2026-10-16T19:04:49.820Z Diffinery runner: job live (Containers, registry, sandboxes, webhooks, schedules, LFS and pull requests) for codician/diffinery@0e2e03317c49
2026-10-16T19:04:49.886Z Runner: image diffinery-runner:efee6389dfc1b5bd5a743d5e, in lhr19, WEUR, container e3d9589dc09a18d7b1fe634b65845ea1145816fa20aa661f775099846dbf6ed6
2026-10-16T19:04:49.886Z Runner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), this job uses what a smaller runner doesn't have; runs-on: diffinery-large (or -medium, -small, -tiny) sets a size
2026-10-16T19:04:49.886Z Host: AMD EPYC (family 25, model 17), 4 vCPUs, 2550 MHz
2026-10-16T19:04:49.886Z Workspace: /workspace/diffinery
2026-10-16T19:04:49.948Z ##[group]Run if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then
2026-10-16T19:04:49.948Z   # Deploy's gate skips a commit that is no longer main's tip (the newer commit's run deploys it):
2026-10-16T19:04:49.948Z   # then nothing new is live, and this run would only test the site as it was.
2026-10-16T19:04:49.948Z   deployed=$(curl -fsS "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/runs/$DEPLOY_RUN/jobs" -H "Authorization: Bearer $GH_TOKEN" | jq -r '[.jobs[] | select(.name == "Deploy to Cloudflare") | .conclusion][0] // "unknown"' || echo unknown)
2026-10-16T19:04:49.948Z   if [ "$deployed" = skipped ]; then
2026-10-16T19:04:49.948Z     echo "::notice::Deploy deployed nothing for $HEAD_SHA (main has moved on), so there is nothing new to test"
2026-10-16T19:04:49.948Z     echo "skip=true" >> "$GITHUB_OUTPUT"
2026-10-16T19:04:49.948Z     exit 0
2026-10-16T19:04:49.949Z   fi
2026-10-16T19:04:49.949Z fi
2026-10-16T19:04:49.949Z if [ -z "$TOKEN" ]; then
2026-10-16T19:04:49.949Z   # After a deploy of diffinery.com a missing token is an error: a green run would mean nothing was tested.
2026-10-16T19:04:49.949Z   if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then
2026-10-16T19:04:49.949Z     echo "::error::DIFFINERY_LIVE_TOKEN is not set in the production environment, so nothing was tested. Create a write token at $DIFFINERY/settings/tokens and save it as a production environment secret."
2026-10-16T19:04:49.949Z     exit 1
2026-10-16T19:04:49.949Z   fi
2026-10-16T19:04:49.949Z   echo "::warning::DIFFINERY_LIVE_TOKEN is not set, so the live test is skipped. Create a write token at $DIFFINERY/settings/tokens and save it as a production environment secret."
2026-10-16T19:04:49.949Z   echo "skip=true" >> "$GITHUB_OUTPUT"
2026-10-16T19:04:49.949Z   exit 0
2026-10-16T19:04:49.949Z fi
2026-10-16T19:04:49.949Z login=$(curl -fsS "$DIFFINERY/api/v3/user" -H "Authorization: Bearer $TOKEN" | jq -r .login)
2026-10-16T19:04:49.949Z echo "OWNER=$login" >> "$GITHUB_ENV"
2026-10-16T19:04:49.949Z echo "testing as $login in $login/$REPO"
2026-10-16T19:04:49.949Z env:
2026-10-16T19:04:49.949Z   GH_TOKEN: ***
2026-10-16T19:04:49.949Z   DEPLOY_RUN: 489
2026-10-16T19:04:49.949Z ##[endgroup]
2026-10-16T19:04:51.198Z testing as cnbrkdmrci in cnbrkdmrci/live-492-1
2026-10-16T19:04:51.289Z ##[group]Run set -euo pipefail
2026-10-16T19:04:51.289Z # Layers over Cloudflare's 100 MB request limit (which hosted runners push through
2026-10-16T19:04:51.289Z # the registry relay) take minutes to push and pull. They're pushed on manual runs and
2026-10-16T19:04:51.289Z # whenever the registry, the runner image or this test changed since the last
2026-10-16T19:04:51.289Z # successful live test; other deploys push small images through the same path.
2026-10-16T19:04:51.289Z full=true
2026-10-16T19:04:51.289Z if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then
2026-10-16T19:04:51.289Z   api() { curl -fsS "$DIFFINERY/api/v3/repos/$GITHUB_REPOSITORY$1" -H "Authorization: Bearer $TOKEN"; }
2026-10-16T19:04:51.289Z   last=$(api "/actions/runs?workflow=live-test.yml&status=success&per_page=1" | jq -r '.workflow_runs[0].head_sha // empty' || true)
2026-10-16T19:04:51.289Z   if [ -n "$last" ] && files=$(api "/compare/$last...$HEAD_SHA" | jq -r '.files[].filename'); then
2026-10-16T19:04:51.289Z     grep -qE '^(apps/diffinery/src/registry/|containers/runner/|\.github/workflows/live-test\.yml$)' <<<"$files" || full=false
2026-10-16T19:04:51.289Z     echo "changed since $last: $(wc -l <<<"$files") files"
2026-10-16T19:04:51.289Z   fi
2026-10-16T19:04:51.289Z fi
2026-10-16T19:04:51.289Z if [ "$full" = true ]; then
2026-10-16T19:04:51.289Z   echo "BIG=150000000" >> "$GITHUB_ENV"
2026-10-16T19:04:51.289Z   echo "BUILDX=120000000" >> "$GITHUB_ENV"
2026-10-16T19:04:51.289Z else
2026-10-16T19:04:51.289Z   echo "BIG=5000000" >> "$GITHUB_ENV"
2026-10-16T19:04:51.289Z   echo "BUILDX=4000000" >> "$GITHUB_ENV"
2026-10-16T19:04:51.289Z fi
2026-10-16T19:04:51.289Z echo "registry check: full=$full"
2026-10-16T19:04:51.289Z ##[endgroup]
2026-10-16T19:04:52.324Z changed since 4798de7b2e20f76f4cf5e2564dcf6ef1f68c7797: 4 files
2026-10-16T19:04:52.324Z registry check: full=false
2026-10-16T19:04:52.406Z ##[group]Run set -euo pipefail
2026-10-16T19:04:52.406Z av="$DIFFINERY/api/avatars/$OWNER"
2026-10-16T19:04:52.406Z # Keep the account's current picture, if it has one, to put it back afterwards.
2026-10-16T19:04:52.406Z had=$(curl -fsS -o before.webp -w '%{content_type}' "$av?s=256&v=1")
2026-10-16T19:04:52.406Z restore() {
2026-10-16T19:04:52.406Z   if [ "$had" = image/webp ]; then
2026-10-16T19:04:52.406Z     curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/webp" --data-binary @before.webp | jq -r '"restored the previous picture: \(.avatar_url)"'
2026-10-16T19:04:52.406Z   else
2026-10-16T19:04:52.406Z     curl -fsS -o /dev/null -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN"
2026-10-16T19:04:52.406Z   fi
2026-10-16T19:04:52.406Z }
2026-10-16T19:04:52.406Z trap restore EXIT
2026-10-16T19:04:52.406Z # A 600×400 PNG gradient; the server crops it to a square and makes small WebPs.
2026-10-16T19:04:52.406Z python3 - <<'EOF'
2026-10-16T19:04:52.406Z import struct, zlib
2026-10-16T19:04:52.406Z w, h = 600, 400
2026-10-16T19:04:52.406Z rows = b"".join(b"\0" + bytes(c for x in range(w) for c in (x * 255 // w, y * 255 // h, 128)) for y in range(h))
2026-10-16T19:04:52.406Z chunk = lambda t, d: struct.pack(">I", len(d)) + t + d + struct.pack(">I", zlib.crc32(t + d))
2026-10-16T19:04:52.406Z open("avatar.png", "wb").write(b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0)) + chunk(b"IDAT", zlib.compress(rows)) + chunk(b"IEND", b""))
2026-10-16T19:04:52.406Z EOF
2026-10-16T19:04:52.406Z url=$(curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/png" --data-binary @avatar.png | jq -r .avatar_url)
2026-10-16T19:04:52.406Z echo "uploaded: $url"
2026-10-16T19:04:52.406Z v=${url##*v=}
2026-10-16T19:04:52.406Z type=$(curl -fsS -o small.webp -w '%{content_type}' "$av?s=64&v=$v")
2026-10-16T19:04:52.406Z [ "$type" = image/webp ] || { echo "::error::expected image/webp, got $type"; exit 1; }
2026-10-16T19:04:52.406Z python3 - <<'EOF'
2026-10-16T19:04:52.406Z import struct, sys
2026-10-16T19:04:52.406Z b = open("small.webp", "rb").read()
2026-10-16T19:04:52.406Z ok = b[:4] == b"RIFF" and b[8:12] == b"WEBP"
2026-10-16T19:04:52.406Z if b[12:16] == b"VP8 ":
2026-10-16T19:04:52.406Z     size = (struct.unpack("<H", b[26:28])[0] & 0x3FFF, struct.unpack("<H", b[28:30])[0] & 0x3FFF)
2026-10-16T19:04:52.406Z elif b[12:16] == b"VP8X":
2026-10-16T19:04:52.406Z     size = (int.from_bytes(b[24:27], "little") + 1, int.from_bytes(b[27:30], "little") + 1)
2026-10-16T19:04:52.406Z else:
2026-10-16T19:04:52.406Z     size = None
2026-10-16T19:04:52.406Z print(f"64 px avatar: {len(b)} bytes, {size}")
2026-10-16T19:04:52.406Z if not ok or size != (64, 64) or len(b) > 5000:
2026-10-16T19:04:52.406Z     print("::error::the 64 px avatar is not a 64x64 WebP under 5 KB"); sys.exit(1)
2026-10-16T19:04:52.406Z EOF
2026-10-16T19:04:52.406Z curl -fsS -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" >/dev/null
2026-10-16T19:04:52.406Z # A `v` that is not current bypasses the edge cache, so this sees the removal from any colo.
