| workflow_payload |
name: Verify public complete backup roots in bound name: Verify public complete backup roots in bounded private memory
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Verify complete public fixture without stopping production
run: |
set -eu
python3 <<'PY'
import ast,hashlib,json,os,pathlib,re,subprocess,time
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_FULL_FIXTURE_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-restore-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
names=frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines()
sources={}
for name in names:
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
suites=['test-memory-restore-layout.py','test-memory-restore-mounts.py','test-memory-old-database.py','test-memory-window-capacity.py','test-full-memory-restore.py','test-independent-mirror.py']
for name in suites:subprocess.run(['/usr/bin/python3','-B',str(work/name)],check=True,timeout=120)
print('R1_FULL_MEMORY_TEST_SOURCE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'sourceSHA256':sources,'nativeSuites':suites,'allSelectedTestSuitesPassed':True}),flush=True)
# A real controller cgroup, rather than an unbounded workflow process,
# holds the fixture lease and orchestrates the7G/1G/64M workers.
unit='eios-r1-full-fixture-'+run
props=['User=root','UMask=0077','MemoryMax=448M','MemorySwapMax=0','OOMPolicy=kill','TasksMax=128','RuntimeMaxSec=1200','TimeoutStopSec=30','KillMode=control-group','StandardOutput=file:'+str(work/'controller.stdout'),'StandardError=file:'+str(work/'controller.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'full-memory-window-bridge.py'),'--public-fixture'],check=True,capture_output=True,timeout=30)
manager_path=work/'run-memory-old-database-probe.py'
import importlib.util
spec=importlib.util.spec_from_file_location('manager',manager_path);manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,1210)
output=(work/'controller.stdout').read_text()
# Only bridge-produced screened receipts leave private job storage.
markers=['R1_FULL_MEMORY_JSON ','R1_FULL_MEMORY_CLEANUP_JSON ','R1_MEMORY_OLD_DB_BIND_DIAGNOSTIC_JSON ','R1_MEMORY_OLD_DB_MANAGED_DIAGNOSTIC_JSON ']
for line in output.splitlines():
if any(line.startswith(marker) for marker in markers):print(line,flush=True)
if output.count('R1_FULL_MEMORY_JSON ')!=1:
error=(work/'controller.stderr').read_text();print('R1_FULL_MEMORY_CONTROLLER_FAILURE_JSON '+json.dumps({'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',error),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',error)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',error)]}),flush=True);raise RuntimeError('PUBLIC_FULL_MEMORY_FIXTURE_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "25"
permissions:
contents: read
... |