2026-10-16T16:16:30.526Z Diffinery runner: job live (Containers, registry, sandboxes, webhooks, schedules, LFS and pull requests) for codician/diffinery@87ba4af0d7a8
2026-10-16T16:16:30.535Z Runner: image diffinery-runner:aad1cf32443727971f9a24c2, in ams19, WEUR, container 296e0ad19cde282fd003abde8669fbb37e957ce0b49d087b17c8703a2d664db3
2026-10-16T16:16:30.535Z Runner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), this job uses what a smaller runner doesn't have; runs-on: diffinery-large (or -medium, -small, -tiny) sets a size
2026-10-16T16:16:30.535Z Host: AMD EPYC (family 25, model 17), 4 vCPUs, 2550 MHz
2026-10-16T16:16:30.535Z Workspace: /workspace/diffinery
2026-10-16T16:16:30.595Z ##[group]Run if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then
2026-10-16T16:16:30.595Z   # Deploy's gate skips a commit that is no longer main's tip (the newer commit's run deploys it):
2026-10-16T16:16:30.595Z   # then nothing new is live, and this run would only test the site as it was.
2026-10-16T16:16:30.595Z   deployed=$(curl -fsS "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/runs/$DEPLOY_RUN/jobs" -H "Authorization: Bearer $GH_TOKEN" | jq -r '[.jobs[] | select(.name == "Deploy to Cloudflare") | .conclusion][0] // "unknown"' || echo unknown)
2026-10-16T16:16:30.595Z   if [ "$deployed" = skipped ]; then
2026-10-16T16:16:30.595Z     echo "::notice::Deploy deployed nothing for $HEAD_SHA (main has moved on), so there is nothing new to test"
2026-10-16T16:16:30.595Z     echo "skip=true" >> "$GITHUB_OUTPUT"
2026-10-16T16:16:30.595Z     exit 0
2026-10-16T16:16:30.595Z   fi
2026-10-16T16:16:30.595Z fi
2026-10-16T16:16:30.595Z if [ -z "$TOKEN" ]; then
2026-10-16T16:16:30.595Z   # After a deploy of diffinery.com a missing token is an error: a green run would mean nothing was tested.
2026-10-16T16:16:30.595Z   if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then
2026-10-16T16:16:30.595Z     echo "::error::DIFFINERY_LIVE_TOKEN is not set in the production environment, so nothing was tested. Create a write token at $DIFFINERY/settings/tokens and save it as a production environment secret."
2026-10-16T16:16:30.595Z     exit 1
2026-10-16T16:16:30.596Z   fi
2026-10-16T16:16:30.596Z   echo "::warning::DIFFINERY_LIVE_TOKEN is not set, so the live test is skipped. Create a write token at $DIFFINERY/settings/tokens and save it as a production environment secret."
2026-10-16T16:16:30.596Z   echo "skip=true" >> "$GITHUB_OUTPUT"
2026-10-16T16:16:30.596Z   exit 0
2026-10-16T16:16:30.596Z fi
2026-10-16T16:16:30.596Z login=$(curl -fsS "$DIFFINERY/api/v3/user" -H "Authorization: Bearer $TOKEN" | jq -r .login)
2026-10-16T16:16:30.596Z echo "OWNER=$login" >> "$GITHUB_ENV"
2026-10-16T16:16:30.596Z echo "testing as $login in $login/$REPO"
2026-10-16T16:16:30.596Z env:
2026-10-16T16:16:30.596Z   GH_TOKEN: ***
2026-10-16T16:16:30.596Z   DEPLOY_RUN: 332
2026-10-16T16:16:30.596Z ##[endgroup]
2026-10-16T16:16:31.242Z testing as cnbrkdmrci in cnbrkdmrci/live-333-1
2026-10-16T16:16:31.363Z ##[group]Run set -euo pipefail
2026-10-16T16:16:31.364Z # Layers over Cloudflare's 100 MB request limit (which hosted runners push through
2026-10-16T16:16:31.364Z # the registry relay) take minutes to push and pull. They're pushed on manual runs and
2026-10-16T16:16:31.364Z # whenever the registry, the runner image or this test changed since the last
2026-10-16T16:16:31.364Z # successful live test; other deploys push small images through the same path.
2026-10-16T16:16:31.364Z full=true
2026-10-16T16:16:31.364Z if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then
2026-10-16T16:16:31.364Z   api() { curl -fsS "$DIFFINERY/api/v3/repos/$GITHUB_REPOSITORY$1" -H "Authorization: Bearer $TOKEN"; }
2026-10-16T16:16:31.364Z   last=$(api "/actions/runs?workflow=live-test.yml&status=success&per_page=1" | jq -r '.workflow_runs[0].head_sha // empty' || true)
2026-10-16T16:16:31.364Z   if [ -n "$last" ] && files=$(api "/compare/$last...$HEAD_SHA" | jq -r '.files[].filename'); then
2026-10-16T16:16:31.364Z     grep -qE '^(apps/diffinery/src/registry/|containers/runner/|\.github/workflows/live-test\.yml$)' <<<"$files" || full=false
2026-10-16T16:16:31.364Z     echo "changed since $last: $(wc -l <<<"$files") files"
2026-10-16T16:16:31.364Z   fi
2026-10-16T16:16:31.364Z fi
2026-10-16T16:16:31.364Z if [ "$full" = true ]; then
2026-10-16T16:16:31.364Z   echo "BIG=150000000" >> "$GITHUB_ENV"
2026-10-16T16:16:31.364Z   echo "BUILDX=120000000" >> "$GITHUB_ENV"
2026-10-16T16:16:31.364Z else
2026-10-16T16:16:31.364Z   echo "BIG=5000000" >> "$GITHUB_ENV"
2026-10-16T16:16:31.364Z   echo "BUILDX=4000000" >> "$GITHUB_ENV"
2026-10-16T16:16:31.364Z fi
2026-10-16T16:16:31.364Z echo "registry check: full=$full"
2026-10-16T16:16:31.364Z ##[endgroup]
2026-10-16T16:16:32.468Z changed since 86c0486202914805334ba20765e24f6c1a231d33: 26 files
2026-10-16T16:16:32.468Z registry check: full=true
2026-10-16T16:16:32.587Z ##[group]Run set -euo pipefail
2026-10-16T16:16:32.587Z av="$DIFFINERY/api/avatars/$OWNER"
2026-10-16T16:16:32.587Z # Keep the account's current picture, if it has one, to put it back afterwards.