2026-10-16T19:04:52.406Z type=$(curl -fsS -o /dev/null -w '%{content_type}' "$av?s=64&v=1")
2026-10-16T19:04:52.406Z [[ "$type" == image/svg+xml* ]] || { echo "::error::after removal expected the initials SVG, got $type"; exit 1; }
2026-10-16T19:04:52.406Z echo "removed: initials again ($type)"
2026-10-16T19:04:52.406Z ##[endgroup]
2026-10-16T19:04:54.164Z uploaded: https://diffinery.com/api/avatars/cnbrkdmrci?v=1792177493
2026-10-16T19:04:54.494Z 64 px avatar: 256 bytes, (64, 64)
2026-10-16T19:04:55.306Z removed: initials again (image/svg+xml; charset=utf-8)
2026-10-16T19:04:58.652Z restored the previous picture: https://diffinery.com/api/avatars/cnbrkdmrci?v=1792177495
2026-10-16T19:04:59.315Z ##[group]Run set -euo pipefail
2026-10-16T19:04:59.315Z check() { # path, content type, text it must contain
2026-10-16T19:04:59.315Z   body=$(curl -fsS -D /tmp/h "$DIFFINERY$1")
2026-10-16T19:04:59.315Z   grep -qi "content-type: $2" /tmp/h || { echo "::error::$1 is not $2"; exit 1; }
2026-10-16T19:04:59.315Z   grep -qF -- "$3" <<<"$body" || { echo "::error::$1 doesn't contain: $3"; exit 1; }
2026-10-16T19:04:59.315Z   echo "$1 ok ($(wc -c <<<"$body") bytes)"
2026-10-16T19:04:59.315Z }
2026-10-16T19:04:59.315Z check /docs "text/html" "Overview"
2026-10-16T19:04:59.315Z check /docs/actions/workflow-syntax "text/html" "View as Markdown"
2026-10-16T19:04:59.315Z check /docs/quickstart.md "text/markdown" "# Quickstart"
2026-10-16T19:04:59.315Z check /llms.txt "text/plain" "/docs/actions/workflow-syntax.md"
2026-10-16T19:04:59.315Z check /llms-full.txt "text/plain" "# REST API reference"
2026-10-16T19:04:59.315Z check /docs/api/openapi.json "application/json" '"openapi": "3.1.0"'
2026-10-16T19:04:59.315Z check /-/cli/diffinery.mjs "text/javascript" "#!/usr/bin/env node"
2026-10-16T19:04:59.315Z md=$(curl -fsS -H "Accept: text/markdown" "$DIFFINERY/docs/agents/mcp")
2026-10-16T19:04:59.315Z grep -q "^# MCP" <<<"$md" || { echo "::error::Accept: text/markdown didn't return Markdown"; exit 1; }
2026-10-16T19:04:59.315Z curl -fsS "$DIFFINERY/-/cli/diffinery.mjs" -o /tmp/diffinery.mjs && node /tmp/diffinery.mjs --version
2026-10-16T19:04:59.315Z ##[endgroup]
2026-10-16T19:04:59.410Z /docs ok (88061 bytes)
2026-10-16T19:04:59.653Z /docs/actions/workflow-syntax ok (173791 bytes)
2026-10-16T19:04:59.725Z /docs/quickstart.md ok (16622 bytes)
2026-10-16T19:04:59.828Z /llms.txt ok (18154 bytes)
2026-10-16T19:05:00.054Z /llms-full.txt ok (2426647 bytes)
2026-10-16T19:05:00.562Z /docs/api/openapi.json ok (812266 bytes)
2026-10-16T19:05:00.630Z /-/cli/diffinery.mjs ok (240403 bytes)
2026-10-16T19:05:00.816Z diffinery 0.1.0
2026-10-16T19:05:00.920Z ##[group]Run set -euo pipefail
2026-10-16T19:05:00.920Z s=$(curl -sS -w '\n%{http_code}' "$DIFFINERY/api/v3/diffinery/admin/email" -H "Authorization: Bearer $TOKEN")
2026-10-16T19:05:00.920Z code=${s##*$'\n'}; s=${s%$'\n'*}
2026-10-16T19:05:00.921Z # Only a site administrator's token reads the email settings, and the live-test account isn't one.
2026-10-16T19:05:00.921Z if [ "$code" = 403 ]; then echo "::notice::skipped: the live-test token isn't a site administrator's"; exit 0; fi
2026-10-16T19:05:00.921Z [ "$code" = 200 ] || { echo "::error::/diffinery/admin/email answered $code"; exit 1; }
2026-10-16T19:05:00.921Z echo "$s" | jq '{sending, queue, from, last_24h}'
2026-10-16T19:05:00.921Z [ "$(jq -r .sending <<<"$s")" = true ] || { echo "::error::the Worker has no Email Sending binding"; exit 1; }
2026-10-16T19:05:00.921Z [ "$(jq -r .queue <<<"$s")" = true ] || { echo "::error::the Worker has no mail queue binding"; exit 1; }
2026-10-16T19:05:00.921Z failed=$(jq -r .last_24h.failed <<<"$s")
2026-10-16T19:05:00.921Z [ "$failed" = 0 ] || echo "::warning::$failed emails failed in the last 24 hours; see Settings -> Email in site administration"
2026-10-16T19:05:00.921Z ##[endgroup]
2026-10-16T19:05:01.200Z {
2026-10-16T19:05:01.200Z   "sending": true,
2026-10-16T19:05:01.200Z   "queue": true,
2026-10-16T19:05:01.200Z   "from": "notifications@diffinery.com",
2026-10-16T19:05:01.200Z   "last_24h": {
2026-10-16T19:05:01.200Z     "sent": 42,
2026-10-16T19:05:01.200Z     "failed": 0,
2026-10-16T19:05:01.200Z     "skipped": 0
2026-10-16T19:05:01.200Z   }
2026-10-16T19:05:01.200Z }
2026-10-16T19:05:01.302Z ##[group]Run set -euo pipefail
2026-10-16T19:05:01.302Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T19:05:01.302Z api POST /user/repos "{\"name\":\"$REPO\",\"private\":true}" >/dev/null
2026-10-16T19:05:01.302Z # Webhooks may only reach public hosts other than Diffinery itself; the push's delivery goes to example.com.
2026-10-16T19:05:01.302Z code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST "$DIFFINERY/api/v3/repos/$OWNER/$REPO/hooks" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data "{\"config\":{\"url\":\"$DIFFINERY/healthz\"},\"events\":[\"push\"]}")
2026-10-16T19:05:01.302Z [ "$code" = 422 ] || { echo "::error::a webhook to Diffinery itself answered $code, not 422"; exit 1; }
2026-10-16T19:05:01.302Z api POST "/repos/$OWNER/$REPO/hooks" "{\"config\":{\"url\":\"https://example.com/diffinery-live-test\"},\"events\":[\"push\"]}" >/dev/null
2026-10-16T19:05:01.302Z echo "created $OWNER/$REPO"
2026-10-16T19:05:01.302Z ##[endgroup]
2026-10-16T19:05:03.343Z created cnbrkdmrci/live-492-1
2026-10-16T19:05:04.101Z ##[group]Run set -euo pipefail
2026-10-16T19:05:04.101Z # A deploy's container rollout updates instances over a while after it starts, and an
2026-10-16T19:05:04.101Z # instance not yet updated starts jobs on the previous runner image. Jobs report their
2026-10-16T19:05:04.101Z # image (`runner.image`), so a probe workflow runs until three jobs in a row land on the
2026-10-16T19:05:04.101Z # image the deploy set (/meta's runner_image) before the Docker and registry checks.
2026-10-16T19:05:04.101Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T19:05:04.101Z expected=$(api GET /meta | jq -r '.runner_image // empty')
2026-10-16T19:05:04.101Z if [ -z "$expected" ]; then
2026-10-16T19:05:04.101Z   echo "::warning::/meta doesn't name the deployed runner image, so jobs aren't checked against it"
2026-10-16T19:05:04.101Z   exit 0
2026-10-16T19:05:04.101Z fi
2026-10-16T19:05:04.101Z echo "DEPLOYED_RUNNER_IMAGE=$expected" >> "$GITHUB_ENV"
2026-10-16T19:05:04.101Z mkdir -p src/.github/workflows && cd src
2026-10-16T19:05:04.101Z git init -q -b main
2026-10-16T19:05:04.101Z git config user.name "Live test" && git config user.email "live-test@diffinery.com"
2026-10-16T19:05:04.101Z cat > .github/workflows/probe.yml <<'EOF'
2026-10-16T19:05:04.101Z on: workflow_dispatch
2026-10-16T19:05:04.101Z jobs:
2026-10-16T19:05:04.101Z   probe:
2026-10-16T19:05:04.101Z     runs-on: ubuntu-latest
2026-10-16T19:05:04.101Z     strategy:
2026-10-16T19:05:04.101Z       matrix:
2026-10-16T19:05:04.101Z         n: [1, 2, 3]
2026-10-16T19:05:04.101Z     steps:
2026-10-16T19:05:04.101Z       - run: echo "probe ok"
2026-10-16T19:05:04.101Z EOF
2026-10-16T19:05:04.101Z git add -A && git commit -q -m "Runner image probe"
2026-10-16T19:05:04.101Z git push -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" main
2026-10-16T19:05:04.101Z deadline=$(( $(date +%s) + 15 * 60 ))
2026-10-16T19:05:04.101Z while :; do
2026-10-16T19:05:04.101Z   before=$(api GET "/repos/$OWNER/$REPO/actions/runs?event=workflow_dispatch" | jq '.workflow_runs | length')
2026-10-16T19:05:04.101Z   api POST "/repos/$OWNER/$REPO/actions/workflows/probe.yml/dispatches" '{"ref":"main"}' >/dev/null
2026-10-16T19:05:04.101Z   run=""
2026-10-16T19:05:04.101Z   # Up to 10 minutes: a job turned away from a replaced image starts again after 30 s, 1, 2 and 4 minutes.
2026-10-16T19:05:04.101Z   for i in $(seq 1 120); do
2026-10-16T19:05:04.101Z     runs=$(api GET "/repos/$OWNER/$REPO/actions/runs?event=workflow_dispatch")
2026-10-16T19:05:04.101Z     if [ "$(jq '.workflow_runs | length' <<<"$runs")" -gt "$before" ]; then
2026-10-16T19:05:04.101Z       run=$(jq -c '.workflow_runs[0]' <<<"$runs")
2026-10-16T19:05:04.101Z       [ "$(jq -r .status <<<"$run")" = completed ] && break
2026-10-16T19:05:04.101Z     fi
2026-10-16T19:05:04.101Z     sleep 5
2026-10-16T19:05:04.101Z   done
2026-10-16T19:05:04.101Z   [ -n "$run" ] || { echo "::error::the probe workflow didn't start"; exit 1; }
2026-10-16T19:05:04.101Z   probe=$(api GET "/repos/$OWNER/$REPO/actions/runs/$(jq -r .id <<<"$run")/jobs")
2026-10-16T19:05:04.101Z   images=$(jq -r '.jobs[] | .runner.image // "no image reported"' <<<"$probe")
2026-10-16T19:05:04.101Z   echo "probe jobs ran on: $(sort <<<"$images" | uniq -c | sed 's/^ *//' | paste -sd ','), started again $(jq '[.jobs[].placementTries // 0] | add // 0' <<<"$probe") time(s) in all"
2026-10-16T19:05:04.101Z   [ "$(grep -cxF "$expected" <<<"$images" || true)" = 3 ] && { echo "jobs start on $expected"; exit 0; }
2026-10-16T19:05:04.101Z   if [ "$(date +%s)" -ge "$deadline" ]; then
2026-10-16T19:05:04.101Z     echo "::error::15 minutes after the deploy, jobs still start on a runner image other than the deployed $expected"
2026-10-16T19:05:04.101Z     exit 1
2026-10-16T19:05:04.101Z   fi
2026-10-16T19:05:04.101Z   sleep 20
2026-10-16T19:05:04.101Z done
2026-10-16T19:05:04.101Z ##[endgroup]
2026-10-16T19:05:14.236Z probe jobs ran on: 3 diffinery-runner:efee6389dfc1b5bd5a743d5e, started again 0 time(s) in all
2026-10-16T19:05:14.238Z jobs start on diffinery-runner:efee6389dfc1b5bd5a743d5e
2026-10-16T19:05:14.534Z ##[group]Run set -euo pipefail
2026-10-16T19:05:14.534Z mkdir -p src/.github/workflows && cd src
2026-10-16T19:05:14.534Z git init -q -b main
2026-10-16T19:05:14.534Z git config user.name "Live test" && git config user.email "live-test@diffinery.com"
2026-10-16T19:05:14.534Z git lfs install --local >/dev/null
2026-10-16T19:05:14.534Z git lfs track "*.bin" >/dev/null
2026-10-16T19:05:14.534Z head -c 3145728 /dev/urandom > blob.bin
2026-10-16T19:05:14.534Z sha256sum blob.bin | cut -d' ' -f1 > ../blob.sha
2026-10-16T19:05:14.534Z echo "# $REPO" > README.md
2026-10-16T19:05:14.534Z cat > .github/workflows/ci.yml <<'EOF'
2026-10-16T19:05:14.534Z on: push
2026-10-16T19:05:14.534Z jobs:
2026-10-16T19:05:14.534Z   hosted:
2026-10-16T19:05:14.534Z     runs-on: ubuntu-latest
2026-10-16T19:05:14.534Z     strategy:
2026-10-16T19:05:14.534Z       matrix:
2026-10-16T19:05:14.534Z         n: [1, 2]
2026-10-16T19:05:14.534Z     steps:
2026-10-16T19:05:14.534Z       - uses: actions/checkout@v4
2026-10-16T19:05:14.534Z       - run: echo "live ok ${{ matrix.n }} $(cat README.md)"
2026-10-16T19:05:14.534Z       # Passwordless sudo, as on GitHub's runners (`sudo apt-get install ...` is common).
