Add reusable Node application validation with writable tool cache #99
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!99
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/reusable-node-ci"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
GitchAlerts run 84 stops during Node setup because its app-local job cannot create
/opt/hostedtoolcache. Add shared Node validation so applications use a thin caller for frozen pnpm installation, optional generation, then required formatting, typecheck, lint, tests and build in one job. Script names come from.pipeline/node-ci.json; pnpm must be exactly pinned inpackageManager. Missing gates or any stage failure block later work.node-ci.ymlretains the credential-free Node 24 default. Following the owner’s review choice,node-ci-image.ymladds an explicit owned Node 26 tool-image path with an accepted digest and the existing registry pull secret pair. It verifies installed Node/pnpm against the image runtime contract and caller manifest before dependency installation. Base-images PR #48 prepares the tool layer from the accepted base-node digest with Git/Python/Bash, pinned pnpm and non-root offline smoke checks. Base-images #49 tracks publication and acceptance on the Roadmap.Both workflows configure caches through the same helper using runner-provided RUNNER_TEMP and GITHUB_ENV, probing real writes before export. There is no runner-context expression in job-level env. The owning Library checks job invokes the helper and real actions/setup-node, then verifies the selected Node 24 binary is inside the writable job-local cache. Frozen stable-v1 compilation keeps library code paired with its release; image digests remain separately reviewed pins. Both paths preserve the combined job ID and selected existing display name.
Validation at
d7b2cf4c97f16dace02dc3edd501ebf41c8c97b0: 41 focused Node/channel/Forgejo/security-image tests passed, including actual cache filesystem/export/rejection, image runtime mismatches, stage failures, all 23 adapter compilations and generated Bash syntax. Ruff 0.16.8, diff checks and native Gitleaks 8.30.1 passed. The base-image source passed 35 tests and actual thin-caller contracts. Existing GitchAlerts checks previously passed 398 tests and formatting under its current runtime; that is not Node 26 acceptance. No local containers ran.The new hosted head and real Node setup probe, signed tool-image publication, library release/promotion and fresh owning application CI remain pending. Do not activate a caller to these paths before promotion and image acceptance. Verify the exact existing required status
CI / Lint, typecheck, tests and build (pull_request)and Node 26 application compatibility before adoption. Keep the Node 24 path available for recovery. Refs: gitchegumi/GitchAlerts#187.Reviewed the exact-head reusable Node workflow, validation planner, and focused tests. The job provides a writable runner-temp tool cache before setup-node; checkout is credentialless and library-ref constrained; pnpm must be exactly pinned, installation is frozen, required gates/scripts are validated before execution, and the sequential stages fail closed. The frozen-channel adapter test checks stable-v1 compilation and the source docs require release/promotion before caller adoption. Source review approved; this does not establish hosted execution or authorize merge. On this SHA workflow acceptance passed, but Library checks and Repository security failed before checkout because the runner could not create its pinned job image (
No such image). Those gates must be recovered on the same head and pass before merge, and GitchAlerts caller acceptance remains separate.CI at submission: failure. This is a source-review approval, not a scan verdict; required checks still block merge.
@ -0,0 +1,55 @@name: Node application validationWhy does this workflow not use
git.gitchegumi.com/homelab/base-node:base-node-v2026.10.10-r6608? Or, would it be worth using that base to build a tool image for testing with node based applications?The original workflow preserved GitchAlerts’ Node 24 selection. The accepted base is Node 26.11.1 and deliberately omits Python, Git and pnpm, so it cannot run this planner directly. Following your choice to prepare the Node 26 CI image, base-images PR #48 now extends that exact accepted base digest with Git/Python/Bash and checksum-pinned pnpm 9.15.4; commit b4558213df1ad69dc824d9515770deeac9e3d3b4 includes non-root offline hosted smoke checks and thin stable-v1 pipeline callers. Tracker #49 is In Progress on the Roadmap.
This PR adds
node-ci-image.ymlinc6e7b5b, with follow-upd7b2cf4. It accepts only the owned tool-image repository plus an exact digest, checks installed Node 26 and pnpm against the image runtime contract and caller manifest, then runs the same combined validation planner. Library checkout remains frozen independently of the image pin. The existing Node 24 path stays available for compatibility/recovery.Validation: 41 focused Node/channel/Forgejo/security-image tests passed; the image repository passed 35 source/routing/documentation tests and actual caller contracts. Ruff 0.16.8, archive checksum/integrity/executable-path checks, diff checks and native Gitleaks passed. Both workflow paths now export genuinely probed writable caches through GITHUB_ENV using runner-provided RUNNER_TEMP. The library CI also has a real hosted Node setup/cache probe. No local containers ran.