2026-10-16T16:16:32.587Z had=$(curl -fsS -o before.webp -w '%{content_type}' "$av?s=256&v=1")
2026-10-16T16:16:32.587Z restore() {
2026-10-16T16:16:32.587Z   if [ "$had" = image/webp ]; then
2026-10-16T16:16:32.587Z     curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/webp" --data-binary @before.webp | jq -r '"restored the previous picture: \(.avatar_url)"'
2026-10-16T16:16:32.587Z   else
2026-10-16T16:16:32.587Z     curl -fsS -o /dev/null -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN"
2026-10-16T16:16:32.587Z   fi
2026-10-16T16:16:32.588Z }
2026-10-16T16:16:32.588Z trap restore EXIT
2026-10-16T16:16:32.588Z # A 600×400 PNG gradient; the server crops it to a square and makes small WebPs.
2026-10-16T16:16:32.588Z python3 - <<'EOF'
2026-10-16T16:16:32.588Z import struct, zlib
2026-10-16T16:16:32.588Z w, h = 600, 400
2026-10-16T16:16:32.588Z rows = b"".join(b"\0" + bytes(c for x in range(w) for c in (x * 255 // w, y * 255 // h, 128)) for y in range(h))
2026-10-16T16:16:32.588Z chunk = lambda t, d: struct.pack(">I", len(d)) + t + d + struct.pack(">I", zlib.crc32(t + d))
2026-10-16T16:16:32.588Z open("avatar.png", "wb").write(b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0)) + chunk(b"IDAT", zlib.compress(rows)) + chunk(b"IEND", b""))
2026-10-16T16:16:32.588Z EOF
2026-10-16T16:16:32.588Z url=$(curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/png" --data-binary @avatar.png | jq -r .avatar_url)
2026-10-16T16:16:32.588Z echo "uploaded: $url"
2026-10-16T16:16:32.588Z v=${url##*v=}
2026-10-16T16:16:32.588Z type=$(curl -fsS -o small.webp -w '%{content_type}' "$av?s=64&v=$v")
2026-10-16T16:16:32.588Z [ "$type" = image/webp ] || { echo "::error::expected image/webp, got $type"; exit 1; }
2026-10-16T16:16:32.588Z python3 - <<'EOF'
2026-10-16T16:16:32.588Z import struct, sys
2026-10-16T16:16:32.588Z b = open("small.webp", "rb").read()
2026-10-16T16:16:32.588Z ok = b[:4] == b"RIFF" and b[8:12] == b"WEBP"
2026-10-16T16:16:32.588Z if b[12:16] == b"VP8 ":
2026-10-16T16:16:32.588Z     size = (struct.unpack("<H", b[26:28])[0] & 0x3FFF, struct.unpack("<H", b[28:30])[0] & 0x3FFF)
2026-10-16T16:16:32.588Z elif b[12:16] == b"VP8X":
2026-10-16T16:16:32.588Z     size = (int.from_bytes(b[24:27], "little") + 1, int.from_bytes(b[27:30], "little") + 1)
2026-10-16T16:16:32.588Z else:
2026-10-16T16:16:32.588Z     size = None
2026-10-16T16:16:32.588Z print(f"64 px avatar: {len(b)} bytes, {size}")
2026-10-16T16:16:32.588Z if not ok or size != (64, 64) or len(b) > 5000:
2026-10-16T16:16:32.588Z     print("::error::the 64 px avatar is not a 64x64 WebP under 5 KB"); sys.exit(1)
2026-10-16T16:16:32.588Z EOF
2026-10-16T16:16:32.588Z curl -fsS -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" >/dev/null
2026-10-16T16:16:32.588Z # A `v` that is not current bypasses the edge cache, so this sees the removal from any colo.