2026-10-16T19:05:14.534Z       - run: sudo -n true && echo "sudo ok $(sudo -n id -u)"
2026-10-16T19:05:14.534Z   docker:
2026-10-16T19:05:14.534Z     runs-on: ubuntu-latest
2026-10-16T19:05:14.534Z     services:
2026-10-16T19:05:14.534Z       cache:
2026-10-16T19:05:14.534Z         image: redis:7-alpine
2026-10-16T19:05:14.534Z         ports: ["6379"]
2026-10-16T19:05:14.534Z         options: --health-cmd "redis-cli ping" --health-interval 1s --health-retries 30
2026-10-16T19:05:14.534Z     steps:
2026-10-16T19:05:14.534Z       - run: |
2026-10-16T19:05:14.534Z           printf 'FROM alpine:3.20\nRUN echo built > /msg\nCMD ["cat", "/msg"]\n' > Dockerfile
2026-10-16T19:05:14.534Z           docker build -q -t live-image .
2026-10-16T19:05:14.534Z           echo "docker ok $(docker run --rm live-image)"
2026-10-16T19:05:14.534Z           exec 3<>/dev/tcp/127.0.0.1/${{ job.services.cache.ports['6379'] }}
2026-10-16T19:05:14.534Z           printf 'PING\r\n' >&3
2026-10-16T19:05:14.534Z           read -r line <&3
2026-10-16T19:05:14.534Z           echo "service ok ${line%$'\r'}"
2026-10-16T19:05:14.534Z   # Container registry: a layer pushed with the job's GITHUB_TOKEN (over Cloudflare's
2026-10-16T19:05:14.534Z   # 100 MB request limit on full runs), plus the docker/*-action route most ghcr.io
2026-10-16T19:05:14.534Z   # workflows use. __BIG__ and __BUILDX__ are the layer sizes.
2026-10-16T19:05:14.534Z   publish:
2026-10-16T19:05:14.534Z     runs-on: ubuntu-latest
2026-10-16T19:05:14.534Z     permissions:
2026-10-16T19:05:14.534Z       packages: write
2026-10-16T19:05:14.534Z     steps:
2026-10-16T19:05:14.534Z       - run: |
2026-10-16T19:05:14.534Z           image="diffinery.com/${GITHUB_REPOSITORY,,}"
2026-10-16T19:05:14.534Z           echo "${{ secrets.GITHUB_TOKEN }}" | docker login diffinery.com -u "${{ github.actor }}" --password-stdin
2026-10-16T19:05:14.534Z           head -c __BIG__ /dev/urandom > big.bin
2026-10-16T19:05:14.534Z           sha256sum big.bin | cut -d' ' -f1 > big.sha
2026-10-16T19:05:14.534Z           printf 'FROM scratch\nCOPY big.bin big.sha /\n' > Dockerfile
2026-10-16T19:05:14.534Z           docker build -q -t "$image:live" .
2026-10-16T19:05:14.534Z           docker push "$image:live"
2026-10-16T19:05:14.534Z           echo "pushed $(cat big.sha)"
2026-10-16T19:05:14.534Z   buildx:
2026-10-16T19:05:14.534Z     runs-on: ubuntu-latest
2026-10-16T19:05:14.534Z     permissions:
2026-10-16T19:05:14.534Z       packages: write
2026-10-16T19:05:14.534Z     steps:
2026-10-16T19:05:14.534Z       - run: |
2026-10-16T19:05:14.534Z           echo "IMAGE=diffinery.com/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
2026-10-16T19:05:14.534Z           head -c __BUILDX__ /dev/urandom > big.bin
2026-10-16T19:05:14.534Z           printf 'FROM scratch\nCOPY big.bin /\n' > Dockerfile
2026-10-16T19:05:14.534Z       - uses: docker/setup-buildx-action@v3
2026-10-16T19:05:14.534Z       - uses: docker/login-action@v3
2026-10-16T19:05:14.534Z         with:
2026-10-16T19:05:14.534Z           registry: diffinery.com
2026-10-16T19:05:14.534Z           username: ${{ github.actor }}
2026-10-16T19:05:14.534Z           password: ${{ secrets.GITHUB_TOKEN }}
2026-10-16T19:05:14.534Z       - uses: docker/build-push-action@v6
2026-10-16T19:05:14.534Z         with:
2026-10-16T19:05:14.534Z           context: .
2026-10-16T19:05:14.534Z           push: true
2026-10-16T19:05:14.534Z           tags: ${{ env.IMAGE }}:buildx
2026-10-16T19:05:14.534Z   pull:
2026-10-16T19:05:14.534Z     needs: [publish, buildx]
2026-10-16T19:05:14.534Z     runs-on: ubuntu-latest
2026-10-16T19:05:14.534Z     permissions:
2026-10-16T19:05:14.534Z       packages: read
2026-10-16T19:05:14.535Z     steps:
2026-10-16T19:05:14.535Z       - run: |
2026-10-16T19:05:14.535Z           image="diffinery.com/${GITHUB_REPOSITORY,,}"
2026-10-16T19:05:14.535Z           echo "${{ secrets.GITHUB_TOKEN }}" | docker login diffinery.com -u "${{ github.actor }}" --password-stdin
2026-10-16T19:05:14.535Z           docker pull -q "$image:live"
2026-10-16T19:05:14.535Z           id=$(docker create "$image:live" true)
2026-10-16T19:05:14.535Z           docker cp "$id:/big.bin" big.bin && docker cp "$id:/big.sha" big.sha
2026-10-16T19:05:14.535Z           [ "$(sha256sum big.bin | cut -d' ' -f1)" = "$(cat big.sha)" ] && echo "registry ok $(stat -c %s big.bin) bytes"
2026-10-16T19:05:14.535Z           docker pull -q "$image:buildx"
2026-10-16T19:05:14.535Z           id=$(docker create "$image:buildx" true)
2026-10-16T19:05:14.535Z           docker cp "$id:/big.bin" buildx.bin
2026-10-16T19:05:14.535Z           echo "buildx ok $(stat -c %s buildx.bin) bytes"
2026-10-16T19:05:14.535Z EOF
2026-10-16T19:05:14.535Z cat > .github/workflows/tick.yml <<'EOF'
2026-10-16T19:05:14.535Z on:
2026-10-16T19:05:14.535Z   schedule:
2026-10-16T19:05:14.535Z     - cron: "*/5 * * * *"
2026-10-16T19:05:14.535Z jobs:
2026-10-16T19:05:14.535Z   tick:
2026-10-16T19:05:14.535Z     runs-on: ubuntu-latest
2026-10-16T19:05:14.535Z     steps:
2026-10-16T19:05:14.535Z       - run: echo "scheduled ok"
2026-10-16T19:05:14.535Z EOF
2026-10-16T19:05:14.535Z sed -i "s/__BIG__/$BIG/g; s/__BUILDX__/$BUILDX/g" .github/workflows/ci.yml
2026-10-16T19:05:14.535Z git add -A && git commit -q -m "Live test"
2026-10-16T19:05:14.535Z git push -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" main
2026-10-16T19:05:14.535Z git lfs ls-files
2026-10-16T19:05:14.535Z ##[endgroup]
2026-10-16T19:05:14.544Z warning: re-init: ignored --initial-branch=main
2026-10-16T19:05:17.544Z Uploading LFS objects: 100% (1/1), 3.1 MB | 0 B/s, done.
2026-10-16T19:05:20.077Z 3e6cd103ed * blob.bin
2026-10-16T19:05:20.167Z ##[group]Run set -euo pipefail
2026-10-16T19:05:20.167Z page() { curl -fsS "$DIFFINERY$1" -H "Authorization: Bearer $TOKEN"; }
2026-10-16T19:05:20.167Z has() { grep -qF -- "$2" <<<"$1" || { echo "::error::$3"; exit 1; }; }
2026-10-16T19:05:20.167Z html=$(page "/$OWNER/$REPO/blob/main/.github/workflows/ci.yml")
2026-10-16T19:05:20.167Z has "$html" '<td class="sh">' "the workflow file is not syntax highlighted"
2026-10-16T19:05:20.167Z has "$html" "--shiki-dark" "highlighted code has no dark theme colours"
2026-10-16T19:05:20.167Z has "$html" "@view-transition{navigation:auto}" "pages don't opt in to view transitions"
2026-10-16T19:05:20.167Z has "$html" "prefers-reduced-motion:no-preference" "view transitions ignore reduced motion"
2026-10-16T19:05:20.167Z has "$(page /settings/appearance)" 'name="appearance"' "Settings -> Appearance has no theme choice"
2026-10-16T19:05:20.167Z has "$(page /notifications)" 'href="/settings/notifications"' "the notifications page doesn't link to notification settings"
2026-10-16T19:05:20.167Z code=$(curl -sS -o /tmp/out -w '%{http_code}' -X POST "$DIFFINERY/api/v3/user/repos" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data "{\"name\":\"$REPO-internal\",\"visibility\":\"internal\"}")
2026-10-16T19:05:20.167Z [ "$code" = 422 ] || { echo "::error::visibility internal got $code, expected 422"; curl -sS -o /dev/null -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$REPO-internal" -H "Authorization: Bearer $TOKEN"; exit 1; }
2026-10-16T19:05:20.167Z org=$(page /api/v3/user/orgs | jq -r '.[0].login // empty')
2026-10-16T19:05:20.167Z if [ -n "$org" ]; then
2026-10-16T19:05:20.167Z   perm=$(page "/api/v3/orgs/$org" | jq -r '.default_repository_permission // empty')
2026-10-16T19:05:20.167Z   case "$perm" in none|read|write|admin) echo "$org's base permission: $perm" ;; *) echo "::error::GET /orgs/$org has no default_repository_permission"; exit 1 ;; esac
2026-10-16T19:05:20.167Z   # A malformed rename is refused before anything is written (422 for owners, 403 for everyone else).
