{ vars.PVE_TARGET_NODE }}
|
|
PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }}
|
|
STORAGE_VM_FQDN: ${{ vars.STORAGE_VM_FQDN }}
|
|
TF_VAR_disk_storage: ${{ vars.DISK_STORAGE }}
|
|
TF_VAR_iso_storage: ${{ vars.ISO_STORAGE }}
|
|
TF_VAR_network_bridge: ${{ vars.NETWORK_BRIDGE }}
|
|
TF_VAR_pool_id: ${{ vars.POOL_ID }}
|
|
run: bash ${SCRIPTS_DIR}/run-integration.sh force-cleanup
|