| workflow_payload |
name: Inspect existing R1 restore resources withou name: Inspect existing R1 restore resources without changing services
"on":
workflow_dispatch:
jobs:
observe:
name: observe
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Measure fixed metadata only in a limited readonly unit
run: |
set -eu
python3 <<'PY'
import ast,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not run.isdigit() or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_JOB_IDENTITY_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('restore-resource-inspect-'+run);work.mkdir(mode=0o700)
for name in ['inspect-restore-resources.py','test-restore-resources.py']:
r=subprocess.run(['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':ops/gitea-r1/'+name],capture_output=True,timeout=30)
if r.returncode:raise RuntimeError('FIXED_RESOURCE_INSPECTION_SOURCE_REQUIRED')
ast.parse(r.stdout);(work/name).write_bytes(r.stdout)
subprocess.run(['python3','-B',str(work/'test-restore-resources.py')],check=True,timeout=30)
props=['User=root','Nice=15','CPUQuota=50%','MemoryMax=256M','TasksMax=32','RuntimeMaxSec=480','TimeoutStopSec=15','ProtectSystem=strict','ProtectHome=read-only','PrivateTmp=yes','PrivateDevices=yes','NoNewPrivileges=yes','ReadWritePaths='+str(work),'StandardOutput=file:'+str(work/'native.stdout'),'StandardError=file:'+str(work/'native.stderr')]
r=subprocess.run(['systemd-run','--quiet','--wait','--collect','--unit=eios-r1-restore-resource-inspect-'+run,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'inspect-restore-resources.py')],capture_output=True,timeout=540)
if r.returncode:raise RuntimeError('READONLY_RESOURCE_INSPECTION_FAILED')
print((work/'native.stdout').read_text())
PY
shell: bash
timeout-minutes: "10"
permissions:
contents: read
... |