Diffinery runner: job live (Containers, registry, sandboxes, webhooks, schedules, LFS and pull requests) for codician/diffinery@b4c01c57c9d3Runner: image diffinery-runner:0d9b89e0a449e5faecf2b19c, in ams08, WEUR, container 77c51ac20d3fe56ace7beac6652c61377e0f4135780241deefae2febfd3849ebRunner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), this job uses what a smaller runner doesn't have; runs-on: diffinery-large (or -medium, -small, -tiny) sets a sizeHost: AMD EPYC (family 25, model 1), 4 vCPUs, 2000 MHzWorkspace: /workspace/diffineryHost: 3% of the vCPUs' time went to other work on the host (steal)Job completed with conclusion: failureResources: 0.2 of 4 vCPUs busy on average (0.5 at the 95th percentile), peak memory 0.3 GiB of 11.9 GiB, peak disk 1.1 GB of 19.3 GB

##[group]Run if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then  # Deploy's gate skips a commit that is no longer main's tip (the newer commit's run deploys it):  # then nothing new is live, and this run would only test the site as it was.  deployed=$(curl -fsS "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/runs/$DEPLOY_RUN/jobs" -H "Authorization: Bearer $GH_TOKEN" | jq -r '[.jobs[] | select(.name == "Deploy to Cloudflare") | .conclusion][0] // "unknown"' || echo unknown)  if [ "$deployed" = skipped ]; then    echo "::notice::Deploy deployed nothing for $HEAD_SHA (main has moved on), so there is nothing new to test"    echo "skip=true" >> "$GITHUB_OUTPUT"    exit 0  fifiif [ -z "$TOKEN" ]; then  # After a deploy of diffinery.com a missing token is an error: a green run would mean nothing was tested.  if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then    echo "::error::DIFFINERY_LIVE_TOKEN is not set in the production environment, so nothing was tested. Create a write token at $DIFFINERY/settings/tokens and save it as a production environment secret."    exit 1  fi  echo "::warning::DIFFINERY_LIVE_TOKEN is not set, so the live test is skipped. Create a write token at $DIFFINERY/settings/tokens and save it as a production environment secret."  echo "skip=true" >> "$GITHUB_OUTPUT"  exit 0filogin=$(curl -fsS "$DIFFINERY/api/v3/user" -H "Authorization: Bearer $TOKEN" | jq -r .login)echo "OWNER=$login" >> "$GITHUB_ENV"echo "testing as $login in $login/$REPO"env:  GH_TOKEN: ***  DEPLOY_RUN: 247##[endgroup]testing as cnbrkdmrci in cnbrkdmrci/live-248-1

##[group]Run set -euo pipefail# Layers over Cloudflare's 100 MB request limit (which hosted runners push through# the registry relay) take minutes to push and pull. They're pushed on manual runs and# whenever the registry, the runner image or this test changed since the last# successful live test; other deploys push small images through the same path.full=trueif [ "$GITHUB_EVENT_NAME" = workflow_run ]; then  api() { curl -fsS "$DIFFINERY/api/v3/repos/$GITHUB_REPOSITORY$1" -H "Authorization: Bearer $TOKEN"; }  last=$(api "/actions/runs?workflow=live-test.yml&status=success&per_page=1" | jq -r '.workflow_runs[0].head_sha // empty' || true)  if [ -n "$last" ] && files=$(api "/compare/$last...$HEAD_SHA" | jq -r '.files[].filename'); then    grep -qE '^(apps/diffinery/src/registry/|containers/runner/|\.github/workflows/live-test\.yml$)' <<<"$files" || full=false    echo "changed since $last: $(wc -l <<<"$files") files"  fifiif [ "$full" = true ]; then  echo "BIG=150000000" >> "$GITHUB_ENV"  echo "BUILDX=120000000" >> "$GITHUB_ENV"else  echo "BIG=5000000" >> "$GITHUB_ENV"  echo "BUILDX=4000000" >> "$GITHUB_ENV"fiecho "registry check: full=$full"##[endgroup]changed since b4c01c57c9d38fa429705b6201ba1a1e6d601454: 1 filesregistry check: full=false

##[group]Run set -euo pipefailav="$DIFFINERY/api/avatars/$OWNER"# Keep the account's current picture, if it has one, to put it back afterwards.had=$(curl -fsS -o before.webp -w '%{content_type}' "$av?s=256&v=1")restore() {  if [ "$had" = image/webp ]; then    curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/webp" --data-binary @before.webp | jq -r '"restored the previous picture: \(.avatar_url)"'  else    curl -fsS -o /dev/null -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN"  fi}trap restore EXIT# A 600×400 PNG gradient; the server crops it to a square and makes small WebPs.python3 - <<'EOF'import struct, zlibw, h = 600, 400rows = b"".join(b"\0" + bytes(c for x in range(w) for c in (x * 255 // w, y * 255 // h, 128)) for y in range(h))chunk = lambda t, d: struct.pack(">I", len(d)) + t + d + struct.pack(">I", zlib.crc32(t + d))open("avatar.png", "wb").write(b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0)) + chunk(b"IDAT", zlib.compress(rows)) + chunk(b"IEND", b""))EOFurl=$(curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/png" --data-binary @avatar.png | jq -r .avatar_url)echo "uploaded: $url"v=${url##*v=}type=$(curl -fsS -o small.webp -w '%{content_type}' "$av?s=64&v=$v")[ "$type" = image/webp ] || { echo "::error::expected image/webp, got $type"; exit 1; }python3 - <<'EOF'import struct, sysb = open("small.webp", "rb").read()ok = b[:4] == b"RIFF" and b[8:12] == b"WEBP"if b[12:16] == b"VP8 ":    size = (struct.unpack("<H", b[26:28])[0] & 0x3FFF, struct.unpack("<H", b[28:30])[0] & 0x3FFF)elif b[12:16] == b"VP8X":    size = (int.from_bytes(b[24:27], "little") + 1, int.from_bytes(b[27:30], "little") + 1)else:    size = Noneprint(f"64 px avatar: {len(b)} bytes, {size}")if not ok or size != (64, 64) or len(b) > 5000:    print("::error::the 64 px avatar is not a 64x64 WebP under 5 KB"); sys.exit(1)EOFcurl -fsS -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" >/dev/null# A `v` that is not current bypasses the edge cache, so this sees the removal from any colo.type=$(curl -fsS -o /dev/null -w '%{content_type}' "$av?s=64&v=1")[[ "$type" == image/svg+xml* ]] || { echo "::error::after removal expected the initials SVG, got $type"; exit 1; }echo "removed: initials again ($type)"##[endgroup]uploaded: https://diffinery.com/api/avatars/cnbrkdmrci?v=179216280964 px avatar: 256 bytes, (64, 64)curl: (22) The requested URL returned error: 500restored the previous picture: https://diffinery.com/api/avatars/cnbrkdmrci?v=1792162814##[error]Process completed with exit code 22.

##[group]Run curl -sS -o /dev/null -w 'package %{http_code}\n' -X DELETE "$DIFFINERY/api/v3/users/$OWNER/packages/container/${REPO,,}" -H "Authorization: Bearer $TOKEN"curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$REPO" -H "Authorization: Bearer $TOKEN"[ -z "${PR_REPO:-}" ] || curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$PR_REPO" -H "Authorization: Bearer $TOKEN"[ -z "${IMPORT_REPO:-}" ] || curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$IMPORT_REPO" -H "Authorization: Bearer $TOKEN"##[endgroup]package 404404