2026-10-16T16:16:32.588Z type=$(curl -fsS -o /dev/null -w '%{content_type}' "$av?s=64&v=1")
2026-10-16T16:16:32.588Z [[ "$type" == image/svg+xml* ]] || { echo "::error::after removal expected the initials SVG, got $type"; exit 1; }
2026-10-16T16:16:32.588Z echo "removed: initials again ($type)"
2026-10-16T16:16:32.588Z ##[endgroup]
2026-10-16T16:16:34.516Z uploaded: https://diffinery.com/api/avatars/cnbrkdmrci?v=1792167393
2026-10-16T16:16:34.965Z 64 px avatar: 256 bytes, (64, 64)
2026-10-16T16:16:35.928Z removed: initials again (image/svg+xml; charset=utf-8)
2026-10-16T16:16:39.060Z restored the previous picture: https://diffinery.com/api/avatars/cnbrkdmrci?v=1792167396
2026-10-16T16:16:39.145Z ##[group]Run set -euo pipefail
2026-10-16T16:16:39.145Z check() { # path, content type, text it must contain
2026-10-16T16:16:39.145Z   body=$(curl -fsS -D /tmp/h "$DIFFINERY$1")
2026-10-16T16:16:39.145Z   grep -qi "content-type: $2" /tmp/h || { echo "::error::$1 is not $2"; exit 1; }
2026-10-16T16:16:39.145Z   grep -qF -- "$3" <<<"$body" || { echo "::error::$1 doesn't contain: $3"; exit 1; }
2026-10-16T16:16:39.145Z   echo "$1 ok ($(wc -c <<<"$body") bytes)"
2026-10-16T16:16:39.145Z }
2026-10-16T16:16:39.145Z check /docs "text/html" "Overview"
2026-10-16T16:16:39.145Z check /docs/actions/workflow-syntax "text/html" "View as Markdown"
2026-10-16T16:16:39.145Z check /docs/quickstart.md "text/markdown" "# Quickstart"
2026-10-16T16:16:39.145Z check /llms.txt "text/plain" "/docs/actions/workflow-syntax.md"
2026-10-16T16:16:39.145Z check /llms-full.txt "text/plain" "# REST API reference"
2026-10-16T16:16:39.145Z check /docs/api/openapi.json "application/json" '"openapi": "3.1.0"'
2026-10-16T16:16:39.145Z check /-/cli/diffinery.mjs "text/javascript" "#!/usr/bin/env node"
2026-10-16T16:16:39.145Z md=$(curl -fsS -H "Accept: text/markdown" "$DIFFINERY/docs/agents/mcp")
2026-10-16T16:16:39.145Z grep -q "^# MCP" <<<"$md" || { echo "::error::Accept: text/markdown didn't return Markdown"; exit 1; }
2026-10-16T16:16:39.145Z curl -fsS "$DIFFINERY/-/cli/diffinery.mjs" -o /tmp/diffinery.mjs && node /tmp/diffinery.mjs --version
2026-10-16T16:16:39.145Z ##[endgroup]
2026-10-16T16:16:39.245Z /docs ok (84701 bytes)
2026-10-16T16:16:39.543Z /docs/actions/workflow-syntax ok (170431 bytes)
2026-10-16T16:16:39.600Z /docs/quickstart.md ok (16327 bytes)
2026-10-16T16:16:39.705Z /llms.txt ok (17618 bytes)
2026-10-16T16:16:39.962Z /llms-full.txt ok (2386848 bytes)
2026-10-16T16:16:40.088Z /docs/api/openapi.json ok (803582 bytes)
2026-10-16T16:16:40.163Z /-/cli/diffinery.mjs ok (240403 bytes)
2026-10-16T16:16:40.375Z diffinery 0.1.0
2026-10-16T16:16:40.490Z ##[group]Run set -euo pipefail
2026-10-16T16:16:40.490Z s=$(curl -sS -w '\n%{http_code}' "$DIFFINERY/api/v3/diffinery/admin/email" -H "Authorization: Bearer $TOKEN")
2026-10-16T16:16:40.490Z code=${s##*$'\n'}; s=${s%$'\n'*}
2026-10-16T16:16:40.490Z # Only a site administrator's token reads the email settings, and the live-test account isn't one.
2026-10-16T16:16:40.490Z if [ "$code" = 403 ]; then echo "::notice::skipped: the live-test token isn't a site administrator's"; exit 0; fi
2026-10-16T16:16:40.490Z [ "$code" = 200 ] || { echo "::error::/diffinery/admin/email answered $code"; exit 1; }
2026-10-16T16:16:40.490Z echo "$s" | jq '{sending, queue, from, last_24h}'
2026-10-16T16:16:40.490Z [ "$(jq -r .sending <<<"$s")" = true ] || { echo "::error::the Worker has no Email Sending binding"; exit 1; }
2026-10-16T16:16:40.490Z [ "$(jq -r .queue <<<"$s")" = true ] || { echo "::error::the Worker has no mail queue binding"; exit 1; }
2026-10-16T16:16:40.490Z failed=$(jq -r .last_24h.failed <<<"$s")
2026-10-16T16:16:40.490Z [ "$failed" = 0 ] || echo "::warning::$failed emails failed in the last 24 hours; see Settings -> Email in site administration"
2026-10-16T16:16:40.490Z ##[endgroup]
2026-10-16T16:16:40.773Z {
2026-10-16T16:16:40.773Z   "sending": true,
2026-10-16T16:16:40.773Z   "queue": true,
2026-10-16T16:16:40.773Z   "from": "notifications@diffinery.com",
2026-10-16T16:16:40.773Z   "last_24h": {
2026-10-16T16:16:40.773Z     "sent": 33,
2026-10-16T16:16:40.773Z     "failed": 0,
2026-10-16T16:16:40.773Z     "skipped": 0
2026-10-16T16:16:40.773Z   }
2026-10-16T16:16:40.773Z }
2026-10-16T16:16:40.993Z ##[group]Run set -euo pipefail
2026-10-16T16:16:40.993Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T16:16:40.993Z api POST /user/repos "{\"name\":\"$REPO\",\"private\":true}" >/dev/null
2026-10-16T16:16:40.993Z # Webhooks may only reach public hosts other than Diffinery itself; the push's delivery goes to example.com.
2026-10-16T16:16:40.993Z code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST "$DIFFINERY/api/v3/repos/$OWNER/$REPO/hooks" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data "{\"config\":{\"url\":\"$DIFFINERY/healthz\"},\"events\":[\"push\"]}")
2026-10-16T16:16:40.993Z [ "$code" = 422 ] || { echo "::error::a webhook to Diffinery itself answered $code, not 422"; exit 1; }
2026-10-16T16:16:40.993Z api POST "/repos/$OWNER/$REPO/hooks" "{\"config\":{\"url\":\"https://example.com/diffinery-live-test\"},\"events\":[\"push\"]}" >/dev/null
2026-10-16T16:16:40.993Z echo "created $OWNER/$REPO"
2026-10-16T16:16:40.993Z ##[endgroup]
2026-10-16T16:16:43.973Z created cnbrkdmrci/live-333-1
2026-10-16T16:16:44.061Z ##[group]Run set -euo pipefail
2026-10-16T16:16:44.061Z # A deploy's container rollout updates instances over a while after it starts, and an
2026-10-16T16:16:44.061Z # instance not yet updated starts jobs on the previous runner image. Jobs report their
2026-10-16T16:16:44.061Z # image (`runner.image`), so a probe workflow runs until three jobs in a row land on the
2026-10-16T16:16:44.061Z # image the deploy set (/meta's runner_image) before the Docker and registry checks.