2026-10-16T19:05:20.167Z   code=$(curl -sS -o /tmp/out -w '%{http_code}' -X PATCH "$DIFFINERY/api/v3/orgs/$org" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"name":123}')
2026-10-16T19:05:20.167Z   case "$code" in 422|403) ;; *) echo "::error::PATCH /orgs/$org with a numeric name got $code"; cat /tmp/out; exit 1 ;; esac
2026-10-16T19:05:20.167Z fi
2026-10-16T19:05:20.167Z page "/api/v3/repos/$OWNER/$REPO/invitations" | jq -e 'type == "array"' >/dev/null || { echo "::error::GET /repos/$OWNER/$REPO/invitations doesn't list pending invitations"; exit 1; }
2026-10-16T19:05:20.167Z tools=$(curl -fsS -X POST "$DIFFINERY/mcp" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" -H "accept: application/json, text/event-stream" --data '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq -r '.result.tools[].name')
2026-10-16T19:05:20.167Z for t in get_organization list_invitations revoke_invitation; do grep -qx "$t" <<<"$tools" || { echo "::error::the MCP server has no $t tool"; exit 1; }; done
2026-10-16T19:05:20.167Z echo "highlighting, Appearance, notification settings link, view transitions, visibility, organization and invitation checks passed"
2026-10-16T19:05:20.167Z ##[endgroup]
2026-10-16T19:05:21.857Z ALCAN's base permission: write
2026-10-16T19:05:23.037Z highlighting, Appearance, notification settings link, view transitions, visibility, organization and invitation checks passed
2026-10-16T19:05:23.121Z ##[group]Run set -euo pipefail
2026-10-16T19:05:23.121Z page() { curl -fsS "$DIFFINERY$1" -H "Authorization: Bearer $TOKEN"; }
2026-10-16T19:05:23.121Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T19:05:23.121Z code() { curl -sS -o /tmp/out -w '%{http_code}' -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T19:05:23.121Z fail() { echo "::error::$1"; cat /tmp/out 2>/dev/null || true; exit 1; }
2026-10-16T19:05:23.121Z has() { grep -qF -- "$2" <<<"$1" || fail "$3"; }
2026-10-16T19:05:23.121Z R="/repos/$OWNER/$REPO"
2026-10-16T19:05:23.121Z has "$(page /new/import)" 'diffy/hello-world' "the importer's placeholder isn't Diffy"
2026-10-16T19:05:23.121Z has "$(page "/$OWNER/$REPO/settings/actions")" 'Allow GitHub Actions to create and approve pull requests' "repository settings have no Actions page"
2026-10-16T19:05:23.121Z # Milestones: created closed, checked before an issue edit is saved, shown in the response, and filterable.
2026-10-16T19:05:23.121Z [ "$(api POST "$R/milestones" '{"title":"Shipped","state":"closed"}' | jq -r .state)" = closed ] || fail "POST milestones ignored state"
2026-10-16T19:05:23.121Z ms=$(api POST "$R/milestones" '{"title":"Live v1"}' | jq -r .number)
2026-10-16T19:05:23.121Z n=$(api POST "$R/issues" '{"title":"Planned"}' | jq -r .number)
2026-10-16T19:05:23.121Z [ "$(code PATCH "$R/issues/$n" '{"title":"Renamed","milestone":999999}')" = 422 ] || fail "an unknown milestone wasn't refused with 422"
2026-10-16T19:05:23.121Z [ "$(api GET "$R/issues/$n" | jq -r .title)" = Planned ] || fail "a refused milestone edit saved the title"
2026-10-16T19:05:23.121Z [ "$(api PATCH "$R/issues/$n" "{\"milestone\":$ms}" | jq -r .milestone.number)" = "$ms" ] || fail "PATCH issue doesn't return the new milestone"
2026-10-16T19:05:23.121Z [ "$(api GET "$R/issues?milestone=$ms&state=all" | jq -r '[.[].number] | join(",")')" = "$n" ] || fail "issues aren't filtered by milestone"
2026-10-16T19:05:23.121Z loc=$(curl -sS -o /dev/null -w '%{redirect_url}' "$DIFFINERY/$OWNER/$REPO/milestone/$ms" -H "Authorization: Bearer $TOKEN")
2026-10-16T19:05:23.121Z has "$loc" "/issues?milestone=$ms" "the milestone link doesn't open its issue list"
2026-10-16T19:05:23.121Z # Repository variable deletes ignore letter case.
2026-10-16T19:05:23.121Z [ "$(code PUT "$R/actions/variables/LIVE_CASE" '{"value":"x"}')" = 204 ] || fail "couldn't set a repository variable"
2026-10-16T19:05:23.121Z [ "$(code DELETE "$R/actions/variables/live_case")" = 204 ] || fail "couldn't delete a repository variable"
2026-10-16T19:05:23.121Z [ "$(code GET "$R/actions/variables/LIVE_CASE")" = 404 ] || fail "deleting a variable in lower case left it in place"
2026-10-16T19:05:23.121Z org=$(page /api/v3/user/orgs | jq -r '.[0].login // empty')
2026-10-16T19:05:23.121Z if [ -n "$org" ]; then
2026-10-16T19:05:23.121Z   # Deleting an organization variable or secret that doesn't exist is a 404 (403 for someone who isn't an admin).
2026-10-16T19:05:23.121Z   for path in variables secrets; do
2026-10-16T19:05:23.121Z     c=$(code DELETE "/orgs/$org/actions/$path/LIVE_NEVER_SET_$GITHUB_RUN_ID")
2026-10-16T19:05:23.121Z     case "$c" in 404|403) ;; *) fail "DELETE of a missing organization $path entry got $c" ;; esac
2026-10-16T19:05:23.121Z   done
2026-10-16T19:05:23.121Z fi
2026-10-16T19:05:23.121Z echo "Diffy placeholders, Actions settings page, milestone and variable checks passed"
2026-10-16T19:05:23.121Z ##[endgroup]
2026-10-16T19:05:29.142Z Diffy placeholders, Actions settings page, milestone and variable checks passed
2026-10-16T19:05:29.242Z ##[group]Run set -euo pipefail
2026-10-16T19:05:29.242Z api() { curl -fsS "$DIFFINERY/api/v3$1" -H "Authorization: Bearer $TOKEN"; }
2026-10-16T19:05:29.242Z for i in $(seq 1 90); do
2026-10-16T19:05:29.242Z   run=$(api "/repos/$OWNER/$REPO/actions/runs?event=push" | jq -c '.workflow_runs[0] // empty')
2026-10-16T19:05:29.242Z   [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break
2026-10-16T19:05:29.242Z   sleep 10
2026-10-16T19:05:29.242Z done
2026-10-16T19:05:29.242Z echo "$run" | jq '{id, status, conclusion}'
2026-10-16T19:05:29.242Z id=$(jq -r .id <<<"$run")
2026-10-16T19:05:29.242Z jobs=$(api "/repos/$OWNER/$REPO/actions/runs/$id/jobs")
2026-10-16T19:05:29.242Z # placementTries: times a job went back in line (no machine, or a runner on a replaced image turned away).
2026-10-16T19:05:29.242Z # restarts: times it started over because the platform replaced its runner before its steps ran.
2026-10-16T19:05:29.242Z jq -r '.jobs[] | "  \(.name): \(.conclusion)\(if .failure then " - " + (.failure.message // "") else "" end)\(try " (\((.completed_at | fromdateiso8601) - (.started_at | fromdateiso8601))s)" catch "")\(if (.placementTries // 0) > 0 then ", started again \(.placementTries) time(s)" else "" end)\(if (.restarts // 0) > 0 then ", restarted \(.restarts) time(s) after its runner was replaced" else "" end)"' <<<"$jobs"
2026-10-16T19:05:29.242Z if [ "$(jq -r .conclusion <<<"$run")" != success ]; then
2026-10-16T19:05:29.242Z   for job in $(jq -r '.jobs[] | select(.conclusion == "failure" or .conclusion == "timed_out") | .id' <<<"$jobs"); do
2026-10-16T19:05:29.242Z     echo "::group::Last log lines of job $job"
2026-10-16T19:05:29.242Z     api "/repos/$OWNER/$REPO/actions/jobs/$job/logs" | tail -n 80 || true
2026-10-16T19:05:29.242Z     echo "::endgroup::"
2026-10-16T19:05:29.242Z   done
2026-10-16T19:05:29.242Z   echo "::error::the push run did not succeed"
2026-10-16T19:05:29.242Z   exit 1
2026-10-16T19:05:29.242Z fi
2026-10-16T19:05:29.242Z if [ -n "${DEPLOYED_RUNNER_IMAGE:-}" ]; then
2026-10-16T19:05:29.242Z   # Every job ran the deployed runner, so these checks test what was just deployed.
2026-10-16T19:05:29.242Z   stale=$(jq -r --arg want "$DEPLOYED_RUNNER_IMAGE" '.jobs[] | select(.runner.image != $want) | "\(.name) on \(.runner.image // "no image reported")"' <<<"$jobs")
2026-10-16T19:05:29.242Z   [ -z "$stale" ] || { echo "::error::jobs ran on a runner image other than the deployed $DEPLOYED_RUNNER_IMAGE: $(paste -sd ';' <<<"$stale")"; exit 1; }
2026-10-16T19:05:29.242Z   echo "every job ran on $DEPLOYED_RUNNER_IMAGE"
2026-10-16T19:05:29.242Z fi
2026-10-16T19:05:29.242Z for job in $(jq -r '.jobs[] | select(.name | startswith("hosted")) | .id' <<<"$jobs"); do
2026-10-16T19:05:29.242Z   log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs")
2026-10-16T19:05:29.242Z   grep -F "live ok" <<<"$log" | grep -F "# $REPO" || { echo "::error::job $job did not print its line (checkout or run step failed)"; exit 1; }
2026-10-16T19:05:29.242Z   grep -F "sudo ok 0" <<<"$log" || { echo "::error::job $job could not run sudo without a password"; exit 1; }
2026-10-16T19:05:29.242Z done
2026-10-16T19:05:29.242Z job=$(jq -r '.jobs[] | select(.name == "docker") | .id' <<<"$jobs")
2026-10-16T19:05:29.242Z log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs")
2026-10-16T19:05:29.242Z grep -F "docker ok built" <<<"$log" || { echo "::error::docker build or run failed on a hosted runner"; exit 1; }
2026-10-16T19:05:29.242Z grep -F "service ok +PONG" <<<"$log" || { echo "::error::the redis service container was not reachable"; exit 1; }
2026-10-16T19:05:29.242Z job=$(jq -r '.jobs[] | select(.name == "pull") | .id' <<<"$jobs")
2026-10-16T19:05:29.242Z log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs")
2026-10-16T19:05:29.242Z grep -F "registry ok $BIG bytes" <<<"$log" || { echo "::error::the image pushed with a $BIG-byte layer did not come back intact from the registry"; exit 1; }
2026-10-16T19:05:29.242Z grep -F "buildx ok $BUILDX bytes" <<<"$log" || { echo "::error::the image pushed by docker/build-push-action did not come back from the registry"; exit 1; }
2026-10-16T19:05:29.242Z api "/users/$OWNER/packages/container/${REPO,,}/versions" | jq -c '.[] | {tags: .metadata.container.tags, size, platforms}'
2026-10-16T19:05:29.242Z ##[endgroup]
2026-10-16T19:06:10.571Z {
2026-10-16T19:06:10.571Z   "id": "4d5798de1a0c4d80b375998fe7c0d475",
2026-10-16T19:06:10.571Z   "status": "completed",
2026-10-16T19:06:10.571Z   "conclusion": "success"
2026-10-16T19:06:10.571Z }
2026-10-16T19:06:10.848Z   hosted (1): success (1s)
2026-10-16T19:06:10.848Z   hosted (2): success (3s)
2026-10-16T19:06:10.848Z   docker: success (7s)
2026-10-16T19:06:10.848Z   publish: success (15s)
2026-10-16T19:06:10.848Z   buildx: success (28s)
2026-10-16T19:06:10.848Z   pull: success (13s)
2026-10-16T19:06:10.858Z every job ran on diffinery-runner:efee6389dfc1b5bd5a743d5e
2026-10-16T19:06:11.402Z 2026-10-16T19:05:31.258Z live ok 1 # live-492-1
2026-10-16T19:06:11.404Z 2026-10-16T19:05:31.379Z sudo ok 0
2026-10-16T19:06:11.924Z 2026-10-16T19:05:29.049Z live ok 2 # live-492-1
2026-10-16T19:06:11.926Z 2026-10-16T19:05:29.772Z sudo ok 0
2026-10-16T19:06:12.487Z 2026-10-16T19:05:28.704Z docker ok built
2026-10-16T19:06:12.489Z 2026-10-16T19:05:28.705Z service ok +PONG
2026-10-16T19:06:12.997Z 2026-10-16T19:06:03.648Z registry ok 5000000 bytes
2026-10-16T19:06:12.999Z 2026-10-16T19:06:09.260Z buildx ok 4000000 bytes
2026-10-16T19:06:13.954Z {"tags":["buildx"],"size":4001855,"platforms":["linux/amd64","unknown/unknown"]}
2026-10-16T19:06:13.954Z {"tags":["live"],"size":5002323,"platforms":["linux/amd64","unknown/unknown"]}
2026-10-16T19:06:14.064Z ##[group]Run set -euo pipefail
2026-10-16T19:06:14.064Z org=$(curl -fsS "$DIFFINERY/api/v3/user/orgs" -H "Authorization: Bearer $TOKEN" | jq -r '.[0].login // empty')
2026-10-16T19:06:14.064Z [ -n "$org" ] || { echo "$OWNER is in no organization; skipped"; exit 0; }
2026-10-16T19:06:14.064Z html=$(curl -fsS "$DIFFINERY/$org/-/packages" -H "Authorization: Bearer $TOKEN")
2026-10-16T19:06:14.064Z grep -qF "<a href=\"/$org/-/packages\" class=\"on\">" <<<"$html" || { echo "::error::$org's packages page lost the organization's tab bar"; exit 1; }
2026-10-16T19:06:14.064Z grep -qF "href=\"/$org?tab=repositories\"" <<<"$html" || { echo "::error::$org's packages page has no Repositories tab"; exit 1; }
2026-10-16T19:06:14.064Z echo "$org's packages page shows the organization's tabs with Packages selected"
2026-10-16T19:06:14.064Z ##[endgroup]
2026-10-16T19:06:14.690Z ALCAN's packages page shows the organization's tabs with Packages selected
2026-10-16T19:06:15.443Z ##[group]Run set -euo pipefail
2026-10-16T19:06:15.443Z git clone -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" clone
2026-10-16T19:06:15.443Z [ "$(sha256sum clone/blob.bin | cut -d' ' -f1)" = "$(cat blob.sha)" ] || { echo "::error::the LFS file came back different"; exit 1; }
2026-10-16T19:06:15.443Z echo "LFS file matches ($(stat -c %s clone/blob.bin) bytes)"
2026-10-16T19:06:15.443Z ##[endgroup]
2026-10-16T19:06:17.745Z LFS file matches (3145728 bytes)
2026-10-16T19:06:17.831Z ##[group]Run set -euo pipefail
2026-10-16T19:06:17.831Z for i in $(seq 1 30); do
2026-10-16T19:06:17.831Z   hook=$(curl -fsS "$DIFFINERY/api/v3/repos/$OWNER/$REPO/hooks" -H "Authorization: Bearer $TOKEN" | jq -c '.[0]')
2026-10-16T19:06:17.831Z   # GitHub's hook shape: the target is config.url, the last delivery's status last_response.code.
