| workflow_payload |
name: Refresh native memory window capacity and re name: Refresh native memory window capacity and readonly prerequisites
"on":
workflow_dispatch:
jobs:
validate:
name: validate
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Refresh native backup access HTTP and compressed geometry without maintenance
run: |
set -eu
python3 <<'PY'
import ast,hashlib,importlib.util,json,os,pathlib,re,subprocess
run=os.environ['GITHUB_RUN_ID'];sha=os.environ['GITHUB_SHA']
if not re.fullmatch('[1-9][0-9]*',run) or not re.fullmatch('[0-9a-f]{40}',sha):raise RuntimeError('FIXED_MEMORY_PREFLIGHT_JOB_REQUIRED')
work=pathlib.Path('/var/lib/eios-r1-maintenance')/('memory-window-preflight-'+run);work.mkdir(mode=0o700)
repo='/home/git/repositories/luoanwu/enterprise-platform.git'
def frozen(*args):return subprocess.run(['git','-c','safe.directory='+repo,'-c','core.hooksPath=/dev/null','-C',repo,*args],capture_output=True,check=True,timeout=30).stdout
sources={}
for name in frozen('ls-tree','--name-only',sha+':ops/gitea-r1').decode().splitlines():
if not re.fullmatch('[a-z][a-z0-9-]*\.py',name):continue
data=frozen('show',sha+':ops/gitea-r1/'+name);ast.parse(data);(work/name).write_bytes(data);sources[name]=hashlib.sha256(data).hexdigest()
with open(work/'source-closure.private.json','x') as stream:json.dump(sources,stream)
for name in ['prerequisites-native-27278.json','parent-child-native-27281.json']:
data=frozen('show',sha+':docs/evidence/r1-memory-restore-2026-11-09/'+name);json.loads(data);(work/name).write_bytes(data)
suites=[]
for name,count in [('test-memory-window-capacity.py',12),('test-memory-native-prerequisites.py',5),('test-memory-window-integration.py',15),('test-launch-memory-window.py',5)]:
result=subprocess.run(['/usr/bin/python3','-B',str(work/name)],capture_output=True,text=True,timeout=60)
(work/(name+'.stdout')).write_text(result.stdout);(work/(name+'.stderr')).write_text(result.stderr)
observed=re.findall(r'Ran ([0-9]+) tests?',result.stderr)
if result.returncode or observed!=[str(count)] or 'OK' not in result.stderr:raise RuntimeError('FIXED_MEMORY_PREREQUISITE_UNIT_TEST_FAILED')
suites.append({'file':name,'tests':count,'exitCode':0})
with open(work/'native-unit-tests.private.json','x') as stream:json.dump({'ci':{'runId':run,'sourceSha':sha},'suites':suites},stream)
(work/'native-unit-tests.private.json').chmod(0o600)
roots=next(ast.literal_eval(n.value) for n in ast.parse((work/'window-support.py').read_bytes()).body if isinstance(n,ast.Assign) and any(isinstance(t,ast.Name) and t.id=='ROOTS' for t in n.targets))
if hashlib.sha256(json.dumps(list(roots),separators=(',',':')).encode()).hexdigest()!='be95219bdb15adaf0b7b4ba28d1227bee48688a17865575c5fe473377c47e89c':raise RuntimeError('FIXED_EIGHT_READONLY_ROOTS_REQUIRED')
unit='eios-r1-memory-prerequisites-'+run
props=['User=root','UMask=0077','Nice=15','CPUQuota=150%','MemoryMax=7G','MemorySwapMax=0','OOMPolicy=kill','TasksMax=256','RuntimeMaxSec=2400','TimeoutStopSec=30','KillMode=control-group','ProtectSystem=strict','PrivateMounts=yes','PrivateTmp=yes','BindReadOnlyPaths='+' '.join('/'+name for name in roots),'ReadWritePaths=/var/lib/eios-r1-maintenance','StandardOutput=file:'+str(work/'prerequisites.stdout'),'StandardError=file:'+str(work/'prerequisites.stderr')]
subprocess.run(['systemd-run','--service-type=exec','--quiet','--collect','--unit='+unit,'--working-directory='+str(work),'--setenv=GITHUB_RUN_ID='+run,'--setenv=GITHUB_SHA='+sha,*['--property='+p for p in props],'/usr/bin/python3','-B',str(work/'memory-native-prerequisites.py')],check=True,capture_output=True,timeout=30)
spec=importlib.util.spec_from_file_location('manager',work/'run-memory-old-database-probe.py');manager=importlib.util.module_from_spec(spec);spec.loader.exec_module(manager)
try:
manager.wait_root(unit,2410);output=(work/'prerequisites.stdout').read_text();marker='R1_MEMORY_PREREQUISITES_JSON '
if output.count(marker)==1:print(marker+output.split(marker)[1],flush=True)
else:
diagnostics={}
for name in ['prerequisites.stderr','window-preflight.py.stderr','window-receipt-preflight.py.stderr','controller-envelope.stderr']:
p=work/name
if p.exists():
raw=p.read_text();diagnostics[name]={'runtimeCodes':re.findall(r'(?m)^(?:RuntimeError|ValueError): ([A-Z_]+)$',raw),'errors':[{'class':c,'errno':int(n)} for c,n in re.findall(r'(?m)^([A-Za-z]+Error): \[Errno ([0-9]+)\]',raw)],'frames':[{'file':pathlib.Path(f).name,'line':int(n),'function':fn} for f,n,fn in re.findall(r'File "([^"]+)", line ([0-9]+), in ([A-Za-z_][A-Za-z0-9_]*)',raw)]}
print('R1_MEMORY_PREREQUISITES_FAILURE_JSON '+json.dumps({'ci':{'runId':run,'sourceSha':sha},'diagnostics':diagnostics,'liveHealthAfter':manager.health(),'productionServicesChanged':False,'windowAdmissionGranted':False}),flush=True);raise RuntimeError('FRESH_MEMORY_NATIVE_PREREQUISITES_FAILED')
finally:manager.stop_owned(unit,'root',work)
PY
shell: bash
timeout-minutes: "45"
permissions:
contents: read
... |