2026-10-16T16:16:44.061Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T16:16:44.061Z expected=$(api GET /meta | jq -r '.runner_image // empty')
2026-10-16T16:16:44.061Z if [ -z "$expected" ]; then
2026-10-16T16:16:44.061Z   echo "::warning::/meta doesn't name the deployed runner image, so jobs aren't checked against it"
2026-10-16T16:16:44.061Z   exit 0
2026-10-16T16:16:44.061Z fi
2026-10-16T16:16:44.061Z echo "DEPLOYED_RUNNER_IMAGE=$expected" >> "$GITHUB_ENV"
2026-10-16T16:16:44.061Z mkdir -p src/.github/workflows && cd src
2026-10-16T16:16:44.061Z git init -q -b main
2026-10-16T16:16:44.061Z git config user.name "Live test" && git config user.email "live-test@diffinery.com"
2026-10-16T16:16:44.061Z cat > .github/workflows/probe.yml <<'EOF'
2026-10-16T16:16:44.061Z on: workflow_dispatch
2026-10-16T16:16:44.061Z jobs:
2026-10-16T16:16:44.061Z   probe:
2026-10-16T16:16:44.061Z     runs-on: ubuntu-latest
2026-10-16T16:16:44.061Z     strategy:
2026-10-16T16:16:44.061Z       matrix:
2026-10-16T16:16:44.061Z         n: [1, 2, 3]
2026-10-16T16:16:44.061Z     steps:
2026-10-16T16:16:44.061Z       - run: echo "probe ok"
2026-10-16T16:16:44.061Z EOF
2026-10-16T16:16:44.061Z git add -A && git commit -q -m "Runner image probe"
2026-10-16T16:16:44.061Z git push -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" main
2026-10-16T16:16:44.061Z deadline=$(( $(date +%s) + 15 * 60 ))
2026-10-16T16:16:44.061Z while :; do
2026-10-16T16:16:44.061Z   before=$(api GET "/repos/$OWNER/$REPO/actions/runs?event=workflow_dispatch" | jq '.workflow_runs | length')
2026-10-16T16:16:44.061Z   api POST "/repos/$OWNER/$REPO/actions/workflows/probe.yml/dispatches" '{"ref":"main"}' >/dev/null
2026-10-16T16:16:44.061Z   run=""
2026-10-16T16:16:44.061Z   # Up to 10 minutes: a job turned away from a replaced image starts again after 30 s, 1, 2 and 4 minutes.
2026-10-16T16:16:44.061Z   for i in $(seq 1 120); do
2026-10-16T16:16:44.061Z     runs=$(api GET "/repos/$OWNER/$REPO/actions/runs?event=workflow_dispatch")
2026-10-16T16:16:44.061Z     if [ "$(jq '.workflow_runs | length' <<<"$runs")" -gt "$before" ]; then
2026-10-16T16:16:44.061Z       run=$(jq -c '.workflow_runs[0]' <<<"$runs")
2026-10-16T16:16:44.061Z       [ "$(jq -r .status <<<"$run")" = completed ] && break
2026-10-16T16:16:44.061Z     fi
2026-10-16T16:16:44.061Z     sleep 5
2026-10-16T16:16:44.061Z   done
2026-10-16T16:16:44.061Z   [ -n "$run" ] || { echo "::error::the probe workflow didn't start"; exit 1; }
2026-10-16T16:16:44.061Z   probe=$(api GET "/repos/$OWNER/$REPO/actions/runs/$(jq -r .id <<<"$run")/jobs")
2026-10-16T16:16:44.061Z   images=$(jq -r '.jobs[] | .runner.image // "no image reported"' <<<"$probe")
2026-10-16T16:16:44.061Z   echo "probe jobs ran on: $(sort <<<"$images" | uniq -c | sed 's/^ *//' | paste -sd ','), started again $(jq '[.jobs[].placementTries // 0] | add // 0' <<<"$probe") time(s) in all"
2026-10-16T16:16:44.061Z   [ "$(grep -cxF "$expected" <<<"$images" || true)" = 3 ] && { echo "jobs start on $expected"; exit 0; }
2026-10-16T16:16:44.061Z   if [ "$(date +%s)" -ge "$deadline" ]; then
2026-10-16T16:16:44.061Z     echo "::error::15 minutes after the deploy, jobs still start on a runner image other than the deployed $expected"
2026-10-16T16:16:44.061Z     exit 1
2026-10-16T16:16:44.061Z   fi
2026-10-16T16:16:44.061Z   sleep 20
2026-10-16T16:16:44.061Z done
2026-10-16T16:16:44.061Z ##[endgroup]
2026-10-16T16:16:59.664Z probe jobs ran on: 3 diffinery-runner:aad1cf32443727971f9a24c2, started again 0 time(s) in all
2026-10-16T16:16:59.667Z jobs start on diffinery-runner:aad1cf32443727971f9a24c2
2026-10-16T16:16:59.779Z ##[group]Run set -euo pipefail
2026-10-16T16:16:59.779Z mkdir -p src/.github/workflows && cd src
2026-10-16T16:16:59.779Z git init -q -b main
2026-10-16T16:16:59.779Z git config user.name "Live test" && git config user.email "live-test@diffinery.com"
2026-10-16T16:16:59.779Z git lfs install --local >/dev/null
2026-10-16T16:16:59.779Z git lfs track "*.bin" >/dev/null
2026-10-16T16:16:59.779Z head -c 3145728 /dev/urandom > blob.bin
2026-10-16T16:16:59.779Z sha256sum blob.bin | cut -d' ' -f1 > ../blob.sha
2026-10-16T16:16:59.779Z echo "# $REPO" > README.md
2026-10-16T16:16:59.779Z cat > .github/workflows/ci.yml <<'EOF'
2026-10-16T16:16:59.779Z on: push
2026-10-16T16:16:59.779Z jobs:
2026-10-16T16:16:59.779Z   hosted:
2026-10-16T16:16:59.779Z     runs-on: ubuntu-latest
2026-10-16T16:16:59.779Z     strategy:
2026-10-16T16:16:59.779Z       matrix:
2026-10-16T16:16:59.779Z         n: [1, 2]
2026-10-16T16:16:59.779Z     steps:
2026-10-16T16:16:59.779Z       - uses: actions/checkout@v4
2026-10-16T16:16:59.779Z       - run: echo "live ok ${{ matrix.n }} $(cat README.md)"
2026-10-16T16:16:59.779Z       # Passwordless sudo, as on GitHub's runners (`sudo apt-get install ...` is common).