2026-10-16T19:06:17.831Z   [ "$(jq -r '.last_response.code // empty' <<<"$hook")" != "" ] && break
2026-10-16T19:06:17.831Z   sleep 5
2026-10-16T19:06:17.831Z done
2026-10-16T19:06:17.831Z echo "$hook" | jq '{target: .config.url, last_response, updated_at}'
2026-10-16T19:06:17.831Z [ "$(jq -r '.last_response.code // empty' <<<"$hook")" != "" ] || { echo "::error::the push webhook was never delivered"; exit 1; }
2026-10-16T19:06:17.831Z ##[endgroup]
2026-10-16T19:06:18.112Z {
2026-10-16T19:06:18.112Z   "target": "https://example.com/diffinery-live-test",
2026-10-16T19:06:18.112Z   "last_response": {
2026-10-16T19:06:18.112Z     "code": 405,
2026-10-16T19:06:18.112Z     "status": "failed",
2026-10-16T19:06:18.112Z     "message": null
2026-10-16T19:06:18.112Z   },
2026-10-16T19:06:18.112Z   "updated_at": "2026-10-16T19:05:31Z"
2026-10-16T19:06:18.112Z }
2026-10-16T19:06:18.198Z ##[group]Run set -euo pipefail
2026-10-16T19:06:18.198Z # Revokes anything a failed check minted, then fails.
2026-10-16T19:06:18.198Z minted() { echo "::error::$1"; curl -fsS "$DIFFINERY/api/v3/diffinery/tokens" -H "Authorization: Bearer $TOKEN" | jq -r '.[] | select(.name == "live-test escalation") | .id' | while read -r id; do curl -sS -o /dev/null -X DELETE "$DIFFINERY/api/v3/diffinery/tokens/$id" -H "Authorization: Bearer $TOKEN"; done; exit 1; }
2026-10-16T19:06:18.198Z code=$(curl -sS -o /tmp/out -w '%{http_code}' -X POST "$DIFFINERY/api/v3/diffinery/tokens" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"name":"live-test escalation","scopes":["read"],"expires_in_days":1}')
2026-10-16T19:06:18.198Z [ "$code" = 403 ] || minted "an admin token minted a token through the API ($code)"
2026-10-16T19:06:18.198Z grep -q "browser session" /tmp/out || minted "unexpected refusal: $(cat /tmp/out)"
2026-10-16T19:06:18.198Z code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST "$DIFFINERY/api/v3/diffinery/agents" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"login":"live-test-escalation"}')
2026-10-16T19:06:18.198Z [ "$code" = 403 ] || { echo "::error::an admin token created an agent ($code); disable live-test-escalation by hand"; exit 1; }
2026-10-16T19:06:18.198Z # A web form with a token and a forged double-submit CSRF pair.
2026-10-16T19:06:18.198Z code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST "$DIFFINERY/settings/tokens" -H "Authorization: Bearer $TOKEN" -H "cookie: dfy_csrf=forged" --data "_csrf=forged&name=live-test%20escalation&scope=read&days=1")
2026-10-16T19:06:18.198Z [ "$code" = 403 ] || minted "a token submitted the web token form ($code)"
2026-10-16T19:06:18.198Z echo "tokens can't mint tokens or agents, through the API or the web forms"
2026-10-16T19:06:18.198Z ##[endgroup]
2026-10-16T19:06:18.808Z tokens can't mint tokens or agents, through the API or the web forms
2026-10-16T19:06:18.887Z ##[group]Run set -euo pipefail
2026-10-16T19:06:18.887Z base="$DIFFINERY/api/v3/repos/$OWNER/$REPO/diffinery/sandboxes"
2026-10-16T19:06:18.887Z id=$(curl -fsS --retry 1 --retry-delay 15 -X POST "$base" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{}' | jq -r .id)
2026-10-16T19:06:18.887Z echo "sandbox $id"
2026-10-16T19:06:18.887Z for i in $(seq 1 40); do
2026-10-16T19:06:18.887Z   out=$(curl -sS -X POST "$base/$id/exec" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"cmd":"cat README.md && git lfs ls-files | wc -l"}' || true)
2026-10-16T19:06:18.887Z   jq -e '.exitCode == 0' >/dev/null 2>&1 <<<"$out" && break
2026-10-16T19:06:18.887Z   sleep 6
2026-10-16T19:06:18.887Z done
2026-10-16T19:06:18.887Z echo "$out" | jq '{exitCode, stdout}'
2026-10-16T19:06:18.887Z curl -sS -X POST "$base/$id/close" -H "Authorization: Bearer $TOKEN" >/dev/null || true
2026-10-16T19:06:18.887Z jq -e --arg r "# $REPO" '.exitCode == 0 and (.stdout | contains($r))' >/dev/null <<<"$out" || { echo "::error::the sandbox did not run the command in the repository"; exit 1; }
2026-10-16T19:06:18.887Z ##[endgroup]
2026-10-16T19:06:21.198Z sandbox c26ae554276144ea820e7783e423ac48
2026-10-16T19:07:43.577Z {
2026-10-16T19:07:43.577Z   "exitCode": 0,
2026-10-16T19:07:43.577Z   "stdout": "# live-492-1\n1\n"
2026-10-16T19:07:43.577Z }
2026-10-16T19:07:44.924Z ##[group]Run set -euo pipefail
2026-10-16T19:07:44.924Z base="$DIFFINERY/api/v3/repos/$OWNER/$REPO/diffinery/sandboxes"
2026-10-16T19:07:44.924Z id=""
2026-10-16T19:07:44.924Z close() { if [ -n "$id" ]; then curl -sS --max-time 60 -X POST "$base/$id/close" -H "Authorization: Bearer $TOKEN" >/dev/null || true; fi; id=""; }
2026-10-16T19:07:44.924Z trap close EXIT
2026-10-16T19:07:44.924Z run() { curl -sS --max-time "${2:-240}" -X POST "$base/$id/exec" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data "$(jq -n --arg c "$1" '{cmd: $c, timeoutMs: 180000}')"; }
2026-10-16T19:07:44.924Z # One create (no retry: a retried POST could open a second sandbox nothing closes), then wait for it to answer.
2026-10-16T19:07:44.924Z open() {
2026-10-16T19:07:44.924Z   close
2026-10-16T19:07:44.924Z   id=$(curl -sS --max-time 240 -X POST "$base" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{}' | jq -r '.id // empty' || true)
2026-10-16T19:07:44.924Z   [ -n "$id" ] || { echo "::error::could not open a sandbox for the jail check"; exit 1; }
2026-10-16T19:07:44.924Z   for i in $(seq 1 30); do
2026-10-16T19:07:44.924Z     jq -e '.exitCode == 0' >/dev/null 2>&1 <<<"$(run true 20 || true)" && return 0
2026-10-16T19:07:44.924Z     sleep 6
2026-10-16T19:07:44.924Z   done
2026-10-16T19:07:44.924Z   echo "::error::the sandbox never became ready"
2026-10-16T19:07:44.924Z   exit 1
2026-10-16T19:07:44.924Z }
2026-10-16T19:07:44.924Z # Sandboxes roll out on their own: one opened right after a deploy can still be on the previous image.
2026-10-16T19:07:44.924Z jail=no
2026-10-16T19:07:44.924Z for attempt in 1 2 3 4 5; do
2026-10-16T19:07:44.924Z   open
2026-10-16T19:07:44.924Z   # A runner with headless jails asks for the run's model token; an older one ignores --egress.