The requested image and reusable source are prepared for review. Signed image publication, the new hosted checks, library release/promotion and fresh Node 26 application acceptance remain pending before activation; no output digest is invented.
New commits pushed, approval review dismissed automatically according to repository settings
Blocking: both
.forgejo/workflows/node-ci.yml(RUNNER_TOOL_CACHE) and.forgejo/workflows/node-ci-image.yml(npm_config_cache,npm_config_store_dir) interpolate${{ runner.temp }}underjobs.validate.env. Forgejo 16's Actions context-availability table excludesrunneratjobs.<job-id>.envbut allows it atjobs.<job-id>.steps[*].env; the runner-provided$RUNNER_TEMPis available to shell steps. Thus the critical writable-cache assignment is not valid at its current evaluation location, and the Node 24 path risks the same non-writable/root-path failure it is meant to fix (or workflow evaluation failure). Please move runtime-dependent assignments to a supported step context, propagating to subsequent steps as needed, and add a focused regression checking the expression's supported placement plus a real owning runner invocation verifying Node setup and cache writability. Current tests only assert the YAML text and mock planner subprocesses; they do not exercise this expression at runner evaluation. The image variant needs the analogous correction. This is an application CI/tool-image boundary, not a UDS deployment, admission, policy, or route change; no UDS package/gateway work is requested. Reviewed source atc6e7b5b758. Workflow acceptance, Library checks, and Repository security were still running/pending during review, and image publication and consumer acceptance remain separate gates; no merge is authorized.At
d7b2cf4c97, the earlier job-level${{ runner.temp }}issue is addressed in both Node workflows: the cache helper uses RUNNER_TEMP, checks writable directories and exports paths through GITHUB_ENV ahead of setup/validation. A new Library-check step exercises real Node 24 setup and cache writes on the owning runner, but that job and the security/acceptance gates are still pending at review time. The separate Node 26 image path requires its own signed image and consumer validation. No UDS deployment, policy or routing boundary is changed. This COMMENT does not clear the prior REQUEST_CHANGES or establish CI acceptance. Formal approval was attempted but the review guard refused because GitcheGumi has already reviewed this PR; GitcheGumi should review the new SHA and decide whether to clear his change request after hosted checks complete. No merge authorized.Addressed the Forgejo context-placement finding in d7b2cf4. Neither Node workflow uses the runner context in job-level env now. Both execute the shared
node_ci_cache.pyhelper after library checkout; it reads the runner-provided RUNNER_TEMP, creates and actually writes to every cache, and only then appends its paths to GITHUB_ENV for subsequent setup/validation steps. Invalid paths or an uncreatable cache fail before export.The regression executes actual filesystem/cache export for both runtime and image modes, preserves existing env records, rejects invalid/unwritable locations without partial export, and checks supported placement in both workflow definitions. The existing owning Library checks job also invokes this same helper, runs real actions/setup-node for Node 24, and asserts the actual selected binary is inside the exported cache and that writes succeed. This is a hosted source-check probe, not a local container test or cross-repository delivery dispatch.
Validation: all 41 focused Node/channel/Forgejo/security-image tests, generated Bash syntax, Ruff 0.16.8, diff checks and native Gitleaks passed. The new head’s hosted probe/checks remain pending; this reply does not claim hosted acceptance. Image publication and fresh application CI remain tracked separately in base-images #49.
CI diagnosis for kiyi at
1b46ab756a: Library checks run 714 (API 7293), executingtestsjob 9166, failed after checkout and during/after the unit-test output. The authenticated bounded log excerpt is truncated before the failing assertion, traceback, or final step, so the root cause is not yet verified. Its ClamAV/Trivyfailed or interruptedlines are test-fixture/progress output and do not establish a real image scan failure. Please inspect the full job log for the first FAIL/ERROR traceback and failing step, reproduce the exact test or Node setup/cache probe on the owning Linux runner, and send the smallest source/test correction if needed; preserve every security gate. Workflow acceptance, repository security and security-image compatibility are successful on this SHA, but Library checks remain red and block merge. The earlier Noderunner.tempjob-env defect is addressed in the current source (cache helper reads RUNNER_TEMP, probes writes, exports GITHUB_ENV before setup-node); this COMMENT does not clear my prior REQUEST_CHANGES or GitcheGumi's review. The reviewed paths are Node/build workflow and shared source-scan mechanics, not a UDS deployment, admission, policy or routing change; no UDS package/gateway change requested. No release/promotion/merge or source approval is inferred from the green contexts.Follow-through for the cache review and the new Library checks failure: the supported RUNNER_TEMP → write probe → GITHUB_ENV cache flow from
d7b2cf4and the real hosted Node setup/cache step are retained.d0371fbremoves the conflicting fixed workflow count without dropping interface checks.The complete failed Library log shows the actual cause: the new base-image context check rejected ComfyUI’s curated Python payload context. Shared fix
35f595frestricts caller-selected folders at the CLI boundary while retaining full original source/history scanning and the existing fixed payload recipe;9f18818carries that correction here. No waiver, job rename or gate removal was introduced.Final combined source completed 127 focused local tests with eight Windows symlink skips, including real native-Gitleaks payload regressions and the selected-folder CLI rejection. Native staged Gitleaks passed. Exact-head hosted Library/Node probe/security checks are still required, and GitcheGumi’s existing change request needs owner re-review. Merge batch: #103 → #101 → #99 → #100 → #102, then ONE numbered release and ONE stable-v1 promotion. Node image publication/acceptance remains separate and lower priority than cluster updates and Harbor.
