Repository navigation
fix(ci): isolation drill removes its probe containers, registry-sync runs on served-projection pushes (D-1481 D-1480) - #487
Merged
Merged
Conversation
added 2 commits
October 26, 2026 06:13
…s (D-1481) scenario-01-local-only refuses to cut the network while a container runs; a nself-ci-probe-* container left by the gVisor leg of the drill before it made the nightly red. The drill now removes, on exit, the probe containers (label nself.ci.probe=1) that were not there when it started.
…ojection (D-1480) The served bundles.members lagged main after a bundle membership change until the daily run. Also trigger on catalog.json, registry.json and counts.json changes on main; the daily schedule and the secret are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
D-1481: scenario-01 refuses to cut the network while a probe container is up
Failing run 40296379989:
containers are running (... nself-ci-probe-921147ce8a3f-px Up 2 minutes). The drills run in name order, sodrill-isolation-levels(its gVisor leg starts the engine'snself-ci-probe-*container, labellednself.ci.probe=1) runs beforedrill-scenario-01-local-only.cut_preflightalready waits 60 s for such a container; this one outlived that wait.Fix: the isolation-levels drill removes, in its EXIT trap, the probe containers that were not there when it started. I picked this over having scenario-01 stop
nself-ci-probe-*containers because it is the narrower change: it cleans up after the drill that leaked, and touches only containers that drill's run created (the same before/after rule scenario-01 already uses fornselfci-). Making scenario-01 kill containers it did not start would also hit unrelated containers on a developer machine, and it would hide any other drill that leaks.Test:
scripts/drill/isolation-levels/selftest.shcase 10 (fake docker holds a pre-existing probe, the fakegoleaves a new one). It fails on the oldrun("the probe left by the legs was not removed") and passes now.D-1480: served bundles.members lags main after a bundle membership change
registry-sync.ymlnow also runs on a push tomainthat touchescatalog.json(the.bundlesthe drill compares),registry.jsonorcounts.json. The daily schedule andworkflow_dispatchare unchanged, and no secret is added (still onlyCLOUDFLARE_WORKER_SYNC_TOKEN, which the daily run already uses).Test:
scripts/ci/tests/test_registry_sync_triggers.py(stdlib only; picked up by the existingunittest discoverin hygiene) checks the schedule is kept, the push paths, and that no other secret appears. It fails on the old workflow and passes now.Not verified here: the worker fetching fresh content right after the push (no production access from here); the first merge that touches a projection will show it.
Commands run
bash scripts/drill/isolation-levels/selftest.sh: all ok (10 cases); with the oldrun, case 10 failspython3 -m unittest scripts.ci.tests.test_registry_sync_triggers -v: 3 ok; with the old workflow, 1 failspython3 -m unittest discover -s scripts/ci/tests: 86 tests, 13 failures, all intest_verify_published_checksums.py(--signatures needs --published-sha256), a file this PR does not touchshellcheckis not installed here, so the shell edit was not linted