2026-10-16T19:07:44.924Z   has=$(run 'mkdir -p ../probe ../probe.out; [ -n "${DIFFINERY_JAIL:-}" ] && [ -x "$DIFFINERY_JAIL" ] && "$DIFFINERY_JAIL" agent --dir ../probe --out ../probe.out --egress model -- true 2>&1 | grep -q DIFFINERY_MODEL_TOKEN && echo yes || echo no' 20 | jq -r '.stdout // empty' || true)
2026-10-16T19:07:44.924Z   if [ "$has" = yes ]; then jail=yes; break; fi
2026-10-16T19:07:44.924Z   echo "sandbox $id is on a runner image without the jail; trying another in a minute"
2026-10-16T19:07:44.924Z   close
2026-10-16T19:07:44.924Z   sleep 60
2026-10-16T19:07:44.924Z done
2026-10-16T19:07:44.924Z [ "$jail" = yes ] || { echo "::error::the sandbox started on a runner image without the jail (rollout not finished?)"; exit 1; }
2026-10-16T19:07:44.924Z inside='echo "direct=$(node -e "require(\"net\").connect(443, \"1.1.1.1\").on(\"connect\", () => (console.log(\"open\"), process.exit())).on(\"error\", (e) => (console.log(e.code), process.exit()))")"
2026-10-16T19:07:44.924Z echo "other=$(curl -sS -m 20 -o /dev/null -w "%{http_connect}" https://example.com 2>/dev/null || true)"
2026-10-16T19:07:44.924Z echo "sni=$(curl -sS -m 20 -o /dev/null -w "%{http_code}" --connect-to example.com:443:registry.npmjs.org:443 https://example.com 2>/dev/null; true)"
2026-10-16T19:07:44.924Z echo "checkout=$(ls -A /workspace/repo | paste -sd,)"
2026-10-16T19:07:44.924Z echo "credential=$(cat /workspace/repo/.git/config 2>/dev/null || echo hidden)"
2026-10-16T19:07:44.924Z v=$(npm view left-pad version --no-update-notifier --loglevel=error 2>/tmp/npm.err)
2026-10-16T19:07:44.924Z echo "npm=$(printf "%s\n" "$v" | grep -E "^[0-9]+\.[0-9]+\.[0-9]+$" | tail -1)"
2026-10-16T19:07:44.924Z echo "npmerr=$(tail -3 /tmp/npm.err | paste -sd" " -)"'
2026-10-16T19:07:44.924Z out=$(run "mkdir -p ../jail-check ../jail-check.out && \"\$DIFFINERY_JAIL\" agent --dir ../jail-check --out ../jail-check.out -- sh -c $(printf '%q' "$inside")")
2026-10-16T19:07:44.924Z echo "$out" | jq -r '"exit \(.exitCode)", .stdout, .stderr'
2026-10-16T19:07:44.924Z o=$(jq -r .stdout <<<"$out")
2026-10-16T19:07:44.924Z fail=0
2026-10-16T19:07:44.924Z jq -e '.exitCode == 0' >/dev/null <<<"$out" || { echo "::error::the jail didn't run (exit $(jq -r .exitCode <<<"$out"))"; fail=1; }
2026-10-16T19:07:44.924Z grep -qE '^direct=(ENETUNREACH|EHOSTUNREACH|ECONNREFUSED|EACCES)$' <<<"$o" || { echo "::error::the jail has a route out of its own"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'other=403' <<<"$o" || { echo "::error::the proxy didn't refuse example.com"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'checkout=.git' <<<"$o" || { echo "::error::the jail sees the person's checkout"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'credential=hidden' <<<"$o" || { echo "::error::the jail sees the checkout's git config"; fail=1; }
2026-10-16T19:07:44.924Z grep -qE '^npm=[0-9]+\.[0-9]+' <<<"$o" || { echo "::error::npm view left-pad didn't work through the proxy"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'sni=000' <<<"$o" || { echo "::error::the proxy let TLS for example.com through a tunnel to registry.npmjs.org"; fail=1; }
2026-10-16T19:07:44.924Z 
2026-10-16T19:07:44.924Z # A headless run's jail: registries only, and Diffinery only at /-/model/ through the model proxy outside,
2026-10-16T19:07:44.924Z # which adds the run's token (a stand-in here, so Diffinery answers 401) and drops whatever the agent sends.
2026-10-16T19:07:44.924Z host=${DIFFINERY#https://}
2026-10-16T19:07:44.924Z headless='echo "model=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$ANTHROPIC_BASE_URL/v1/messages" -H "x-api-key: $ANTHROPIC_API_KEY" -H "content-type: application/json" -d "{}")"
2026-10-16T19:07:44.924Z echo "api=$(curl -s -o /dev/null -w "%{http_code}" --path-as-is "$ANTHROPIC_BASE_URL/../../api/v3/user")"
2026-10-16T19:07:44.924Z echo "connect=$(curl -sS -m 20 -o /dev/null -w "%{http_connect}" https://'"$host"'/api/v3/user 2>/dev/null || true)"
2026-10-16T19:07:44.924Z echo "vendor=$(curl -sS -m 20 -o /dev/null -w "%{http_connect}" https://api.anthropic.com 2>/dev/null || true)"
2026-10-16T19:07:44.924Z echo "token=$(env | grep -c dmt_ || true)"
2026-10-16T19:07:44.924Z echo "credential=$(cat /workspace/repo/.git/config 2>/dev/null || echo hidden)"
2026-10-16T19:07:44.924Z v=$(npm view left-pad version --no-update-notifier --loglevel=error 2>/dev/null)
2026-10-16T19:07:44.924Z echo "npm=$(printf "%s\n" "$v" | grep -E "^[0-9]+\.[0-9]+\.[0-9]+$" | tail -1)"'
2026-10-16T19:07:44.924Z out=$(run "mkdir -p ../headless-check ../headless-check.out && DIFFINERY_MODEL_TOKEN=dmt_livetest_standin DIFFINERY_MODEL_ORIGIN=$(printf '%q' "$DIFFINERY") ANTHROPIC_BASE_URL=http://127.0.0.1:3129/-/model/anthropic ANTHROPIC_API_KEY=diffinery-jail \"\$DIFFINERY_JAIL\" agent --dir ../headless-check --out ../headless-check.out --egress model -- sh -c $(printf '%q' "$headless")")
2026-10-16T19:07:44.924Z echo "$out" | jq -r '"exit \(.exitCode)", .stdout, .stderr'
2026-10-16T19:07:44.924Z o=$(jq -r .stdout <<<"$out")
2026-10-16T19:07:44.924Z jq -e '.exitCode == 0' >/dev/null <<<"$out" || { echo "::error::the headless jail didn't run (exit $(jq -r .exitCode <<<"$out"))"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'model=401' <<<"$o" || { echo "::error::the model proxy didn't reach Diffinery's model endpoint with the run's token"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'api=403' <<<"$o" || { echo "::error::the model proxy forwarded a path outside /-/model/"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'connect=403' <<<"$o" || { echo "::error::the headless jail could open a tunnel to Diffinery"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'vendor=403' <<<"$o" || { echo "::error::the headless jail could reach a CLI vendor"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'token=0' <<<"$o" || { echo "::error::the run's token is inside the headless jail"; fail=1; }
2026-10-16T19:07:44.924Z grep -qx 'credential=hidden' <<<"$o" || { echo "::error::the headless jail sees the checkout's git config"; fail=1; }
2026-10-16T19:07:44.924Z grep -qE '^npm=[0-9]+\.[0-9]+' <<<"$o" || { echo "::error::npm view left-pad didn't work in the headless jail"; fail=1; }
2026-10-16T19:07:44.924Z exit $fail
2026-10-16T19:07:44.924Z ##[endgroup]
2026-10-16T19:09:11.041Z exit 0
2026-10-16T19:09:11.042Z direct=ENETUNREACH
2026-10-16T19:09:11.042Z other=403
2026-10-16T19:09:11.042Z sni=000
2026-10-16T19:09:11.042Z checkout=.git
2026-10-16T19:09:11.042Z credential=hidden
2026-10-16T19:09:11.042Z npm=1.3.0
2026-10-16T19:09:11.042Z npmerr=
2026-10-16T19:09:11.042Z 
2026-10-16T19:09:11.042Z diffinery: refused a connection to example.com:443 from the task (only the hosts in /docs/agents/terminal#what-a-task-can-reach)
2026-10-16T19:09:11.042Z diffinery: refused a connection to registry.npmjs.org:443 from the task: its TLS ClientHello asks for example.com
2026-10-16T19:09:11.042Z 
2026-10-16T19:09:12.938Z exit 0
2026-10-16T19:09:12.938Z model=401
2026-10-16T19:09:12.938Z api=403
2026-10-16T19:09:12.938Z connect=403
2026-10-16T19:09:12.938Z vendor=403
2026-10-16T19:09:12.938Z token=0
2026-10-16T19:09:12.938Z credential=hidden
2026-10-16T19:09:12.938Z npm=1.3.0
2026-10-16T19:09:12.938Z 
2026-10-16T19:09:12.938Z diffinery: refused GET /-/model/anthropic/../../api/v3/user from the run (only Diffinery's model endpoints, /-/model/...)
2026-10-16T19:09:12.938Z diffinery: refused a connection to diffinery.com:443 from the task (only the hosts in /docs/agents/tasks#what-a-run-can-reach)
2026-10-16T19:09:12.938Z diffinery: refused a connection to api.anthropic.com:443 from the task (only the hosts in /docs/agents/tasks#what-a-run-can-reach)
2026-10-16T19:09:12.938Z 
2026-10-16T19:09:13.498Z ##[group]Run set -euo pipefail
2026-10-16T19:09:13.498Z Q="$REPO-pr"
2026-10-16T19:09:13.498Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T19:09:13.498Z api POST /user/repos "{\"name\":\"$Q\",\"private\":true}" >/dev/null
2026-10-16T19:09:13.498Z echo "PR_REPO=$Q" >> "$GITHUB_ENV"
2026-10-16T19:09:13.498Z api PUT "/repos/$OWNER/$Q/actions/secrets/TOPSECRET" '{"value":"s3cret"}' >/dev/null
2026-10-16T19:09:13.498Z remote="https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$Q.git"
2026-10-16T19:09:13.498Z mkdir -p pr/.github/workflows && cd pr
2026-10-16T19:09:13.498Z git init -q -b main
2026-10-16T19:09:13.498Z git config user.name "Live test" && git config user.email "live-test@diffinery.com"
2026-10-16T19:09:13.498Z printf 'a\nb\nc\n' > app.txt
2026-10-16T19:09:13.498Z cat > .github/workflows/ci.yml <<'EOF'
2026-10-16T19:09:13.498Z name: CI
2026-10-16T19:09:13.498Z on:
2026-10-16T19:09:13.498Z   pull_request:
2026-10-16T19:09:13.498Z   merge_group:
2026-10-16T19:09:13.498Z jobs:
2026-10-16T19:09:13.498Z   test:
2026-10-16T19:09:13.498Z     runs-on: ubuntu-latest
2026-10-16T19:09:13.498Z     steps:
2026-10-16T19:09:13.498Z       - uses: actions/checkout@v4
2026-10-16T19:09:13.498Z       - run: echo "pr ok event=${{ github.event_name }} ref=${{ github.ref }} sha=${{ github.sha }} head=$(git rev-parse HEAD) app=$(tr '\n' ' ' < app.txt)"
2026-10-16T19:09:13.498Z EOF
2026-10-16T19:09:13.498Z cat > .github/workflows/target.yml <<'EOF'
2026-10-16T19:09:13.498Z name: Target
2026-10-16T19:09:13.498Z on: pull_request_target
2026-10-16T19:09:13.498Z jobs:
2026-10-16T19:09:13.498Z   t:
2026-10-16T19:09:13.498Z     runs-on: ubuntu-latest
2026-10-16T19:09:13.498Z     steps:
2026-10-16T19:09:13.498Z       - run: echo "target ok secret=${{ secrets.TOPSECRET == 's3cret' }} ref=${{ github.ref }}"
2026-10-16T19:09:13.498Z EOF
2026-10-16T19:09:13.498Z git add -A && git commit -q -m "PR test" && git push -q "$remote" main
2026-10-16T19:09:13.498Z # The pull request changes app.txt and tries to rewrite the pull_request_target workflow.
2026-10-16T19:09:13.498Z git checkout -q -b change
2026-10-16T19:09:13.498Z printf 'A\nb\nc\n' > app.txt
2026-10-16T19:09:13.498Z sed -i 's/target ok/PWNED/' .github/workflows/target.yml
2026-10-16T19:09:13.498Z git commit -q -am "Change" && git push -q "$remote" change
2026-10-16T19:09:13.498Z head=$(git rev-parse HEAD)
2026-10-16T19:09:13.498Z # Main moves on, so the test merge commit holds both sides.
