2026-10-25T22:43:48.597Z Diffinery runner: job live (Containers, registry, sandboxes, webhooks, schedules, LFS and pull requests) for codician/diffinery@18106774c0d9 2026-10-25T22:43:48.608Z Runner: image diffinery-runner:4d3bf17f06575e64ab4155b3, in cdg07, WEUR, container 7b99f79ae3863f5f6ae6aa6de86eb9604de9773053a6562ac846f200e0f9369c 2026-10-25T22:43:48.609Z Runner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), this job uses what a smaller runner doesn't have; runs-on: diffinery-large (or -medium, -small, -tiny) sets a size 2026-10-25T22:43:48.609Z Host: AMD EPYC (family 25, model 17), 4 vCPUs, 2550 MHz 2026-10-25T22:43:48.609Z Workspace: /workspace/diffinery 2026-10-25T22:43:48.662Z ##[group]Run if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then 2026-10-25T22:43:48.662Z # Deploy's gate skips a commit that is no longer main's tip (the newer commit's run deploys it): 2026-10-25T22:43:48.662Z # then nothing new is live, and this run would only test the site as it was. 2026-10-25T22:43:48.662Z deployed=$(curl -fsS "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/runs/$DEPLOY_RUN/jobs" -H "Authorization: Bearer $GH_TOKEN" | jq -r '[.jobs[] | select(.name == "Deploy to Cloudflare") | .conclusion][0] // "unknown"' || echo unknown) 2026-10-25T22:43:48.662Z if [ "$deployed" = skipped ]; then 2026-10-25T22:43:48.662Z echo "::notice::Deploy deployed nothing for $HEAD_SHA (main has moved on), so there is nothing new to test" 2026-10-25T22:43:48.662Z echo "skip=true" >> "$GITHUB_OUTPUT" 2026-10-25T22:43:48.662Z exit 0 2026-10-25T22:43:48.662Z fi 2026-10-25T22:43:48.662Z fi 2026-10-25T22:43:48.662Z if [ -z "$TOKEN" ]; then 2026-10-25T22:43:48.662Z # After a deploy of diffinery.com a missing token is an error: a green run would mean nothing was tested. 2026-10-25T22:43:48.662Z if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then 2026-10-25T22:43:48.662Z echo "::error::DIFFINERY_LIVE_TOKEN is not set in the production environment, so nothing was tested. Create a write token at $DIFFINERY/settings/tokens and save it as a production environment secret." 2026-10-25T22:43:48.662Z exit 1 2026-10-25T22:43:48.662Z fi 2026-10-25T22:43:48.662Z echo "::warning::DIFFINERY_LIVE_TOKEN is not set, so the live test is skipped. Create a write token at $DIFFINERY/settings/tokens and save it as a production environment secret." 2026-10-25T22:43:48.662Z echo "skip=true" >> "$GITHUB_OUTPUT" 2026-10-25T22:43:48.662Z exit 0 2026-10-25T22:43:48.662Z fi 2026-10-25T22:43:48.662Z login=$(curl -fsS "$DIFFINERY/api/v3/user" -H "Authorization: Bearer $TOKEN" | jq -r .login) 2026-10-25T22:43:48.662Z echo "OWNER=$login" >> "$GITHUB_ENV" 2026-10-25T22:43:48.662Z echo "testing as $login in $login/$REPO" 2026-10-25T22:43:48.662Z env: 2026-10-25T22:43:48.662Z GH_TOKEN: *** 2026-10-25T22:43:48.662Z DEPLOY_RUN: 1047 2026-10-25T22:43:48.662Z ##[endgroup] 2026-10-25T22:43:49.625Z testing as cnbrkdmrci in cnbrkdmrci/live-1048-1 2026-10-25T22:43:49.730Z ##[group]Run set -euo pipefail 2026-10-25T22:43:49.730Z # Layers over Cloudflare's 100 MB request limit (which hosted runners push through 2026-10-25T22:43:49.730Z # the registry relay) take minutes to push and pull. They're pushed on manual runs and 2026-10-25T22:43:49.730Z # whenever the registry, the runner image or this test changed since the last 2026-10-25T22:43:49.730Z # successful live test; other deploys push small images through the same path. 2026-10-25T22:43:49.730Z full=true 2026-10-25T22:43:49.730Z if [ "$GITHUB_EVENT_NAME" = workflow_run ]; then 2026-10-25T22:43:49.730Z api() { curl -fsS "$DIFFINERY/api/v3/repos/$GITHUB_REPOSITORY$1" -H "Authorization: Bearer $TOKEN"; } 2026-10-25T22:43:49.730Z last=$(api "/actions/runs?workflow=live-test.yml&status=success&per_page=1" | jq -r '.workflow_runs[0].head_sha // empty' || true) 2026-10-25T22:43:49.730Z if [ -n "$last" ] && files=$(api "/compare/$last...