convoy: migrate CI to self-hosted axiom runners (briefs 1+2) #132

Merged

varutasu merged 4 commits from convoy/migrate-ci-to-self-hosted into main

2026-06-06 00:46:31 -04:00

varutasu commented

2026-06-05 18:50:55 -04:00

(Migrated from github.com)

Summary

Moves 4 of 5 GitHub Actions workflows off ubuntu-latest (billed) onto the new stwl-labs org-level self-hosted pool (CT 111 axiom-runner-1..4) and rewires the migrate job to use CT 102's shared Postgres via per-run databases. See .convoys/migrate-ci-to-self-hosted.md for the full design (ratified architecture decisions, risks, follow-up briefs).

What this PR does (briefs 1+2 combined)

5 jobs in ci.yml → runs-on: [self-hosted, axiom]: lint, schema-map-fresh, forbidden-patterns, migrate, test.
migrate job rewire — drops the ephemeral services.postgres block (saved ~30s/run of image pull) and points at CT 102 Postgres via HOMELAB_CI_POSTGRES_BASE_URL. Per-run DB name (ci_run_<run_id>_<run_attempt>) keeps parallel PRs isolated; if: always() drop step prevents leaked databases. Adds sudo apt-get install -y postgresql-client since the runner image doesn't ship psql.
preview-smoke.yml + visual-diff.yml → both gate + heavy job migrated. Playwright browser cache lives at /opt/appdata/gha-runner/shared-cache/playwright on the CT 111 bind mount; first PR primes, subsequent runs reuse (saves ~15-25s).
pr-health-rollup.yml → migrated.
agent-context-drift.yml → deliberately LEFT on ubuntu-latest per D4 in the convoy. Trades ~2 min/month of billed CI for resilience: weekly cron runs even when axiom is down.

Prereqs (already done before opening this PR)

HOMELAB_CI_POSTGRES_BASE_URL repo secret set on stwl-labs/tcg-vault — value is postgres://deckhearth_ci:<pw>@192.168.68.102:5432
deckhearth_ci Postgres role created on CT 102: CREATEDB, no superuser, no access to other apps' DBs
4 ephemeral runners online and idle at org level (stwl-labs Settings → Actions → Runners)
stwl-labs org Actions hardening: external collaborators require approval; runner group rejects public repos

Test plan

After merge (or as soon as this PR's checks fire — the runners pick up immediately):

All 5 ci.yml jobs report In progress on axiom-runner-<N> in the PR's Checks tab within ~10s of dispatch
migrate job logs show psql ... CREATE DATABASE "ci_run_<run_id>_<run_attempt>" followed by npm run migrate up success, then DROP DATABASE in the cleanup step (even on failure)
preview-smoke and visual-diff jobs run on axiom (gate first, then heavy job). On first run Playwright pulls Chromium; on subsequent runs the cache hits and skips the download.
pr-health-rollup runs on axiom and posts the sticky comment as before.
GitHub Actions minute consumption for this PR is ~0 (only the weekly agent-context-drift cron remains on ubuntu-latest).
No leftover ci_run_* databases on CT 102 after the run: ssh axiom 'pct exec 102 -- docker exec postgres psql -U postgres -c "\l"' | grep ci_run_ returns nothing.

Follow-up briefs (per convoy doc, deferred to separate PRs)

Brief 3 — forbidden-pattern gate (8th check in ci.yml) to prevent runs-on: ubuntu-latest from drifting back outside the agent-context-drift.yml allowlist.
Brief 4 — AGENTS.md § 6/7 updates documenting the self-hosted runner story + the 1-line revert path (D5): sed -i 's/\[self-hosted, axiom\]/ubuntu-latest/g' .github/workflows/*.yml for when axiom is offline mid-PR-storm.
cleanup-stale-ci-runs-cron — weekly cron on CT 102 to drop ci_run_* DBs older than 7d (Risk #4 defensive mitigation; the per-run always() cleanup should already handle the happy + failure paths).