2026-10-16T19:09:13.498Z git checkout -q main
2026-10-16T19:09:13.498Z printf 'a\nb\nC\n' > app.txt
2026-10-16T19:09:13.498Z git commit -q -am "Main moves" && git push -q "$remote" main
2026-10-16T19:09:13.498Z n=$(api POST "/repos/$OWNER/$Q/pulls" '{"title":"Change","head":"change","base":"main"}' | jq -r .number)
2026-10-16T19:09:13.498Z echo "opened pull request #$n (head $head)"
2026-10-16T19:09:13.498Z 
2026-10-16T19:09:13.498Z wait_run() { # event -> the completed run JSON
2026-10-16T19:09:13.498Z   for i in $(seq 1 60); do
2026-10-16T19:09:13.498Z     run=$(api GET "/repos/$OWNER/$Q/actions/runs?event=$1" | jq -c '.workflow_runs[0] // empty')
2026-10-16T19:09:13.498Z     [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && { echo "$run"; return; }
2026-10-16T19:09:13.498Z     sleep 10
2026-10-16T19:09:13.498Z   done
2026-10-16T19:09:13.498Z   echo "::error::no completed $1 run" >&2; exit 1
2026-10-16T19:09:13.498Z }
2026-10-16T19:09:13.498Z log_of() { for job in $(api GET "/repos/$OWNER/$Q/actions/runs/$1/jobs" | jq -r '.jobs[].id'); do api GET "/repos/$OWNER/$Q/actions/jobs/$job/logs"; done; }
2026-10-16T19:09:13.498Z pr=$(wait_run pull_request)
2026-10-16T19:09:13.498Z echo "$pr" | jq '{event, ref, sha, head_sha, conclusion}'
2026-10-16T19:09:13.498Z [ "$(jq -r .conclusion <<<"$pr")" = success ] || { echo "::error::the pull_request run failed"; exit 1; }
2026-10-16T19:09:13.498Z [ "$(jq -r .ref <<<"$pr")" = "refs/pull/$n/merge" ] && [ "$(jq -r .head_sha <<<"$pr")" = "$head" ] && [ "$(jq -r .sha <<<"$pr")" != "$head" ] || { echo "::error::the pull_request run did not use the test merge commit"; exit 1; }
2026-10-16T19:09:13.498Z log_of "$(jq -r .id <<<"$pr")" | grep -F "pr ok event=pull_request ref=refs/pull/$n/merge" | grep -F "app=A b C" || { echo "::error::the pull_request job did not check out the merged code"; exit 1; }
2026-10-16T19:09:13.498Z target=$(wait_run pull_request_target)
2026-10-16T19:09:13.498Z echo "$target" | jq '{event, ref, sha, head_sha, conclusion}'
2026-10-16T19:09:13.498Z tlog=$(log_of "$(jq -r .id <<<"$target")")
2026-10-16T19:09:13.498Z grep -F "target ok secret=true ref=refs/heads/main" <<<"$tlog" || { echo "::error::pull_request_target did not run the base workflow with secrets"; exit 1; }
2026-10-16T19:09:13.498Z ! grep -q PWNED <<<"$tlog" || { echo "::error::pull_request_target ran the pull request's workflow"; exit 1; }
2026-10-16T19:09:13.498Z 
2026-10-16T19:09:13.498Z api PUT "/repos/$OWNER/$Q/branches/main/protection" '{"requirePullRequest":true,"requiredChecks":["CI / test"],"mergeQueue":{"method":"squash","checkTimeoutMinutes":20}}' >/dev/null
2026-10-16T19:09:13.498Z code=$(curl -sS -o /dev/null -w '%{http_code}' -X PUT "$DIFFINERY/api/v3/repos/$OWNER/$Q/pulls/$n/merge" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{}')
2026-10-16T19:09:13.498Z [ "$code" = 405 ] || { echo "::error::a direct merge into a merge queue branch returned $code"; exit 1; }
2026-10-16T19:09:13.498Z api PUT "/repos/$OWNER/$Q/pulls/$n/merge-queue" '{"delete_branch":true}' | jq '{state, position: .entry.position, merge_group: .entry.merge_group}'
2026-10-16T19:09:13.498Z for i in $(seq 1 60); do
2026-10-16T19:09:13.498Z   merged=$(api GET "/repos/$OWNER/$Q/pulls/$n" | jq -r .merged)
2026-10-16T19:09:13.498Z   [ "$merged" = true ] && break
2026-10-16T19:09:13.498Z   sleep 10
2026-10-16T19:09:13.498Z done
2026-10-16T19:09:13.498Z [ "$merged" = true ] || { echo "::error::the merge queue did not merge #$n"; api GET "/repos/$OWNER/$Q/merge-queue/main" | jq .; exit 1; }
2026-10-16T19:09:13.498Z group=$(wait_run merge_group)
2026-10-16T19:09:13.498Z echo "$group" | jq '{event, ref, sha, conclusion}'
2026-10-16T19:09:13.498Z [[ "$(jq -r .ref <<<"$group")" == refs/heads/gh-readonly-queue/main/pr-$n-* ]] || { echo "::error::the merge_group run is not on a queue branch"; exit 1; }
2026-10-16T19:09:13.498Z sha=$(api GET "/repos/$OWNER/$Q/branches/main" | jq -r .commit.sha)
2026-10-16T19:09:13.498Z [ "$sha" = "$(jq -r .sha <<<"$group")" ] || { echo "::error::main ($sha) is not the tested merge group"; exit 1; }
2026-10-16T19:09:13.498Z git fetch -q "$remote" main && [ "$(git show FETCH_HEAD:app.txt | tr '\n' ' ')" = "A b C " ] || { echo "::error::main does not hold the merged change"; exit 1; }
2026-10-16T19:09:13.498Z echo "pull request #$n merged through the queue as $sha"
2026-10-16T19:09:13.498Z ##[endgroup]
2026-10-16T19:09:16.973Z remote: Create a pull request for 'change':        
2026-10-16T19:09:16.973Z remote:   https://diffinery.com/cnbrkdmrci/live-492-1-pr/compare/change        
2026-10-16T19:09:20.170Z opened pull request #1 (head 44ae4c8799569784ab8bfc106f5a1def80e9efd4)
2026-10-16T19:09:30.716Z {
2026-10-16T19:09:30.716Z   "event": "pull_request",
2026-10-16T19:09:30.716Z   "ref": "refs/pull/1/merge",
2026-10-16T19:09:30.716Z   "sha": "13af22c7c08165f01a53274dee61ebcd3e4d277a",
2026-10-16T19:09:30.716Z   "head_sha": "44ae4c8799569784ab8bfc106f5a1def80e9efd4",
2026-10-16T19:09:30.716Z   "conclusion": "success"
2026-10-16T19:09:30.716Z }
2026-10-16T19:09:31.484Z 2026-10-16T19:09:24.621Z pr ok event=pull_request ref=refs/pull/1/merge sha=13af22c7c08165f01a53274dee61ebcd3e4d277a head=13af22c7c08165f01a53274dee61ebcd3e4d277a app=A b C 
2026-10-16T19:09:31.744Z {
2026-10-16T19:09:31.744Z   "event": "pull_request_target",
2026-10-16T19:09:31.744Z   "ref": "refs/heads/main",
2026-10-16T19:09:31.744Z   "sha": "d5480de44a270fab32a090de86a1b4c2a693c48a",
2026-10-16T19:09:31.744Z   "head_sha": "44ae4c8799569784ab8bfc106f5a1def80e9efd4",
2026-10-16T19:09:31.744Z   "conclusion": "success"
2026-10-16T19:09:31.744Z }
2026-10-16T19:09:32.496Z 2026-10-16T19:09:23.393Z ##[group]Run echo "target ok secret=true ref=refs/heads/main"
2026-10-16T19:09:32.496Z 2026-10-16T19:09:23.407Z target ok secret=true ref=refs/heads/main
2026-10-16T19:09:34.401Z {
2026-10-16T19:09:34.401Z   "state": "queued",
2026-10-16T19:09:34.402Z   "position": 1,
2026-10-16T19:09:34.402Z   "merge_group": {
2026-10-16T19:09:34.402Z     "head_sha": "f7d8860598baa85f9903e3a7329cbfc5b03c1f71",
2026-10-16T19:09:34.402Z     "head_ref": "refs/heads/gh-readonly-queue/main/pr-1-44ae4c8799569784ab8bfc106f5a1def80e9efd4",
2026-10-16T19:09:34.402Z     "base_sha": "d5480de44a270fab32a090de86a1b4c2a693c48a",
2026-10-16T19:09:34.402Z     "built_at": "2026-10-16T19:09:33.319Z"
2026-10-16T19:09:34.402Z   }
2026-10-16T19:09:34.402Z }
2026-10-16T19:09:45.319Z {
2026-10-16T19:09:45.319Z   "event": "merge_group",
2026-10-16T19:09:45.319Z   "ref": "refs/heads/gh-readonly-queue/main/pr-1-44ae4c8799569784ab8bfc106f5a1def80e9efd4",
2026-10-16T19:09:45.319Z   "sha": "f7d8860598baa85f9903e3a7329cbfc5b03c1f71",
2026-10-16T19:09:45.319Z   "conclusion": "success"
2026-10-16T19:09:45.319Z }
2026-10-16T19:09:46.337Z pull request #1 merged through the queue as f7d8860598baa85f9903e3a7329cbfc5b03c1f71
2026-10-16T19:09:46.424Z ##[group]Run set -euo pipefail
2026-10-16T19:09:46.424Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T19:09:46.424Z name="$REPO-import"
2026-10-16T19:09:46.424Z body=$(jq -nc --arg s "$SOURCE" --arg o "$OWNER" --arg n "$name" --arg t "${GITHUB_TOKEN_FOR_IMPORT:-}" \
2026-10-16T19:09:46.424Z   '{source: $s, owner: $o, name: $n, visibility: "private"} + (if $t == "" then {} else {github_token: $t} end)')
2026-10-16T19:09:46.424Z # Token-free, GitHub allows 60 requests an hour per address: a rate limit skips this check with a warning.
2026-10-16T19:09:46.424Z # Starting the import reads the repository from GitHub; a GitHub outage (502 "could not reach GitHub")
2026-10-16T19:09:46.424Z # is retried, and skips this check with a warning if it outlasts the retries. While other imports hold
2026-10-16T19:09:46.424Z # every slot (an import campaign), it waits up to 15 minutes for one, so a busy account doesn't hide this check.
