| workflow_payload |
name: Validate R1 full restore preparation without name: Validate R1 full restore preparation without starting maintenance
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Run fixed restore capacity and admission regressions in isolation
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not run.isdigit() or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_JOB_IDENTITY_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('restore-preparation-'+run);work.mkdir(mode=0o700)
names=['window-controller.py','window-support.py','window-quiescence.py','window-public-receipt.py','window-receipt-delivery.py','window-receipt-revoker.py','window-capacity.py','rehearse-old-database.py','window-metadata-capacity.py','restore-independent-mirror.py','launch-controlled-window.py','test-window-metadata-capacity.py','test-independent-mirror.py','test-attempt-capability.py','test-window-support.py','test-window-public-receipt.py','test-window-receipt-delivery.py','window-public-receipt.schema.json','attempt-capability-27220.public.json']
hashes={}
for name in names:
r=subprocess.run(['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':ops/gitea-r1/'+name],capture_output=True,timeout=30)
if r.returncode:raise RuntimeError('FIXED_RESTORE_PREPARATION_SOURCE_REQUIRED')
if name.endswith('.py'):ast.parse(r.stdout)
else:json.loads(r.stdout)
(work/name).write_bytes(r.stdout);hashes[name]=hashlib.sha256(r.stdout).hexdigest()
code=r'''import json,pathlib,re,subprocess,sys
root=pathlib.Path(__file__).parent;results=[]
for name,count in [('test-window-metadata-capacity.py',70),('test-independent-mirror.py',8),('test-attempt-capability.py',9),('test-window-support.py',6),('test-window-public-receipt.py',15),('test-window-receipt-delivery.py',38)]:
r=subprocess.run([sys.executable,'-B',str(root/name)],capture_output=True,text=True,timeout=120)
counts=re.findall(r'Ran ([0-9]+) tests?',r.stderr)
passed=r.returncode==0 and counts==[str(count)] and 'OK' in r.stderr and 'skipped=' not in r.stderr
if not passed:raise RuntimeError('RESTORE_PREPARATION_REGRESSION_FAILED:'+name)
results.append({'file':name,'tests':count,'exitCode':0})
print('R1_RESTORE_PREPARATION_TESTS_JSON '+json.dumps({'suites':results,'tests':sum(r['tests'] for r in results)}),flush=True)
'''
(work/'run-tests.py').write_text(code)
for p in [work,*work.iterdir()]:os.chown(p,1000,1000)
props=['User=git','Group=git','Nice=15','CPUQuota=50%','MemoryMax=512M','TasksMax=64','RuntimeMaxSec=360','TimeoutStopSec=15','ProtectSystem=strict','ProtectHome=tmpfs','PrivateNetwork=yes','PrivateTmp=yes','PrivateDevices=yes','NoNewPrivileges=yes','CapabilityBoundingSet=','TemporaryFileSystem=/var/lib/eios-r1-maintenance:ro,mode=0755','BindReadOnlyPaths='+str(work),'InaccessiblePaths=-/opt/gitea-runner -/usr/local/bin/data -/run/docker.sock -/run/dbus/system_bus_socket -/run/systemd/private','StandardOutput=file:'+str(work/'native.stdout'),'StandardError=file:'+str(work/'native.stderr')]
r=subprocess.run(['systemd-run','--quiet','--wait','--collect','--unit=eios-r1-restore-preparation-'+run,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'run-tests.py')],capture_output=True,timeout=420)
if r.returncode:raise RuntimeError('ISOLATED_RESTORE_PREPARATION_FAILED')
raw=(work/'native.stdout').read_text();marker='R1_RESTORE_PREPARATION_TESTS_JSON '
if raw.count(marker)!=1:raise RuntimeError('UNIQUE_NATIVE_TEST_RECEIPT_REQUIRED')
result=json.loads(raw.split(marker)[1]);result.update(kind='R1RestorePreparationNativeRegression',ci={'runId':run,'sourceSha':sha},fixedSourceSHA256=hashes,productionPathsDenied=True,servicesChanged=False,fullBackupRestorePerformed=False,windowAdmissionGranted=False,releaseEligible=False)
(work/'receipt.json').write_text(json.dumps(result,indent=2)+'\n');print('R1_RESTORE_PREPARATION_JSON '+json.dumps(result))
PY
shell: bash
timeout-minutes: "8"
permissions:
contents: read
... |