Add isolated test-environment host installer - #76
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b86cb94df9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please confirm exact head a75e2fa69afe6bff6b4f6a2b3f211b80495bd65b after the accepted lifecycle, policy, rollback, health, and release-integrity fixes. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a75e2fac15
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please confirm exact head f36fa02c3188de680087913e34bcb4f739641bd6; this only makes read-only release tamper/teardown tests work under non-root CI, with the full tester suite passing. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f36fa02c6d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 196b121df6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ca39b25234
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b4736e5e1a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 841406c946
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d88df91e1d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
# Conflicts: # docs/OPERATOR-WORKFLOWS.md
|
Prepared isolated tester proof completed on exact head The live proof exposed one repository-owned defect: a second uninstall failed when systemd units were already absent. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c600b8fbd7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e7640e2362
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| key=r'(?:!!str[ \t]+)?(?:include|"include"|\x27include\x27)[ \t]*:' | ||
| escaped_key=r'"[^"\n]*\\[^"\n]*"[ \t]*:' | ||
| if re.search(r'(?m)^[ \t]*'+key,text) or re.search(r'[,{][ \t]*'+key,text) or re.search(escaped_key,text): raise SystemExit('Compose include or escaped mapping key is forbidden') |
There was a problem hiding this comment.
Fresh evidence after the accepted escaped-key fix is YAML's explicit mapping form: a source containing ? "include" followed by : [{path: ..., env_file: /host/credential}] does not match either regex because the key and colon are on separate lines. Compose nevertheless parses the decoded top-level include and processes its interpolation file before emitting the rendered JSON, so credential values can be embedded in commands or labels with no remaining include or env_file field for the later policy to reject. Parse the YAML key or conservatively reject explicit mapping keys before rendering.
AGENTS.md reference: AGENTS.md:L33-L34
Useful? React with 👍 / 👎.
| PrivateTmp=yes | ||
| ProtectHome=yes | ||
| ProtectSystem=strict | ||
| ReadWritePaths=/var/lib/ci-fleet-tester -/run/lock/ci-fleet-tester |
There was a problem hiding this comment.
Fresh evidence beyond the accepted launcher recreation fix is this systemd sandbox entry: after reboot, when the volatile directory is absent, ProtectSystem=strict makes /run/lock read-only, while the leading - on ReadWritePaths means the missing exception is ignored. The launcher's mkdir therefore cannot create the directory when either timer starts, leaving expiration cleanup and health checks broken until an unsandboxed command recreates it; create it with RuntimeDirectory= or grant a writable existing parent.
AGENTS.md reference: AGENTS.md:L35-L35
Useful? React with 👍 / 👎.
| for unit in "${units[@]}"; do [[ ! -e $systemd_dir/$unit ]] || present=1; done | ||
| if ((present)); then systemctl disable --now "${timers[@]}" >/dev/null 2>&1 || return 1 | ||
| else systemctl disable --now "${timers[@]}" >/dev/null 2>&1 || true |
There was a problem hiding this comment.
If install_units fails after moving only a prefix of the unit files during a fresh activation, present is true but one of the timer units can still be absent. This call passes both names to systemctl disable; checked with systemctl 255, a missing named unit makes the command return nonzero, so remove_units exits here without deleting any partial files, and every subsequent uninstall repeats the same failure. Disable only installed timers or tolerate the not-found result while still surfacing genuine stop failures.
AGENTS.md reference: AGENTS.md:L66-L66
Useful? React with 👍 / 👎.
| expected=$(python3 -c 'import json,sys; print(len(json.load(open(sys.argv[1]))["services"]))' "$compose") | ||
| mapfile -t containers < <(docker compose -p "$(project_name "$id")" -f "$compose" ps -q) | ||
| [[ ${#containers[@]} == "$expected" ]] || status=unhealthy |
There was a problem hiding this comment.
When a validated definition assigns one service a Compose profiles entry, the unprofiled compose up invocation does not start that service, but the rendered configuration still includes it here. Inspection therefore expects more containers than Compose created and permanently reports the otherwise successful environment as unhealthy; if the profiled service is the declared route, convergence can also report a route that was never started. Reject profiles or calculate the expected service set using the same profile selection as activation.
Useful? React with 👍 / 👎.
1 participant
Closes #23
Summary
Validation
scripts/test-install-tester.sh(TESTER_INSTALLER_TESTS_OK)scripts/validate.shreachedINSTALLER_TESTS_OKandSTATUS_RECEIVER_INSTALL_TESTS_OK; final Docker smoke was omitted because this repository-only environment has no Docker CLI/daemon (docker: command not found)External gate
Draft: issue acceptance still requires install/upgrade/rollback/cleanup evidence on a prepared Debian test host. This run did not touch a live host, Docker daemon, systemd, network, secret, test environment, or production system.