2026-10-16T19:09:46.424Z tries=0 waits=0
2026-10-16T19:09:46.424Z while :; do
2026-10-16T19:09:46.424Z   code=$(curl -sS -o import.json -w '%{http_code}' -X POST "$DIFFINERY/api/v3/diffinery/imports" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \
2026-10-16T19:09:46.424Z     --data-binary @- <<<"$body" || true)
2026-10-16T19:09:46.424Z   unreachable=$(jq -r '.message // "" | startswith("could not reach GitHub")' import.json 2>/dev/null || echo false)
2026-10-16T19:09:46.424Z   busy=$(jq -r '.message // "" | startswith("too many repository imports are already running")' import.json 2>/dev/null || echo false)
2026-10-16T19:09:46.424Z   if [ "$code" = 429 ] && [ "$busy" = true ]; then
2026-10-16T19:09:46.424Z     waits=$((waits + 1))
2026-10-16T19:09:46.424Z     [ "$waits" -le 30 ] || break
2026-10-16T19:09:46.424Z     [ "$waits" -gt 1 ] || echo "every import slot is taken ($(jq -r .message import.json)); waiting for one, up to 15 minutes"
2026-10-16T19:09:46.424Z     sleep 30
2026-10-16T19:09:46.424Z     continue
2026-10-16T19:09:46.424Z   fi
2026-10-16T19:09:46.424Z   { [ "$code" = 502 ] && [ "$unreachable" = true ]; } || [ "$code" = 000 ] || break
2026-10-16T19:09:46.424Z   tries=$((tries + 1))
2026-10-16T19:09:46.424Z   [ "$tries" -lt 4 ] || break
2026-10-16T19:09:46.424Z   echo "starting the import returned $code ($(jq -r .message import.json 2>/dev/null)); trying again in 30 seconds"
2026-10-16T19:09:46.424Z   sleep 30
2026-10-16T19:09:46.424Z done
2026-10-16T19:09:46.424Z if [ "$code" = 429 ] && [ "$busy" = true ]; then echo "::warning::no import slot came free in 15 minutes, so the import check is skipped: $(jq -r .message import.json)"; exit 0; fi
2026-10-16T19:09:46.424Z if [ "$code" = 429 ]; then echo "::warning::GitHub's rate limit stopped the import check: $(jq -r .message import.json)"; exit 0; fi
2026-10-16T19:09:46.424Z if [ "$code" = 502 ] && [ "$unreachable" = true ]; then echo "::warning::GitHub could not be reached, so the import check is skipped: $(jq -r .message import.json)"; exit 0; fi
2026-10-16T19:09:46.424Z [ "$code" = 201 ] || { echo "::error::starting the import returned $code: $(cat import.json)"; exit 1; }
2026-10-16T19:09:46.424Z echo "IMPORT_REPO=$name" >> "$GITHUB_ENV"
2026-10-16T19:09:46.424Z id=$(jq -r .id import.json)
2026-10-16T19:09:46.424Z echo "import $id: $SOURCE -> $OWNER/$name"
2026-10-16T19:09:46.424Z for i in $(seq 1 90); do
2026-10-16T19:09:46.424Z   imp=$(api GET "/diffinery/imports/$id")
2026-10-16T19:09:46.424Z   status=$(jq -r .status <<<"$imp")
2026-10-16T19:09:46.424Z   case "$status" in succeeded|failed|cancelled) break ;; esac
2026-10-16T19:09:46.424Z   if jq -e '[.steps[].message // ""] | any(test("rate limit"))' >/dev/null <<<"$imp"; then
2026-10-16T19:09:46.424Z     api POST "/diffinery/imports/$id/cancel" >/dev/null || true
2026-10-16T19:09:46.424Z     echo "::warning::GitHub's rate limit paused the import, so the import check is skipped: $(jq -r '[.steps[].message // ""] | map(select(test("rate limit")))[0]' <<<"$imp")"
2026-10-16T19:09:46.424Z     exit 0
2026-10-16T19:09:46.424Z   fi
2026-10-16T19:09:46.424Z   sleep 10
2026-10-16T19:09:46.424Z done
2026-10-16T19:09:46.424Z jq '{status, error, warnings, steps: [.steps[] | "\(.name): \(.status) \(.message // "")"], git}' <<<"$imp"
2026-10-16T19:09:46.424Z [ "$status" = succeeded ] || { echo "::error::the import ended $status"; exit 1; }
2026-10-16T19:09:46.424Z 
2026-10-16T19:09:46.424Z # The same refs, issue and pull request numbers as on GitHub (when GitHub still answers this runner).
2026-10-16T19:09:46.424Z R="/repos/$OWNER/$name"
2026-10-16T19:09:46.424Z [ "$(api GET "$R" | jq -r .private)" = true ] || { echo "::error::the imported repository is not private"; exit 1; }
2026-10-16T19:09:46.424Z gh() { curl -fsS "https://api.github.com/repos/$SOURCE$1" -H "Accept: application/vnd.github+json" ${GITHUB_TOKEN_FOR_IMPORT:+-H "Authorization: Bearer $GITHUB_TOKEN_FOR_IMPORT"}; }
2026-10-16T19:09:46.424Z if src=$(gh "") && branches=$(gh "/branches?per_page=100") && items=$(gh "/issues?state=all&per_page=30&sort=created&direction=asc"); then
2026-10-16T19:09:46.424Z   def=$(jq -r .default_branch <<<"$src")
2026-10-16T19:09:46.424Z   want=$(jq -r --arg b "$def" '.[] | select(.name == $b) | .commit.sha' <<<"$branches")
2026-10-16T19:09:46.424Z   got=$(api GET "$R/branches/$def" | jq -r .commit.sha)
2026-10-16T19:09:46.424Z   [ "$got" = "$want" ] || { echo "::error::$def is $got on Diffinery, $want on GitHub"; exit 1; }
2026-10-16T19:09:46.424Z   diff <(jq -r '.[].name' <<<"$branches" | sort) <(api GET "$R/branches?per_page=100" | jq -r '.[].name' | sort) || { echo "::error::the branches differ"; exit 1; }
2026-10-16T19:09:46.424Z   n=0
2026-10-16T19:09:46.424Z   for row in $(jq -r '.[] | "\(.number):\(if .pull_request then "pulls" else "issues" end)"' <<<"$items"); do
2026-10-16T19:09:46.424Z     num=${row%%:*} kind=${row#*:}
2026-10-16T19:09:46.424Z     want=$(jq -r --argjson n "$num" '.[] | select(.number == $n) | .title' <<<"$items")
2026-10-16T19:09:46.424Z     got=$(api GET "$R/$kind/$num" | jq -r .title)
2026-10-16T19:09:46.424Z     [ "$got" = "$want" ] || { echo "::error::$kind #$num is \"$got\" on Diffinery, \"$want\" on GitHub"; exit 1; }
2026-10-16T19:09:46.424Z     n=$((n + 1))
2026-10-16T19:09:46.424Z   done
2026-10-16T19:09:46.424Z   echo "$def at $got, $(jq length <<<"$branches") branches and $n issues and pull requests match GitHub"
2026-10-16T19:09:46.424Z else
2026-10-16T19:09:46.424Z   echo "::warning::GitHub did not answer this runner (rate limit?), so the import is checked without comparing to GitHub"
2026-10-16T19:09:46.424Z fi
2026-10-16T19:09:46.424Z # No side effects: importing runs no workflows and sends no notifications.
2026-10-16T19:09:46.424Z runs=$(api GET "$R/actions/runs" | jq .total_count)
2026-10-16T19:09:46.424Z [ "$runs" = 0 ] || { echo "::error::the import started $runs workflow runs"; exit 1; }
2026-10-16T19:09:46.424Z env:
2026-10-16T19:09:46.424Z   SOURCE: octocat/git-consortium
2026-10-16T19:09:46.424Z   GITHUB_TOKEN_FOR_IMPORT: 
2026-10-16T19:09:46.424Z ##[endgroup]
2026-10-16T19:09:48.424Z import 886c47b3c2934eb9988c2ca7abcaba44: octocat/git-consortium -> cnbrkdmrci/live-492-1-import
2026-10-16T19:11:00.951Z {
2026-10-16T19:11:00.951Z   "status": "succeeded",
2026-10-16T19:11:00.951Z   "error": null,
2026-10-16T19:11:00.951Z   "warnings": [
2026-10-16T19:11:00.951Z     "Actions variables, secret names and environments were not imported: reading them needs a GitHub token with admin access to the repository. Add them under Settings → Secrets and variables."
2026-10-16T19:11:00.951Z   ],
2026-10-16T19:11:00.951Z   "steps": [
2026-10-16T19:11:00.951Z     "repository: done cnbrkdmrci/live-492-1-import",
2026-10-16T19:11:00.951Z     "git: done 1 branches, 0 tags, 30 pull request heads",
2026-10-16T19:11:00.951Z     "labels: done 6 labels, 0 milestones",
2026-10-16T19:11:00.951Z     "issues: done 59",
2026-10-16T19:11:00.951Z     "comments: done 27",
2026-10-16T19:11:00.951Z     "reviews: done 34",
2026-10-16T19:11:00.951Z     "review_comments: done 2",
2026-10-16T19:11:00.951Z     "protection: done No protected branches",
2026-10-16T19:11:00.951Z     "variables: skipped skipped (needs a GitHub token)",
2026-10-16T19:11:00.951Z     "releases: skipped No releases",
2026-10-16T19:11:00.951Z     "finalize: done 40 issues, 19 pull requests"
2026-10-16T19:11:00.951Z   ],
2026-10-16T19:11:00.951Z   "git": {
2026-10-16T19:11:00.951Z     "phase": "done",
2026-10-16T19:11:00.951Z     "message": "Git data copied",
2026-10-16T19:11:00.951Z     "chunks": 31,
2026-10-16T19:11:00.951Z     "bytes": 35792,
2026-10-16T19:11:00.951Z     "tries": 1
2026-10-16T19:11:00.951Z   }
2026-10-16T19:11:00.951Z }
2026-10-16T19:11:12.014Z master at Update README.md, 1 branches and 30 issues and pull requests match GitHub
2026-10-16T19:11:12.355Z ##[group]Run set -euo pipefail
2026-10-16T19:11:12.356Z # The cron trigger fires every 5 minutes, so allow two windows.
2026-10-16T19:11:12.356Z for i in $(seq 1 75); do
2026-10-16T19:11:12.356Z   run=$(curl -fsS "$DIFFINERY/api/v3/repos/$OWNER/$REPO/actions/runs?event=schedule" -H "Authorization: Bearer $TOKEN" | jq -c '.workflow_runs[0] // empty')
2026-10-16T19:11:12.356Z   [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break
2026-10-16T19:11:12.356Z   sleep 10
2026-10-16T19:11:12.356Z done
2026-10-16T19:11:12.356Z if [ -z "$run" ]; then
2026-10-16T19:11:12.356Z   # Whether the scheduler stopped ticking (last_tick_at is old) or ticked without starting the run
2026-10-16T19:11:12.356Z   # (site administrators only: another token prints the 403).
2026-10-16T19:11:12.356Z   echo "scheduler: $(curl -sS "$DIFFINERY/api/v3/diffinery/admin/scheduler" -H "Authorization: Bearer $TOKEN") (now $(date -u +%FT%TZ))"
2026-10-16T19:11:12.356Z   echo "::error::no scheduled run started"
2026-10-16T19:11:12.356Z   exit 1
2026-10-16T19:11:12.356Z fi
2026-10-16T19:11:12.356Z echo "$run" | jq '{id, event, status, conclusion}'
2026-10-16T19:11:12.356Z [ "$(jq -r .conclusion <<<"$run")" = success ] || { echo "::error::the scheduled run did not succeed"; exit 1; }
2026-10-16T19:11:12.356Z ##[endgroup]
2026-10-16T19:11:12.966Z {
2026-10-16T19:11:12.966Z   "id": "39dd68972999489aa70e5128e4bc9d65",
2026-10-16T19:11:12.966Z   "event": "schedule",
2026-10-16T19:11:12.966Z   "status": "completed",
2026-10-16T19:11:12.966Z   "conclusion": "success"
2026-10-16T19:11:12.966Z }
2026-10-16T19:11:13.050Z ##[group]Run curl -sS -o /dev/null -w 'package %{http_code}\n' -X DELETE "$DIFFINERY/api/v3/users/$OWNER/packages/container/${REPO,,}" -H "Authorization: Bearer $TOKEN"
2026-10-16T19:11:13.050Z curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$REPO" -H "Authorization: Bearer $TOKEN"
2026-10-16T19:11:13.050Z [ -z "${PR_REPO:-}" ] || curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$PR_REPO" -H "Authorization: Bearer $TOKEN"
2026-10-16T19:11:13.050Z [ -z "${IMPORT_REPO:-}" ] || curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$IMPORT_REPO" -H "Authorization: Bearer $TOKEN"
2026-10-16T19:11:13.050Z ##[endgroup]
2026-10-16T19:11:13.986Z package 204
2026-10-16T19:11:15.770Z 204
2026-10-16T19:11:17.510Z 204
2026-10-16T19:11:18.675Z 204
2026-10-16T19:11:18.713Z Host: 0% of the vCPUs' time went to other work on the host (steal)
2026-10-16T19:11:18.713Z Job completed with conclusion: success
2026-10-16T19:11:18.714Z Resources: 0.0 of 4 vCPUs busy on average (0.2 at the 95th percentile), peak memory 0.4 GiB of 11.9 GiB, peak disk 1.1 GB of 19.3 GB