2026-10-16T16:16:59.779Z       - run: sudo -n true && echo "sudo ok $(sudo -n id -u)"
2026-10-16T16:16:59.779Z   docker:
2026-10-16T16:16:59.779Z     runs-on: ubuntu-latest
2026-10-16T16:16:59.779Z     services:
2026-10-16T16:16:59.779Z       cache:
2026-10-16T16:16:59.779Z         image: redis:7-alpine
2026-10-16T16:16:59.779Z         ports: ["6379"]
2026-10-16T16:16:59.779Z         options: --health-cmd "redis-cli ping" --health-interval 1s --health-retries 30
2026-10-16T16:16:59.779Z     steps:
2026-10-16T16:16:59.779Z       - run: |
2026-10-16T16:16:59.779Z           printf 'FROM alpine:3.20\nRUN echo built > /msg\nCMD ["cat", "/msg"]\n' > Dockerfile
2026-10-16T16:16:59.779Z           docker build -q -t live-image .
2026-10-16T16:16:59.779Z           echo "docker ok $(docker run --rm live-image)"
2026-10-16T16:16:59.779Z           exec 3<>/dev/tcp/127.0.0.1/${{ job.services.cache.ports['6379'] }}
2026-10-16T16:16:59.779Z           printf 'PING\r\n' >&3
2026-10-16T16:16:59.779Z           read -r line <&3
2026-10-16T16:16:59.779Z           echo "service ok ${line%$'\r'}"
2026-10-16T16:16:59.779Z   # Container registry: a layer pushed with the job's GITHUB_TOKEN (over Cloudflare's
2026-10-16T16:16:59.779Z   # 100 MB request limit on full runs), plus the docker/*-action route most ghcr.io
2026-10-16T16:16:59.779Z   # workflows use. __BIG__ and __BUILDX__ are the layer sizes.
2026-10-16T16:16:59.779Z   publish:
2026-10-16T16:16:59.779Z     runs-on: ubuntu-latest
2026-10-16T16:16:59.779Z     permissions:
2026-10-16T16:16:59.779Z       packages: write
2026-10-16T16:16:59.779Z     steps:
2026-10-16T16:16:59.779Z       - run: |
2026-10-16T16:16:59.779Z           image="diffinery.com/${GITHUB_REPOSITORY,,}"
2026-10-16T16:16:59.779Z           echo "${{ secrets.GITHUB_TOKEN }}" | docker login diffinery.com -u "${{ github.actor }}" --password-stdin
2026-10-16T16:16:59.779Z           head -c __BIG__ /dev/urandom > big.bin
2026-10-16T16:16:59.779Z           sha256sum big.bin | cut -d' ' -f1 > big.sha
2026-10-16T16:16:59.779Z           printf 'FROM scratch\nCOPY big.bin big.sha /\n' > Dockerfile
2026-10-16T16:16:59.779Z           docker build -q -t "$image:live" .
2026-10-16T16:16:59.779Z           docker push "$image:live"
2026-10-16T16:16:59.779Z           echo "pushed $(cat big.sha)"
2026-10-16T16:16:59.779Z   buildx:
2026-10-16T16:16:59.779Z     runs-on: ubuntu-latest
2026-10-16T16:16:59.779Z     permissions:
2026-10-16T16:16:59.779Z       packages: write
2026-10-16T16:16:59.779Z     steps:
2026-10-16T16:16:59.779Z       - run: |
2026-10-16T16:16:59.779Z           echo "IMAGE=diffinery.com/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
2026-10-16T16:16:59.779Z           head -c __BUILDX__ /dev/urandom > big.bin
2026-10-16T16:16:59.779Z           printf 'FROM scratch\nCOPY big.bin /\n' > Dockerfile
2026-10-16T16:16:59.779Z       - uses: docker/setup-buildx-action@v3
2026-10-16T16:16:59.779Z       - uses: docker/login-action@v3
2026-10-16T16:16:59.779Z         with:
2026-10-16T16:16:59.779Z           registry: diffinery.com
2026-10-16T16:16:59.779Z           username: ${{ github.actor }}
2026-10-16T16:16:59.779Z           password: ${{ secrets.GITHUB_TOKEN }}
2026-10-16T16:16:59.779Z       - uses: docker/build-push-action@v6
2026-10-16T16:16:59.779Z         with:
2026-10-16T16:16:59.779Z           context: .
