0deaa5489a
31 runs were queued on igneum-build-1's one runner at 13:15 UK on 7 October 2026 and nothing had concluded since 13:03Z, so no lane could read a conclusion. - ci.yml: a `changes` job (ubuntu-latest) classifies the push with tools/ci/docs-only-check.sh (docs/, site/, *.md only = code=false; a new branch, a pull request, a force push or an API error = code=true); pow and sims need it and run only on code=true. The site job is unchanged on ubuntu-latest for every push. The classifier's self-test is in the gate. - provision.sh and runner/register.sh: `--host <ip>` registers another box, forwarding BOX_HOSTNAME, RUNNER_NAME, RUNNER_LABELS, RUNNER_CPUS and RUNNER_JOBS (plain words only); RUNNER_CPUS writes AllowedCPUs into the service drop-in beside Nice=10, so igneum-build-2's runner is bounded like a suite (32 cores). The pool label is igneum-build-1 (both boxes carry it); ci-red marks the box with the record file and the poster, the default labels carry it, and igneum-build-1 got it through the runners API today. - ci-red.yml runs on the ci-red label, so the red line always lands where the poster reads it. - CLAUDE.md: the rule reads "read the conclusion when it lands, own a red before the next push"; pushes are never held. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
72 lines
5.2 KiB
Bash
Executable file
72 lines
5.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Register (or re-register) the GitHub Actions self-hosted runner on igneum-build-1 from this Mac.
|
|
# infra/build-server/runner/register.sh fetch a registration token with gh, run provision.sh on the box with it
|
|
# infra/build-server/runner/register.sh --status list the repository's runners (name, status, labels) and the box's unit
|
|
# infra/build-server/runner/register.sh --host <ip> another box (7 October 2026, igneum-build-2): the same, against that ip;
|
|
# BOX_HOSTNAME, RUNNER_NAME, RUNNER_LABELS, RUNNER_CPUS and RUNNER_JOBS
|
|
# from this shell's environment travel with it (provision.sh would
|
|
# otherwise rename the box igneum-build-1), e.g.
|
|
# BOX_HOSTNAME=igneum-build-2 RUNNER_LABELS=igneum-build-1,igneum-build-2 RUNNER_CPUS=0-31 RUNNER_JOBS=32 \
|
|
# infra/build-server/runner/register.sh --host 142.132.249.238
|
|
#
|
|
# The token: `gh api -X POST repos/igneum-network/igneum/actions/runners/registration-token` as igneum-labs (the CLAUDE.md gh
|
|
# rule: that account must be ACTIVE; any other active account fails here before anything is fetched). It is a one-hour
|
|
# registration token, not a credential the runner keeps (config.sh writes its own into /opt/actions-runner/.credentials,
|
|
# owner runner, mode 600). It travels to the box on ssh stdin as the first line, followed by provision.sh itself; it is
|
|
# never an argument of ssh, never written to a file on the Mac, and provision.sh never logs it. The whole of provision.sh
