From 6ac62c0bd0001d774607dae42420661ca2ac6553 Mon Sep 17 00:00:00 2001 From: Spencer McGuire Date: Fri, 16 Oct 2026 10:56:09 -0600 Subject: [PATCH] Docs: the Gitea runner runs the full workflow, e2e included; open question 15 resolved Co-Authored-By: Claude Fable 5.1 --- deploy/runner/README.md | 5 +++-- docs/DEPLOY.md | 11 +++++++---- docs/PLAN.md | 2 +- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/deploy/runner/README.md b/deploy/runner/README.md index e94233b..c3480da 100644 --- a/deploy/runner/README.md +++ b/deploy/runner/README.md @@ -57,5 +57,6 @@ which holds the runner's own token: keep the `data` folder private (it is owned - The job images and the actions (`actions/checkout`, `setup-python`, `setup-node`, the docker ones) are fetched from docker.gitea.com, GitHub and GitHub releases, so docker-1 needs outbound internet. -- The Samba DC in the e2e stack needs `cap_add: SYS_ADMIN`. The first run on this runner shows whether the - Docker proxy allows it; if not, the e2e job stays a by-hand step (docs/DEPLOY.md). +- The Samba DC in the e2e stack needs `cap_add: SYS_ADMIN`. The runner passes it through: the third run + (2026-10-16) brought the stack up and passed the 10 Playwright scenarios in under two minutes. +- Timings with the cache working (run 3): server 3 min 46 s, frontend 1 min 06 s, e2e 1 min 48 s. diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index 0637d90..1a02e98 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -170,10 +170,13 @@ the stack's bind mounts resolve and removes the stack when the job ends. The run token was never written down. [deploy/runner/README.md](../deploy/runner/README.md) has the install, update and re-register steps. -The repository must exist on Gitea (`spencerm/packetstation`) with Actions enabled, and the image job needs -the repository secrets `REGISTRY_USER` and `REGISTRY_TOKEN` (a Gitea token with package write). Until the -first push, the workflow has not run on the runner; open question 15 in PLAN.md records what is still to be -seen (the Samba DC's `cap_add` through the proxy). +The repository is `spencerm/PacketStation` on Gitea with Actions enabled. The workflow ran there on +2026-10-16: server, frontend and e2e pass (the e2e job builds the image, starts the CI stack with the Samba +DC and runs the Playwright scenarios on docker-1's daemon). The image job needs the repository secrets +`REGISTRY_USER` and `REGISTRY_TOKEN` (a Gitea token with package write) and fails until they are set. +Two runner settings were needed and are in deploy/runner: the actions cache server published on docker0 +port 8088 (job containers cannot reach the runner's own network, and every cache call timed out), and the +job workspace on a host directory allowed in `valid_volumes` (so the stack's bind mounts resolve). ## Backup (planned, phase 9) diff --git a/docs/PLAN.md b/docs/PLAN.md index ed48261..b43bc57 100644 --- a/docs/PLAN.md +++ b/docs/PLAN.md @@ -232,7 +232,7 @@ Smaller questions from the design, with the default the build takes unless told 12. Partspecs, title or folded-operation target changes on an in-shop packet: default no change order, as the old build. 13. Work-order-gone confirmation after 2 consecutive runs and the 10% suspect-batch guard: defaults as stated. 14. Pause scope: default pauses the feed, the drawing job and auto-release together. -15. Gitea runner: whether the Samba DC container can run there (overlayfs xattrs, possibly cap SYS_ADMIN). Checked in phase 1; if not, CI uses a runner with a Docker socket on docker-1. Phase 1 finding (2026-10-16): the container needs `cap_add: [SYS_ADMIN]` (Samba 4.17 sets sysvol NT ACLs through `security.*` xattrs) and runs that way on docker-1; the Gitea runner itself is still to be tried. Phase 2 (2026-10-16): an act_runner with the host Docker socket is registered on docker-1 as `docker-1` (deploy/runner/); the first workflow run, after the repository is pushed to Gitea, shows whether its Docker proxy passes `cap_add` to the DC. +15. Gitea runner: whether the Samba DC container can run there (overlayfs xattrs, possibly cap SYS_ADMIN). Checked in phase 1; if not, CI uses a runner with a Docker socket on docker-1. Phase 1 finding (2026-10-16): the container needs `cap_add: [SYS_ADMIN]` (Samba 4.17 sets sysvol NT ACLs through `security.*` xattrs) and runs that way on docker-1; the Gitea runner itself is still to be tried. Phase 2 (2026-10-16): an act_runner with the host Docker socket is registered on docker-1 as `docker-1` (deploy/runner/); resolved: the runner passes `cap_add` through, and the e2e job (stack with the DC plus the Playwright scenarios) passed on it on 2026-10-16. 16. NPM: confirm `Block common exploits` does not interfere with uploads; checked when the test proxy host is made in phase 0. 17. SET_DATABOOK_AT is writable by anyone in the old build, even when filed: default restrict to Clerical and Q.C. 18. CO verifications cannot be withdrawn; ITP line signatures can be undone by the same inspector or an Admin before the block is signed.