Moves 4 of 5 GitHub Actions workflows from `ubuntu-latest` to the new `stwl-labs` org-level self-hosted pool (CT 111 axiom-runner-1..4) and rewires the `migrate` job to use CT 102's shared Postgres via per-run databases. Changes: - ci.yml: lint, schema-map-fresh, forbidden-patterns, migrate, test -> `[self-hosted, axiom]`. migrate job drops `services.postgres` (saved ~30s/run of image pull) and switches to `HOMELAB_CI_POSTGRES_BASE_URL` secret + per-run DB (`ci_run_<run_id>_<run_attempt>`) with `always()` cleanup so failed migrations don't leak DBs. - preview-smoke.yml: gate + smoke -> self-hosted. Playwright browser cache lives under /opt/appdata/gha-runner/shared-cache/playwright on the host bind mount; first PR primes it, subsequent runs reuse. - visual-diff.yml: gate + visual -> self-hosted (same Playwright cache). - pr-health-rollup.yml: rollup -> self-hosted. - agent-context-drift.yml: deliberately LEFT on ubuntu-latest (D4 in convoy doc). Weekly cron stays GitHub-hosted so it runs even when axiom is down. Why on this side and not the runner side: - migrate adds an explicit `sudo apt-get install -y postgresql-client` step (~10s, amortized via apt-cache survival). The runner image doesn't ship psql; baking it in would require a custom image and doesn't earn its keep for one job. Repo prereqs (set before this PR opens): - `HOMELAB_CI_POSTGRES_BASE_URL` repo secret set (value pattern: `postgres://deckhearth_ci:<pw>@192.168.68.102:5432`) - `deckhearth_ci` Postgres user created on CT 102 with CREATEDB, no superuser - stwl-labs org Actions settings: "Require approval for all outside collaborators" + runner group rejects public repos - 4 runners online: `axiom-runner-1..4`, status Idle Follow-ups (per convoy): - Brief 3: forbidden-pattern gate to catch `runs-on: ubuntu-latest` re-introduction outside the agent-context-drift allowlist - Brief 4: AGENTS.md updates + 1-line revert path (D5) - Weekly cron on CT 102 to GC any `ci_run_*` DBs older than 7d (Risk #4 mitigation) Co-authored-by: Cursor <cursoragent@cursor.com>
97 lines
4.4 KiB
YAML
97 lines
4.4 KiB
YAML
name: PR Health rollup
|
|
|
|
# Rolls up CI gates AND the Vercel deployment status posted by the Vercel
|
|
# GitHub integration. Build status comes from Vercel, not from our own CI.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
types: [opened, synchronize, reopened, labeled, unlabeled]
|
|
workflow_run:
|
|
workflows: [CI, Preview smoke, Visual diff]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
pull-requests: write
|
|
issues: write
|
|
checks: read
|
|
deployments: read
|
|
|
|
jobs:
|
|
rollup:
|
|
name: Aggregate gate status
|
|
runs-on: [self-hosted, axiom]
|
|
steps:
|
|
- name: Compute status + post sticky comment
|
|
uses: actions/github-script@v7
|
|
with:
|
|
script: |
|
|
const { owner, repo } = context.repo;
|
|
const pr_number = context.payload.pull_request?.number
|
|
?? context.payload.workflow_run?.pull_requests?.[0]?.number;
|
|
|
|
if (!pr_number) {
|
|
core.info('No PR context — skipping rollup.');
|
|
return;
|
|
}
|
|
|
|
const pr = (await github.rest.pulls.get({ owner, repo, pull_number: pr_number })).data;
|
|
const sha = pr.head.sha;
|
|
|
|
const checks = (await github.rest.checks.listForRef({ owner, repo, ref: sha, per_page: 100 })).data.check_runs;
|
|
const find = (name) => checks.find(c => c.name === name);
|
|
|
|
const vercelCheck = checks.find(c => /^vercel/i.test(c.name));
|
|
|
|
const skip = (flag) =>
|
|
new RegExp(`pipeline:.*skip[^\\n]*\\b${flag}\\b`).test(pr.body || '');
|
|
|
|
const row = (label, run, opt = false) => {
|
|
if (!run) return `| ${label} | ${opt ? '⏭ skipped or pending' : '⏳ pending'} |`;
|
|
if (run.status !== 'completed') return `| ${label} | ⏳ in progress |`;
|
|
const ok = run.conclusion === 'success';
|
|
return `| ${label} | ${ok ? '✅ pass' : '❌ ' + run.conclusion} |`;
|
|
};
|
|
|
|
const rows = [
|
|
row('Vercel build (Preview)', vercelCheck),
|
|
row('CI: Lint', find('Lint')),
|
|
row('CI: Schema map fresh', find('Schema map up to date'), true),
|
|
skip('smoke') ? '| Preview smoke | ⏭ skipped (pipeline directive) |' : row('Preview smoke', find('Playwright smoke'), true),
|
|
skip('visual') ? '| Visual diff | ⏭ skipped (pipeline directive) |' : row('Visual diff', find('Screenshot diff'), true),
|
|
];
|
|
|
|
const reviewer_comment = (await github.rest.issues.listComments({
|
|
owner, repo, issue_number: pr_number, per_page: 100,
|
|
})).data.find(c => c.body?.startsWith('## Reviewer Report'));
|
|
|
|
const a11y_comment = (await github.rest.issues.listComments({
|
|
owner, repo, issue_number: pr_number, per_page: 100,
|
|
})).data.find(c => c.body?.startsWith('## A11y Audit'));
|
|
|
|
const ds_comment = (await github.rest.issues.listComments({
|
|
owner, repo, issue_number: pr_number, per_page: 100,
|
|
})).data.find(c => c.body?.startsWith('## Design System Audit'));
|
|
|
|
const role_row = (label, c, skipped) =>
|
|
skipped ? `| ${label} | ⏭ skipped |` : c ? `| ${label} | ✅ posted |` : `| ${label} | ⏳ pending |`;
|
|
|
|
const role_rows = [
|
|
role_row('Reviewer report', reviewer_comment, skip('review')),
|
|
role_row('A11y audit', a11y_comment, skip('a11y')),
|
|
role_row('Design system audit', ds_comment, skip('design')),
|
|
];
|
|
|
|
const marker = '<!-- pipeline-rollup -->';
|
|
const body = `${marker}\n## Pipeline Health\n\n### Build + CI gates\n\n| Gate | Status |\n| --- | --- |\n${rows.join('\n')}\n\n_Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._\n\n### Role reports\n\n| Role | Status |\n| --- | --- |\n${role_rows.join('\n')}\n\nSee individual comments above for details. This rollup updates automatically.`;
|
|
|
|
const comments = (await github.rest.issues.listComments({
|
|
owner, repo, issue_number: pr_number, per_page: 100,
|
|
})).data;
|
|
const existing = comments.find(c => c.body?.startsWith(marker));
|
|
|
|
if (existing) {
|
|
await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
|
|
} else {
|
|
await github.rest.issues.createComment({ owner, repo, issue_number: pr_number, body });
|
|
}
|