CI: .forgejo/deno.sh follow-ups — silent git skip, stale derived images, non-deterministic recipe key #29

New issue

Closed

opened 2026-08-11 15:44:21 +02:00 by julian · 0 comments

julian commented

2026-08-11 15:44:21 +02:00

Owner

Follow-ups from the review of #27 (approved; none blocked it). All three are in .forgejo/deno.sh, so one pass over that file closes them.

1. The soft fallback re-opens the silent-skip hole the file complains about — `deno.sh:67-77`

deno.sh:37-41 documents that without git, docker/backend/commit_test.ts "silently never ran at all", and that test still guards itself (commit_test.ts:17,25 — ignore: !hasGit). The fallback added in #27 warns on stderr and sets CI_IMAGE=$IMAGE, so an unreachable Debian mirror puts that suite straight back to silently skipping, with CI green.

The external-module tests do fail loudly today — they shell out to git unguarded — so something catches it. That is the accident of which suite happens to exist, not a property of the design.

Options:

have the wrapper export a "git was expected" variable that turns hasGit skips into failures; or
keep the soft fallback only for the callers that declare no git dependency (deps.yml reads files and needs none), and let the rest fail hard.

2. Nothing removes superseded derived images

Every recipe or toolchain change leaves a full opsdeck-deno-ci:* image behind on a long-lived runner. Prune the other tags with that prefix after a successful build (tolerating a failure — another job may be running one).

3. `RECIPE_KEY` is not stable across runners — `deno.sh:64-65`

RECIPE_KEY=$(printf '%s' "$RECIPE" | { sha256sum 2>/dev/null || cksum; } | tr -cd '[:alnum:]' | cut -c1-16)

A runner without sha256sum produces a different tag for the same recipe, so a mixed fleet builds the same image twice and caches neither for the other. cksum is also a CRC32 where the surrounding comment reasons about a hash. Pick one digest and fail loudly if it is missing.

Follow-ups from the review of #27 (approved; none blocked it). All three are in `.forgejo/deno.sh`, so one pass over that file closes them. ## 1. The soft fallback re-opens the silent-skip hole the file complains about — `deno.sh:67-77` `deno.sh:37-41` documents that without git, `docker/backend/commit_test.ts` "silently never ran at all", and that test still guards itself (`commit_test.ts:17,25` — `ignore: !hasGit`). The fallback added in #27 warns on stderr and sets `CI_IMAGE=$IMAGE`, so an unreachable Debian mirror puts that suite straight back to silently skipping, with CI green. The external-module tests do fail loudly today — they shell out to git unguarded — so something catches it. That is the accident of which suite happens to exist, not a property of the design. Options: - have the wrapper export a "git was expected" variable that turns `hasGit` skips into failures; or - keep the soft fallback only for the callers that declare no git dependency (`deps.yml` reads files and needs none), and let the rest fail hard. ## 2. Nothing removes superseded derived images Every recipe or toolchain change leaves a full `opsdeck-deno-ci:*` image behind on a long-lived runner. Prune the other tags with that prefix after a successful build (tolerating a failure — another job may be running one). ## 3. `RECIPE_KEY` is not stable across runners — `deno.sh:64-65` ```sh RECIPE_KEY=$(printf '%s' "$RECIPE" | { sha256sum 2>/dev/null || cksum; } | tr -cd '[:alnum:]' | cut -c1-16) ``` A runner without `sha256sum` produces a different tag for the same recipe, so a mixed fleet builds the same image twice and caches neither for the other. `cksum` is also a CRC32 where the surrounding comment reasons about a hash. Pick one digest and fail loudly if it is missing.

julian referenced this issue from a commit

2026-08-11 15:44:45 +02:00

Alert on disabled modules, and retry repos that were unreachable at startup (#27)

julian referenced this issue from a commit

2026-08-16 13:54:35 +02:00

ci(deno.sh): losing git is an error, one digest, and no image left behind

julian referenced this issue from a pull request that will close it,

2026-08-16 13:54:53 +02:00

ci(deno.sh): losing git is an error, one digest, and no image left behind #42

julian closed this issue

2026-08-21 23:20:26 +02:00