Joseph Doherty
d769244ac0
The `windows`/`live-mxaccess` CI jobs were removed in abb0930 because Gitea
act_runner host-mode on Windows is broken and a runs-on gate with no runner
wedges the queue. This left the entire x86/net48 Worker + Worker.Tests tier
(and the live-MXAccess smoke) unguarded by CI.
Restore it without a native Windows runner: Linux jobs on ubuntu-latest (which
always schedule) SSH to windev (10.100.0.48), fetch+checkout the SHA under test
in an isolated clone C:\build\mxaccessgw-ci, run the x86 build/tests there, and
propagate the remote exit code back — so a Worker regression turns the job red
and an unreachable host fails loud (never stuck).
- scripts/ci/run-windev-ci.sh: Linux driver (key/known-hosts, UTF-16LE base64
EncodedCommand bootstrap, ssh, exit-code passthrough).
- scripts/ci/windev-worker-ci.ps1: windev stage — worktree lock, re-fetch/
checkout under lock, build|test|live modes; PS 5.1-safe, checks $LASTEXITCODE.
- scripts/ci/windev.known_hosts: pinned host keys for StrictHostKeyChecking.
- scripts/ci/README.md: operator bring-up + acceptance checklist.
- ci.yml: windows-x86 (per-push `test`) + nightly-windev (scheduled `live` +
on-failure Gitea issue); drop the removal note; fix header/cron comments.
TST-26 (same commit, by rule): correct docs/scripts that still describe the
removed jobs — GatewayTesting.md, Contracts.md, check-codegen.ps1 — and
reattribute the Generated/-commit guard (primary = check-codegen diff in the
portable job; secondary = windows-x86 net48 compile).
Mechanism hand-verified on windev: build->0, bogus-SHA->nonzero (lock released),
test->356 passed/0 failed in ~50s, ssh exit-code propagation confirmed. Merge
requires operator bring-up first (dedicated ci@ key + Gitea secrets) or the
per-push job is red every push — see scripts/ci/README.md.
95 lines
3.8 KiB
Bash
Executable File
95 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# TST-25: Linux side of the Windows/x86 Worker CI tier.
