| workflow_payload |
name: Restore readonly old database under bounded name: Restore readonly old database under bounded private memory pressure
"on":
workflow_dispatch:
inputs:
inspect_run:
description: Read only fixed owned failed old database probes 27255, 27258 or 27260
required: false
default: ''
identity_only:
description: Fixed credential transition diagnostic without database or pressure data
required: false
default: ''
bind_view_only:
description: Public fixture only; true for normal exit or force-exit for exact owned root and git unit SIGKILL
required: false
default: ''
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Test and rehearse readonly database with private RAM and zero swap
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,stat,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not run.isdigit() or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_JOB_IDENTITY_REQUIRED')
inspect=os.environ.get('INSPECT_OLD_DB_RUN','')
if inspect:
allowed={'27255':('319949a9c2e90e3860d4bce64612aa423af9bf71','native.stderr'),'27258':('44b9ef674036881b09d96efd4acc64da7ac5bbc7','layout-observation.stderr'),'27260':('abf5c11c5ded1406fce403156a3064e7739dfd7d','old-helper.stderr')}
if inspect not in allowed:raise RuntimeError('ONLY_FIXED_OLD_DB_FAILURE_ALLOWED')
failed_sha,log_name=allowed[inspect];prior=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-old-db-probe-'+inspect)
for name in ['probe-memory-old-database.py','run-memory-old-database-probe.py','memory-restore-mounts.py']:
r=subprocess.run(['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',failed_sha+':ops/gitea-r1/'+name],capture_output=True,timeout=30)
if r.returncode or hashlib.sha256((prior/name).read_bytes()).digest()!=hashlib.sha256(r.stdout).digest():raise RuntimeError('FIXED_FAILED_OLD_DB_SOURCE_REQUIRED')
for parent in [prior.parent,prior]:
details=parent.lstat()
if not stat.S_ISDIR(details.st_mode) or details.st_uid!=0 or details.st_mode&0o077:raise RuntimeError('PRIVATE_OLD_DB_FAILURE_ANCESTRY_REQUIRED')
log=prior/log_name;details=log.lstat()
if not stat.S_ISREG(details.st_mode) or details.st_uid!=0 or details.st_nlink!=1 or details.st_mode&0o022 or details.st_size>262144:raise RuntimeError('PRIVATE_OLD_DB_FAILURE_LOG_REQUIRED')
text=log.read_text();frames=[{'file':pathlib.Path(name).name,'line':int(number),'function':function} for name,number,function in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',text)]
errors=[{'class':name,'errno':int(number)} for name,number in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',text)]
r=subprocess.run(['systemctl','show','eios-r1-memory-old-db-'+inspect,'--property=LoadState,ActiveState,ExecMainPID'],capture_output=True,text=True,timeout=20)
state=dict(line.split('=',1) for line in r.stdout.splitlines() if '=' in line)
r=subprocess.run(['systemctl','show','eios-r1-memory-old-service-'+inspect,'--property=LoadState,ActiveState,ExecMainPID'],capture_output=True,text=True,timeout=20)
child_state=dict(line.split('=',1) for line in r.stdout.splitlines() if '=' in line)
import urllib.request
with urllib.request.urlopen('http://127.0.0.1:3345/api/healthz',timeout=10) as response:live_health=response.status
if live_health!=200:raise RuntimeError('CURRENT_LIVE_HEALTH_REQUIRED')
mounts=[line for line in pathlib.Path('/proc/self/mountinfo').read_text().splitlines() if line.split()[4].startswith(str(prior)+'/')]
report={'kind':'R1MemoryOldDatabaseFailureInspection','ci':{'runId':run,'sourceSha':sha},'failedRunId':inspect,'failedSource':failed_sha,'frames':frames,'errors':errors,'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',text),'pythonExecutableMentioned':"'/usr/bin/python3'" in text,'preexecMentioned':'preexec_fn' in text,'ownedUnitState':state,'hostMountsUnderOwnedWork':len(mounts),'scratchDirectoriesAbsent':all(not (prior/name).exists() for name in ['recovery','lfs-disk']),'productionServicesChanged':False,'windowAdmissionGranted':False}
report.update(ownedChildUnitState=child_state,currentLiveHealth=live_health)
print('R1_MEMORY_OLD_DB_INSPECTION_JSON '+json.dumps(report));raise SystemExit(0)
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-old-db-probe-'+run);work.mkdir(mode=0o700)
for name in ['probe-memory-old-database.py','run-memory-old-database-probe.py','memory-restore-mounts.py','memory-restore-layout.py','test-memory-old-database.py','test-memory-restore-layout.py','test-memory-restore-mounts.py','window-support.py','window-controller.py','rehearse-old-database.py','inspect-memory-restore.py','window-metadata-capacity.py','restore-independent-mirror.py','inspect-restore-resources.py']:
r=subprocess.run(['git','-c','safe.directory=/home/git/repositories/luoanwu/enterprise-platform.git','-c','core.hooksPath=/dev/null','-C','/home/git/repositories/luoanwu/enterprise-platform.git','show',sha+':ops/gitea-r1/'+name],capture_output=True,timeout=30)
if r.returncode:raise RuntimeError('FIXED_PRIVATE_OLD_DB_SOURCE_REQUIRED')
ast.parse(r.stdout);(work/name).write_bytes(r.stdout)
for name in ['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py']:subprocess.run(['python3','-B',str(work/name)],check=True,timeout=30)
subprocess.run(['python3','-B',str(work/'run-memory-old-database-probe.py')],check=True,timeout=780)
PY
shell: bash
env:
INSPECT_OLD_DB_RUN: ${{ inputs.inspect_run }}
OLD_DB_IDENTITY_ONLY: ${{ inputs.identity_only }}
OLD_DB_BIND_VIEW_ONLY: ${{ inputs.bind_view_only }}
timeout-minutes: "15"
permissions:
contents: read
... |