Made with Cursor

## Summary Moves 4 of 5 GitHub Actions workflows off `ubuntu-latest` (billed) onto the new `stwl-labs` org-level self-hosted pool (CT 111 axiom-runner-1..4) and rewires the `migrate` job to use CT 102's shared Postgres via per-run databases. See [`.convoys/migrate-ci-to-self-hosted.md`](https://github.com/stwl-labs/tcg-vault/blob/convoy/migrate-ci-to-self-hosted/.convoys/migrate-ci-to-self-hosted.md) for the full design (ratified architecture decisions, risks, follow-up briefs). ## What this PR does (briefs 1+2 combined) - **5 jobs in `ci.yml`** → `runs-on: [self-hosted, axiom]`: lint, schema-map-fresh, forbidden-patterns, migrate, test. - **`migrate` job rewire** — drops the ephemeral `services.postgres` block (saved ~30s/run of image pull) and points at CT 102 Postgres via `HOMELAB_CI_POSTGRES_BASE_URL`. Per-run DB name (`ci_run_<run_id>_<run_attempt>`) keeps parallel PRs isolated; `if: always()` drop step prevents leaked databases. Adds `sudo apt-get install -y postgresql-client` since the runner image doesn't ship psql. - **preview-smoke.yml + visual-diff.yml** → both gate + heavy job migrated. Playwright browser cache lives at `/opt/appdata/gha-runner/shared-cache/playwright` on the CT 111 bind mount; first PR primes, subsequent runs reuse (saves ~15-25s). - **pr-health-rollup.yml** → migrated. - **agent-context-drift.yml** → deliberately LEFT on `ubuntu-latest` per D4 in the convoy. Trades ~2 min/month of billed CI for resilience: weekly cron runs even when axiom is down. ## Prereqs (already done before opening this PR) - `HOMELAB_CI_POSTGRES_BASE_URL` repo secret set on stwl-labs/tcg-vault — value is `postgres://deckhearth_ci:<pw>@192.168.68.102:5432` - `deckhearth_ci` Postgres role created on CT 102: `CREATEDB`, no superuser, no access to other apps' DBs - 4 ephemeral runners online and idle at org level (`stwl-labs` Settings → Actions → Runners) - `stwl-labs` org Actions hardening: external collaborators require approval; runner group rejects public repos ## Test plan After merge (or as soon as this PR's checks fire — the runners pick up immediately): - [ ] All 5 `ci.yml` jobs report `In progress on axiom-runner-<N>` in the PR's Checks tab within ~10s of dispatch - [ ] `migrate` job logs show `psql ... CREATE DATABASE "ci_run_<run_id>_<run_attempt>"` followed by `npm run migrate up` success, then `DROP DATABASE` in the cleanup step (even on failure) - [ ] `preview-smoke` and `visual-diff` jobs run on axiom (gate first, then heavy job). On first run Playwright pulls Chromium; on subsequent runs the cache hits and skips the download. - [ ] `pr-health-rollup` runs on axiom and posts the sticky comment as before. - [ ] GitHub Actions minute consumption for this PR is ~0 (only the weekly `agent-context-drift` cron remains on `ubuntu-latest`). - [ ] No leftover `ci_run_*` databases on CT 102 after the run: `ssh axiom 'pct exec 102 -- docker exec postgres psql -U postgres -c "\l"' | grep ci_run_` returns nothing. ## Follow-up briefs (per convoy doc, deferred to separate PRs) - **Brief 3** — forbidden-pattern gate (8th check in `ci.yml`) to prevent `runs-on: ubuntu-latest` from drifting back outside the `agent-context-drift.yml` allowlist. - **Brief 4** — `AGENTS.md` § 6/7 updates documenting the self-hosted runner story + the 1-line revert path (D5): `sed -i 's/\[self-hosted, axiom\]/ubuntu-latest/g' .github/workflows/*.yml` for when axiom is offline mid-PR-storm. - **`cleanup-stale-ci-runs-cron`** — weekly cron on CT 102 to drop `ci_run_*` DBs older than 7d (Risk #4 defensive mitigation; the per-run `always()` cleanup should already handle the happy + failure paths). Made with [Cursor](https://cursor.com)

github-actions[bot] commented

2026-06-05 18:51:08 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	✅ pass
Visual diff	⏭ skipped or pending

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ✅ pass | | Visual diff | ⏭ skipped or pending | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.

vercel[bot] commented

2026-06-06 00:31:11 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	Jun 6, 2026 4:31am

[vc]: #u4ojaXrrxp5eDEFiDWjzFcACIH6+CYGtEhl10ptUy0c=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsInJvb3REaXJlY3RvcnkiOm51bGwsImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS9yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMvdGNnLXZhdWx0L0c3NmNvc3k2QlFhb0toR2Jla1FvZ1ZQTjRrYnAiLCJwcmV2aWV3VXJsIjoidGNnLXZhdWx0LWdpdC1jb252b3ktbWlncmF0ZS1lZDllMjktcmFuZGFsbC1zdGlsbHdlbGxzLXByb2plY3RzLnZlcmNlbC5hcHAiLCJuZXh0Q29tbWl0U3RhdHVzIjoiREVQTE9ZRUQiLCJsaXZlRmVlZGJhY2siOnsicmVzb2x2ZWQiOjAsInVucmVzb2x2ZWQiOjAsInRvdGFsIjowLCJsaW5rIjoidGNnLXZhdWx0LWdpdC1jb252b3ktbWlncmF0ZS1lZDllMjktcmFuZGFsbC1zdGlsbHdlbGxzLXByb2plY3RzLnZlcmNlbC5hcHAifX1dLCJyZXF1ZXN0UmV2aWV3VXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3ZlcmNlbC1hZ2VudC9yZXF1ZXN0LXJldmlldz9vd25lcj1zdHdsLWxhYnMmcmVwbz10Y2ctdmF1bHQmcHI9MTMyIn0= The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/G76cosy6BQaoKhGbekQogVPN4kbp) | [Preview](https://tcg-vault-git-convoy-migrate-ed9e29-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-convoy-migrate-ed9e29-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | Jun 6, 2026 4:31am | <a href="https://vercel.com/vercel-agent/request-review?owner=stwl-labs&repo=tcg-vault&pr=132" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>