2026-10-16T16:16:59.779Z           push: true
2026-10-16T16:16:59.779Z           tags: ${{ env.IMAGE }}:buildx
2026-10-16T16:16:59.779Z   pull:
2026-10-16T16:16:59.779Z     needs: [publish, buildx]
2026-10-16T16:16:59.779Z     runs-on: ubuntu-latest
2026-10-16T16:16:59.779Z     permissions:
2026-10-16T16:16:59.779Z       packages: read
2026-10-16T16:16:59.779Z     steps:
2026-10-16T16:16:59.779Z       - run: |
2026-10-16T16:16:59.779Z           image="diffinery.com/${GITHUB_REPOSITORY,,}"
2026-10-16T16:16:59.779Z           echo "${{ secrets.GITHUB_TOKEN }}" | docker login diffinery.com -u "${{ github.actor }}" --password-stdin
2026-10-16T16:16:59.779Z           docker pull -q "$image:live"
2026-10-16T16:16:59.779Z           id=$(docker create "$image:live" true)
2026-10-16T16:16:59.779Z           docker cp "$id:/big.bin" big.bin && docker cp "$id:/big.sha" big.sha
2026-10-16T16:16:59.779Z           [ "$(sha256sum big.bin | cut -d' ' -f1)" = "$(cat big.sha)" ] && echo "registry ok $(stat -c %s big.bin) bytes"
2026-10-16T16:16:59.779Z           docker pull -q "$image:buildx"
2026-10-16T16:16:59.779Z           id=$(docker create "$image:buildx" true)
2026-10-16T16:16:59.779Z           docker cp "$id:/big.bin" buildx.bin
2026-10-16T16:16:59.779Z           echo "buildx ok $(stat -c %s buildx.bin) bytes"
2026-10-16T16:16:59.779Z EOF
2026-10-16T16:16:59.779Z cat > .github/workflows/tick.yml <<'EOF'
2026-10-16T16:16:59.779Z on:
2026-10-16T16:16:59.779Z   schedule:
2026-10-16T16:16:59.779Z     - cron: "*/5 * * * *"
2026-10-16T16:16:59.779Z jobs:
2026-10-16T16:16:59.779Z   tick:
2026-10-16T16:16:59.779Z     runs-on: ubuntu-latest
2026-10-16T16:16:59.779Z     steps:
2026-10-16T16:16:59.779Z       - run: echo "scheduled ok"
2026-10-16T16:16:59.779Z EOF
2026-10-16T16:16:59.779Z sed -i "s/__BIG__/$BIG/g; s/__BUILDX__/$BUILDX/g" .github/workflows/ci.yml
2026-10-16T16:16:59.779Z git add -A && git commit -q -m "Live test"
2026-10-16T16:16:59.779Z git push -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" main
2026-10-16T16:16:59.779Z git lfs ls-files
2026-10-16T16:16:59.779Z ##[endgroup]
2026-10-16T16:16:59.791Z warning: re-init: ignored --initial-branch=main
2026-10-16T16:17:03.335Z Uploading LFS objects: 100% (1/1), 3.1 MB | 0 B/s, done.
2026-10-16T16:17:06.118Z f603f1b112 * blob.bin
2026-10-16T16:17:06.233Z ##[group]Run set -euo pipefail
2026-10-16T16:17:06.233Z page() { curl -fsS "$DIFFINERY$1" -H "Authorization: Bearer $TOKEN"; }
2026-10-16T16:17:06.233Z has() { grep -qF -- "$2" <<<"$1" || { echo "::error::$3"; exit 1; }; }
2026-10-16T16:17:06.233Z html=$(page "/$OWNER/$REPO/blob/main/.github/workflows/ci.yml")
2026-10-16T16:17:06.233Z has "$html" '<td class="sh">' "the workflow file is not syntax highlighted"
2026-10-16T16:17:06.233Z has "$html" "--shiki-dark" "highlighted code has no dark theme colours"
2026-10-16T16:17:06.233Z has "$html" "@view-transition{navigation:auto}" "pages don't opt in to view transitions"
2026-10-16T16:17:06.233Z has "$html" "prefers-reduced-motion:no-preference" "view transitions ignore reduced motion"
2026-10-16T16:17:06.233Z has "$(page /settings/appearance)" 'name="appearance"' "Settings -> Appearance has no theme choice"
2026-10-16T16:17:06.233Z has "$(page /notifications)" 'href="/settings/notifications"' "the notifications page doesn't link to notification settings"
2026-10-16T16:17:06.233Z code=$(curl -sS -o /tmp/out -w '%{http_code}' -X POST "$DIFFINERY/api/v3/user/repos" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data "{\"name\":\"$REPO-internal\",\"visibility\":\"internal\"}")
2026-10-16T16:17:06.233Z [ "$code" = 422 ] || { echo "::error::visibility internal got $code, expected 422"; curl -sS -o /dev/null -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$REPO-internal" -H "Authorization: Bearer $TOKEN"; exit 1; }
2026-10-16T16:17:06.233Z org=$(page /api/v3/user/orgs | jq -r '.[0].login // empty')
2026-10-16T16:17:06.233Z if [ -n "$org" ]; then
2026-10-16T16:17:06.233Z   perm=$(page "/api/v3/orgs/$org" | jq -r '.default_repository_permission // empty')
2026-10-16T16:17:06.233Z   case "$perm" in none|read|write|admin) echo "$org's base permission: $perm" ;; *) echo "::error::GET /orgs/$org has no default_repository_permission"; exit 1 ;; esac
2026-10-16T16:17:06.233Z   # A malformed rename is refused before anything is written (422 for owners, 403 for everyone else).