|
|
# runs (idempotent, every other step says ok), so the box is also brought up to date.
|
|
set -euo pipefail
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_SLUG="${IGNEUM_GH_REPO:-igneum-network/igneum}"
|
|
KEY="${IGNEUM_BUILD_KEY:-$HOME/.ssh/igneum_ed25519}"
|
|
HOST_LINE="$(head -1 "${IGNEUM_BUILD_HOST_FILE:-$HOME/.config/igneum/build-server}" | tr -d '[:space:]')"
|
|
IP="${HOST_LINE#*@}"
|
|
if [ "${1:-}" = --host ]; then
|
|
IP="${2:-}"; [ -n "$IP" ] || { echo "--host needs an ip" >&2; exit 1; }; shift 2
|
|
[ -n "${BOX_HOSTNAME:-}" ] || { echo "--host: set BOX_HOSTNAME (provision.sh would otherwise rename the box igneum-build-1)" >&2; exit 1; }
|
|
fi
|
|
[ -n "$IP" ] || { echo "no build server in ~/.config/igneum/build-server (infra/build-server/run-from-mac.sh writes it)" >&2; exit 1; }
|
|
# the provisioning variables a second box needs, forwarded as assignments in front of the remote shell (values are plain
|
|
# words: a hostname, a label list, a cpu range, a number; anything else is refused)
|
|
FWD=""
|
|
for v in BOX_HOSTNAME RUNNER_NAME RUNNER_LABELS RUNNER_CPUS RUNNER_JOBS; do
|
|
val="${!v:-}"; [ -n "$val" ] || continue
|
|
printf '%s' "$val" | grep -qE '^[A-Za-z0-9,._-]+$' || { echo "$v='$val' is not a plain word" >&2; exit 1; }
|
|
FWD="$FWD $v=$val"
|
|
done
|
|
SSH=(ssh -i "$KEY" -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 "root@$IP")
|
|
|
|
gh_josh() {
|
|
local active
|
|
active=$(gh auth status 2>/dev/null | awk '/Logged in to github.com account/ { acct=$7 } /Active account: true/ { print acct; exit }')
|
|
if [ "$active" != igneum-labs ]; then
|
|
gh auth switch --user igneum-labs >/dev/null 2>&1 || { echo "gh: cannot switch to igneum-labs (gh auth status: ${active:-no active account})" >&2; exit 1; }
|
|
fi
|
|
[ "$(gh api user --jq .login 2>/dev/null)" = igneum-labs ] || { echo "gh: the active token is not the igneum-labs login (stored as igneum-labs); refusing" >&2; exit 1; }
|
|
}
|
|
|
|
if [ "${1:-}" = --status ]; then
|
|
gh_josh
|
|
gh api "repos/$REPO_SLUG/actions/runners" --jq '.runners[] | "\(.name)\t\(.status)\tbusy=\(.busy)\t\(([.labels[].name]) | join(","))"' || echo "(no runners or no access)"
|
|
"${SSH[@]}" 'systemctl list-units --type=service --no-legend "actions.runner.*" ; ls -la /opt/actions-runner/.runner 2>/dev/null || echo "not registered on the box"'
|
|
exit 0
|
|
fi
|
|
|
|
gh_josh
|
|
echo "fetching a registration token for $REPO_SLUG as igneum-labs (igneum-labs) ..."
|
|
TOKEN=$(gh api -X POST "repos/$REPO_SLUG/actions/runners/registration-token" --jq .token 2>/dev/null) || { echo "gh refused the registration token: the account needs admin on $REPO_SLUG (gh api repos/$REPO_SLUG --jq .permissions)" >&2; exit 1; }
|
|
[ -n "$TOKEN" ] || { echo "empty token from gh" >&2; exit 1; }
|
|
echo "token received (not shown); running provision.sh on root@$IP with it (first line of stdin, then the script)"
|
|
# the first stdin line is the token, read by the remote shell before bash -s takes the rest as the script; the output is
|
|
# kept in a temp file so the ssh exit code is read (a filter in the pipe would hide it) and any line carrying the token is
|
|
# dropped before it is shown (provision.sh never prints it; this is the belt)
|
|
OUT=$(mktemp); trap 'rm -f "$OUT"' EXIT
|
|
set +e
|
|
{ printf '%s\n' "$TOKEN"; cat "$HERE/../provision.sh"; } | "${SSH[@]}" "IFS= read -r RUNNER_TOKEN; export RUNNER_TOKEN; MODE=provision$FWD bash -s" > "$OUT" 2>&1
|
|
RC=$?
|
|
set -e
|
|
grep -v -F "$TOKEN" "$OUT" || true
|
|
unset TOKEN
|
|
[ "$RC" = 0 ] || { echo "provision.sh exited $RC on the box" >&2; exit "$RC"; }
|
|
echo "runners now registered on $REPO_SLUG:"
|
|
gh api "repos/$REPO_SLUG/actions/runners" --jq '.runners[] | " \(.name)\t\(.status)\t\(([.labels[].name]) | join(","))"'
|