Exact-head source follow-up (
9f18818e28): the earlier unsupported job-level runner.temp cache assignment is absent from both Node workflows. The helper probes writable RUNNER_TEMP caches then exports via GITHUB_ENV before Node setup/validation; Library checks contains the real Node 24 cache/setup probe. Reviewed container CLI now limits selected build contexts to the scanned checkout, while the fixed Python payload builder retains its separate path; base-image callers pass --source-checkout and the selected-folder rejection has a focused test. The planner requires exact pnpm, frozen install, complete ordered validation gates and an exact Node 26 image/runtime contract; no UDS deployment, routing, admission or policy boundary is changed. I attempted a formal exact-head source APPROVED review, but the review guard refused it because GitcheGumi has already reviewed this PR. This COMMENT is not approval and does not clear either outstanding change request. Exact-head Workflow acceptance, Library checks, Repository security and Security image compatibility are still pending; the real runner probe and security decisions have not passed. GitcheGumi needs to re-review the current head and resolve his request; required checks must pass before merge. Node image publication, channel promotion and GitchAlerts adoption remain separate.Run 697 batch recovery is included in
4aafb8cand current head4830cf6. The follow-up merge preserves the owner’s concurrent48508c6update and was verified to leave the tested tree unchanged. See the diagnosis and fix in #101: temporary Semgrep transport failures get three bounded attempts; TLS, content pinning and fail-closed decisions remain intact.The combined branch
b955d25completed 177 local cases with eight Windows symlink skips, including download recovery/rejection, native Gitleaks payload regressions, Node cache and workflow contracts. Staged Gitleaks and diff checks passed; the merge order remains #101 → #99 → #100 → #102, with one release for the remaining batch. Current hosted checks and existing review requirements remain required; no workflow/job/status names changed.Exact-head review of
4830cf67c4: the prior unsupported job-level runner.temp cache assignment remains fixed in both Node workflows; the helper tests actual writes under RUNNER_TEMP and exports GITHUB_ENV before setup-node. The owning Library checks job includes a real Node 24 setup/cache probe. The Node planner requires exact pinned pnpm, frozen installation and all ordered validation gates; the image path verifies its runtime contract before install. Additional source on this head fixes the library-owned Seaweed state-bootstrap profile (endpoint/bucket/region/role/credential), rejects plan/apply for that selector before credentials, and uses the existing privacy/encryption/versioning/conditional-write/readback checks; actual Seaweed backend acceptance is still separate. Semgrep download retry retains locked-rule content verification and records exhausted downloads as failed scans. I found no new source-blocking issue in the inspected changes. This is a COMMENT, not approval: a formal APPROVED submission was attempted but the guard refused it because GitcheGumi has already reviewed this PR. GitcheGumi should re-review this SHA and resolve his outstanding REQUEST_CHANGES. At review time Workflow acceptance, Library checks and Repository security are pending; none is claimed passed. No UDS deployment, admission, policy or routing boundary is changed. Signed Node 26 image publication, numbered library release/stable-v1 promotion and consumer acceptance are separate. No merge authorized.Supersedes my earlier REQUEST_CHANGES (#1164). The unsupported job-level runner.temp assignments are gone: both workflows call the writable RUNNER_TEMP cache helper and export paths through GITHUB_ENV before Node setup/validation. The exact-head Library checks run 766/job 9263 logged PASS for real Node 24 setup inside that job-local cache; Workflow acceptance and Repository security also passed. I inspected the nine changed files and ran 22 focused Node/channel tests successfully with Python 3.14. The explicit Node 26 image path checks its digest and installed runtime contract; image publication and consumer acceptance remain separate before adoption. No UDS routing/package change is introduced.