2026-10-16T16:17:06.233Z   code=$(curl -sS -o /tmp/out -w '%{http_code}' -X PATCH "$DIFFINERY/api/v3/orgs/$org" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"name":123}')
2026-10-16T16:17:06.233Z   case "$code" in 422|403) ;; *) echo "::error::PATCH /orgs/$org with a numeric name got $code"; cat /tmp/out; exit 1 ;; esac
2026-10-16T16:17:06.233Z fi
2026-10-16T16:17:06.233Z page "/api/v3/repos/$OWNER/$REPO/invitations" | jq -e 'type == "array"' >/dev/null || { echo "::error::GET /repos/$OWNER/$REPO/invitations doesn't list pending invitations"; exit 1; }
2026-10-16T16:17:06.233Z tools=$(curl -fsS -X POST "$DIFFINERY/mcp" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" -H "accept: application/json, text/event-stream" --data '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq -r '.result.tools[].name')
2026-10-16T16:17:06.233Z for t in get_organization list_invitations revoke_invitation; do grep -qx "$t" <<<"$tools" || { echo "::error::the MCP server has no $t tool"; exit 1; }; done
2026-10-16T16:17:06.233Z echo "highlighting, Appearance, notification settings link, view transitions, visibility, organization and invitation checks passed"
2026-10-16T16:17:06.233Z ##[endgroup]
2026-10-16T16:17:08.330Z ALCAN's base permission: write
2026-10-16T16:17:09.157Z highlighting, Appearance, notification settings link, view transitions, visibility, organization and invitation checks passed
2026-10-16T16:17:09.221Z ##[group]Run set -euo pipefail
2026-10-16T16:17:09.221Z page() { curl -fsS "$DIFFINERY$1" -H "Authorization: Bearer $TOKEN"; }
2026-10-16T16:17:09.221Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T16:17:09.221Z code() { curl -sS -o /tmp/out -w '%{http_code}' -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; }
2026-10-16T16:17:09.221Z fail() { echo "::error::$1"; cat /tmp/out 2>/dev/null || true; exit 1; }
2026-10-16T16:17:09.221Z has() { grep -qF -- "$2" <<<"$1" || fail "$3"; }
2026-10-16T16:17:09.221Z R="/repos/$OWNER/$REPO"
2026-10-16T16:17:09.221Z has "$(page /new/import)" 'diffy/hello-world' "the importer's placeholder isn't Diffy"
2026-10-16T16:17:09.221Z has "$(page "/$OWNER/$REPO/settings/actions")" 'Allow GitHub Actions to create and approve pull requests' "repository settings have no Actions page"
2026-10-16T16:17:09.221Z # Milestones: created closed, checked before an issue edit is saved, shown in the response, and filterable.
2026-10-16T16:17:09.221Z [ "$(api POST "$R/milestones" '{"title":"Shipped","state":"closed"}' | jq -r .state)" = closed ] || fail "POST milestones ignored state"
2026-10-16T16:17:09.221Z ms=$(api POST "$R/milestones" '{"title":"Live v1"}' | jq -r .number)
2026-10-16T16:17:09.221Z n=$(api POST "$R/issues" '{"title":"Planned"}' | jq -r .number)
2026-10-16T16:17:09.221Z [ "$(code PATCH "$R/issues/$n" '{"title":"Renamed","milestone":999999}')" = 422 ] || fail "an unknown milestone wasn't refused with 422"
2026-10-16T16:17:09.221Z [ "$(api GET "$R/issues/$n" | jq -r .title)" = Planned ] || fail "a refused milestone edit saved the title"
2026-10-16T16:17:09.221Z [ "$(api PATCH "$R/issues/$n" "{\"milestone\":$ms}" | jq -r .milestone.number)" = "$ms" ] || fail "PATCH issue doesn't return the new milestone"
2026-10-16T16:17:09.221Z [ "$(api GET "$R/issues?milestone=$ms&state=all" | jq -r '[.[].number] | join(",")')" = "$n" ] || fail "issues aren't filtered by milestone"
2026-10-16T16:17:09.221Z loc=$(curl -sS -o /dev/null -w '%{redirect_url}' "$DIFFINERY/$OWNER/$REPO/milestone/$ms" -H "Authorization: Bearer $TOKEN")
2026-10-16T16:17:09.221Z has "$loc" "/issues?milestone=$ms" "the milestone link doesn't open its issue list"
2026-10-16T16:17:09.221Z # Repository variable deletes ignore letter case.
2026-10-16T16:17:09.221Z [ "$(code PUT "$R/actions/variables/LIVE_CASE" '{"value":"x"}')" = 204 ] || fail "couldn't set a repository variable"
2026-10-16T16:17:09.221Z [ "$(code DELETE "$R/actions/variables/live_case")" = 204 ] || fail "couldn't delete a repository variable"
2026-10-16T16:17:09.221Z [ "$(code GET "$R/actions/variables/LIVE_CASE")" = 404 ] || fail "deleting a variable in lower case left it in place"
2026-10-16T16:17:09.221Z org=$(page /api/v3/user/orgs | jq -r '.[0].login // empty')
2026-10-16T16:17:09.221Z if [ -n "$org" ]; then
2026-10-16T16:17:09.221Z   # Deleting an organization variable or secret that doesn't exist is a 404 (403 for someone who isn't an admin).