|
|
#
|
|
# Runs in the `windows-x86` / nightly Gitea jobs on a Linux runner (which always schedules,
|
|
# unlike a broken Windows act_runner). SSHes to windev (10.100.0.48), where it fetches +
|
|
# checks out the SHA under test in the isolated CI clone C:\build\mxaccessgw-ci and runs
|
|
# scripts/ci/windev-worker-ci.ps1 there. The remote exit code propagates through
|
|
# ssh -> this script -> the CI step, so a Worker regression turns the job red.
|
|
#
|
|
# Usage: run-windev-ci.sh <build|test|live>
|
|
#
|
|
# Environment:
|
|
# CI_SHA commit to test (default: `git rev-parse HEAD` in this checkout)
|
|
# WINDEV_SSH_KEY private key PEM (Gitea secret). If empty, falls back to the
|
|
# runner's default ssh identity/agent (used for local hand-testing).
|
|
# WINDEV_SSH_KNOWN_HOSTS pinned host keys (Gitea secret). If empty, uses the committed
|
|
# scripts/ci/windev.known_hosts.
|
|
# WINDEV_SSH_USER ssh user on windev (default: ci)
|
|
# WINDEV_SSH_HOST windev host/IP (default: 10.100.0.48)
|
|
#
|
|
# The private key is never echoed (written 0600 to a temp file, removed on exit). git on
|
|
# windev writes progress to stderr, so the remote bootstrap does NOT use -ErrorActionPreference
|
|
# Stop around git — it checks $LASTEXITCODE instead (known windev gotcha).
|
|
|
|
set -euo pipefail
|
|
|
|
MODE="${1:-}"
|
|
case "$MODE" in
|
|
build|test|live) ;;
|
|
*) echo "usage: $0 <build|test|live>" >&2; exit 2 ;;
|
|
esac
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
CI_SHA="${CI_SHA:-$(git -C "$SCRIPT_DIR" rev-parse HEAD)}"
|
|
WINDEV_SSH_USER="${WINDEV_SSH_USER:-ci}"
|
|
WINDEV_SSH_HOST="${WINDEV_SSH_HOST:-10.100.0.48}"
|
|
REMOTE_CLONE='C:\build\mxaccessgw-ci'
|
|
REMOTE_SCRIPT='scripts\ci\windev-worker-ci.ps1'
|
|
|
|
# Validate the SHA shape before it reaches a remote shell command.
|
|
if ! printf '%s' "$CI_SHA" | grep -Eq '^[0-9a-fA-F]{7,40}$'; then
|
|
echo "run-windev-ci: refusing to run — CI_SHA '$CI_SHA' is not a hex commit id" >&2
|
|
exit 2
|
|
fi
|
|
|
|
WORK="$(mktemp -d)"
|
|
cleanup() { rm -rf "$WORK"; }
|
|
trap cleanup EXIT
|
|
|
|
SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=yes -o ConnectTimeout=15)
|
|
|
|
# known_hosts: secret if provided, else the committed pins.
|
|
KNOWN_HOSTS="$WORK/known_hosts"
|
|
if [ -n "${WINDEV_SSH_KNOWN_HOSTS:-}" ]; then
|
|
printf '%s\n' "$WINDEV_SSH_KNOWN_HOSTS" > "$KNOWN_HOSTS"
|
|
else
|
|
cp "$SCRIPT_DIR/windev.known_hosts" "$KNOWN_HOSTS"
|
|
fi
|
|
SSH_OPTS+=(-o "UserKnownHostsFile=$KNOWN_HOSTS")
|
|
|
|
# Private key: secret if provided, else fall back to the default identity/agent.
|
|
if [ -n "${WINDEV_SSH_KEY:-}" ]; then
|
|
KEY="$WORK/id_ci"
|
|
( umask 077; printf '%s\n' "$WINDEV_SSH_KEY" > "$KEY" )
|
|
SSH_OPTS+=(-o IdentitiesOnly=yes -i "$KEY")
|
|
fi
|
|
|
|
echo "run-windev-ci: mode=$MODE sha=$CI_SHA target=${WINDEV_SSH_USER}@${WINDEV_SSH_HOST}"
|
|
|
|
# Remote PowerShell bootstrap: fetch + checkout enough to load the versioned CI script, then
|
|
# hand off to it. Not Stop around git (stderr progress). windev-worker-ci.ps1 re-fetches and
|
|
# re-checks-out under a lock, so this checkout only needs to load the right script version.
|
|
read -r -d '' BOOTSTRAP <<PS || true
|
|
\$ErrorActionPreference = 'Continue'
|
|
Set-Location '$REMOTE_CLONE'
|
|
git fetch --prune origin
|
|
git checkout --force --detach $CI_SHA
|
|
if (\$LASTEXITCODE -ne 0) { Write-Error "bootstrap checkout failed"; exit \$LASTEXITCODE }
|
|
powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File '$REMOTE_SCRIPT' -Sha '$CI_SHA' -Mode '$MODE'
|
|
exit \$LASTEXITCODE
|
|
PS
|
|
|
|
# PowerShell -EncodedCommand wants UTF-16LE base64 on one line (avoids all ssh/quoting hazards).
|
|
ENCODED="$(printf '%s' "$BOOTSTRAP" | iconv -t UTF-16LE | base64 | tr -d '\n')"
|
|
|
|
set +e
|
|
ssh "${SSH_OPTS[@]}" "${WINDEV_SSH_USER}@${WINDEV_SSH_HOST}" \
|
|
"powershell -NoProfile -NonInteractive -EncodedCommand $ENCODED"
|
|
RC=$?
|
|
set -e
|
|
|
|
echo "run-windev-ci: remote exit code $RC"
|
|
exit $RC
|