2026-10-16T16:17:09.221Z   for path in variables secrets; do
2026-10-16T16:17:09.221Z     c=$(code DELETE "/orgs/$org/actions/$path/LIVE_NEVER_SET_$GITHUB_RUN_ID")
2026-10-16T16:17:09.221Z     case "$c" in 404|403) ;; *) fail "DELETE of a missing organization $path entry got $c" ;; esac
2026-10-16T16:17:09.221Z   done
2026-10-16T16:17:09.221Z fi
2026-10-16T16:17:09.221Z echo "Diffy placeholders, Actions settings page, milestone and variable checks passed"
2026-10-16T16:17:09.221Z ##[endgroup]
2026-10-16T16:17:14.790Z Diffy placeholders, Actions settings page, milestone and variable checks passed
2026-10-16T16:17:14.887Z ##[group]Run set -euo pipefail
2026-10-16T16:17:14.887Z api() { curl -fsS "$DIFFINERY/api/v3$1" -H "Authorization: Bearer $TOKEN"; }
2026-10-16T16:17:14.887Z for i in $(seq 1 90); do
2026-10-16T16:17:14.887Z   run=$(api "/repos/$OWNER/$REPO/actions/runs?event=push" | jq -c '.workflow_runs[0] // empty')
2026-10-16T16:17:14.887Z   [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break
2026-10-16T16:17:14.887Z   sleep 10
2026-10-16T16:17:14.887Z done
2026-10-16T16:17:14.887Z echo "$run" | jq '{id, status, conclusion}'
2026-10-16T16:17:14.887Z id=$(jq -r .id <<<"$run")
2026-10-16T16:17:14.887Z jobs=$(api "/repos/$OWNER/$REPO/actions/runs/$id/jobs")
2026-10-16T16:17:14.887Z # placementTries: times a job went back in line (no machine, or a runner on a replaced image turned away).
2026-10-16T16:17:14.887Z # restarts: times it started over because the platform replaced its runner before its steps ran.
2026-10-16T16:17:14.887Z jq -r '.jobs[] | "  \(.name): \(.conclusion)\(if .failure then " - " + (.failure.message // "") else "" end)\(try " (\((.completed_at | fromdateiso8601) - (.started_at | fromdateiso8601))s)" catch "")\(if (.placementTries // 0) > 0 then ", started again \(.placementTries) time(s)" else "" end)\(if (.restarts // 0) > 0 then ", restarted \(.restarts) time(s) after its runner was replaced" else "" end)"' <<<"$jobs"
2026-10-16T16:17:14.887Z if [ "$(jq -r .conclusion <<<"$run")" != success ]; then
2026-10-16T16:17:14.887Z   for job in $(jq -r '.jobs[] | select(.conclusion == "failure" or .conclusion == "timed_out") | .id' <<<"$jobs"); do
2026-10-16T16:17:14.887Z     echo "::group::Last log lines of job $job"
2026-10-16T16:17:14.887Z     api "/repos/$OWNER/$REPO/actions/jobs/$job/logs" | tail -n 80 || true
2026-10-16T16:17:14.887Z     echo "::endgroup::"
2026-10-16T16:17:14.887Z   done
2026-10-16T16:17:14.887Z   echo "::error::the push run did not succeed"
2026-10-16T16:17:14.887Z   exit 1
2026-10-16T16:17:14.887Z fi
2026-10-16T16:17:14.887Z if [ -n "${DEPLOYED_RUNNER_IMAGE:-}" ]; then
2026-10-16T16:17:14.887Z   # Every job ran the deployed runner, so these checks test what was just deployed.
2026-10-16T16:17:14.887Z   stale=$(jq -r --arg want "$DEPLOYED_RUNNER_IMAGE" '.jobs[] | select(.runner.image != $want) | "\(.name) on \(.runner.image // "no image reported")"' <<<"$jobs")
2026-10-16T16:17:14.887Z   [ -z "$stale" ] || { echo "::error::jobs ran on a runner image other than the deployed $DEPLOYED_RUNNER_IMAGE: $(paste -sd ';' <<<"$stale")"; exit 1; }
2026-10-16T16:17:14.887Z   echo "every job ran on $DEPLOYED_RUNNER_IMAGE"
2026-10-16T16:17:14.887Z fi
2026-10-16T16:17:14.887Z for job in $(jq -r '.jobs[] | select(.name | startswith("hosted")) | .id' <<<"$jobs"); do
2026-10-16T16:17:14.887Z   log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs")
2026-10-16T16:17:14.887Z   grep -F "live ok" <<<"$log" | grep -F "# $REPO" || { echo "::error::job $job did not print its line (checkout or run step failed)"; exit 1; }
2026-10-16T16:17:14.887Z   grep -F "sudo ok 0" <<<"$log" || { echo "::error::job $job could not run sudo without a password"; exit 1; }
2026-10-16T16:17:14.887Z done
2026-10-16T16:17:14.887Z job=$(jq -r '.jobs[] | select(.name == "docker") | .id' <<<"$jobs")
2026-10-16T16:17:14.887Z log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs")
2026-10-16T16:17:14.887Z grep -F "docker ok built" <<<"$log" || { echo "::error::docker build or run failed on a hosted runner"; exit 1; }
2026-10-16T16:17:14.887Z grep -F "service ok +PONG" <<<"$log" || { echo "::error::the redis service container was not reachable"; exit 1; }
2026-10-16T16:17:14.887Z job=$(jq -r '.jobs[] | select(.name == "pull") | .id' <<<"$jobs")
2026-10-16T16:17:14.887Z log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs")
2026-10-16T16:17:14.887Z grep -F "registry ok $BIG bytes" <<<"$log" || { echo "::error::the image pushed with a $BIG-byte layer did not come back intact from the registry"; exit 1; }
2026-10-16T16:17:14.887Z grep -F "buildx ok $BUILDX bytes" <<<"$log" || { echo "::error::the image pushed by docker/build-push-action did not come back from the registry"; exit 1; }
2026-10-16T16:17:14.887Z api "/users/$OWNER/packages/container/${REPO,,}/versions" | jq -c '.[] | {tags: .metadata.container.tags, size, platforms}'
2026-10-16T16:17:14.887Z ##[endgroup]