$HEAD_SHA" | jq -r '.files[].filename'); then 2026-10-25T22:43:49.730Z grep -qE '^(apps/diffinery/src/registry/|containers/runner/|\.github/workflows/live-test\.yml$)' <<<"$files" || full=false 2026-10-25T22:43:49.730Z echo "changed since $last: $(wc -l <<<"$files") files" 2026-10-25T22:43:49.730Z fi 2026-10-25T22:43:49.730Z fi 2026-10-25T22:43:49.730Z if [ "$full" = true ]; then 2026-10-25T22:43:49.730Z echo "BIG=150000000" >> "$GITHUB_ENV" 2026-10-25T22:43:49.730Z echo "BUILDX=120000000" >> "$GITHUB_ENV" 2026-10-25T22:43:49.730Z else 2026-10-25T22:43:49.730Z echo "BIG=5000000" >> "$GITHUB_ENV" 2026-10-25T22:43:49.730Z echo "BUILDX=4000000" >> "$GITHUB_ENV" 2026-10-25T22:43:49.730Z fi 2026-10-25T22:43:49.730Z echo "registry check: full=$full" 2026-10-25T22:43:49.730Z ##[endgroup] 2026-10-25T22:43:50.255Z changed since 86148f73cd8b3215ae82063fabbb9a5bde718327: 1 files 2026-10-25T22:43:50.255Z registry check: full=false 2026-10-25T22:43:50.362Z ##[group]Run set -euo pipefail 2026-10-25T22:43:50.362Z av="$DIFFINERY/api/avatars/$OWNER" 2026-10-25T22:43:50.362Z # Keep the account's current picture, if it has one, to put it back afterwards. 2026-10-25T22:43:50.362Z had=$(curl -fsS -o before.webp -w '%{content_type}' "$av?s=256&v=1") 2026-10-25T22:43:50.362Z restore() { 2026-10-25T22:43:50.362Z if [ "$had" = image/webp ]; then 2026-10-25T22:43:50.362Z curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/webp" --data-binary @before.webp | jq -r '"restored the previous picture: \(.avatar_url)"' 2026-10-25T22:43:50.362Z else 2026-10-25T22:43:50.362Z curl -fsS -o /dev/null -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" 2026-10-25T22:43:50.362Z fi 2026-10-25T22:43:50.362Z } 2026-10-25T22:43:50.362Z trap restore EXIT 2026-10-25T22:43:50.362Z # A 600×400 PNG gradient; the server crops it to a square and makes small WebPs. 2026-10-25T22:43:50.362Z python3 - <<'EOF' 2026-10-25T22:43:50.362Z import struct, zlib 2026-10-25T22:43:50.362Z w, h = 600, 400 2026-10-25T22:43:50.362Z rows = b"".join(b"\0" + bytes(c for x in range(w) for c in (x * 255 // w, y * 255 // h, 128)) for y in range(h)) 2026-10-25T22:43:50.362Z chunk = lambda t, d: struct.pack(">I", len(d)) + t + d + struct.pack(">I", zlib.crc32(t + d)) 2026-10-25T22:43:50.362Z open("avatar.png", "wb").write(b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", struct.pack(">IIBBBBB", w, h, 8, 2, 0, 0, 0)) + chunk(b"IDAT", zlib.compress(rows)) + chunk(b"IEND", b"")) 2026-10-25T22:43:50.362Z EOF 2026-10-25T22:43:50.362Z url=$(curl -fsS -X PUT "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" -H "content-type: image/png" --data-binary @avatar.png | jq -r .avatar_url) 2026-10-25T22:43:50.362Z echo "uploaded: $url" 2026-10-25T22:43:50.362Z v=${url##*v=} 2026-10-25T22:43:50.362Z type=$(curl -fsS -o small.webp -w '%{content_type}' "$av?s=64&v=$v") 2026-10-25T22:43:50.362Z [ "$type" = image/webp ] || { echo "::error::expected image/webp, got $type"; exit 1; } 2026-10-25T22:43:50.362Z python3 - <<'EOF' 2026-10-25T22:43:50.362Z import struct, sys 2026-10-25T22:43:50.362Z b = open("small.webp", "rb").read() 2026-10-25T22:43:50.362Z ok = b[:4] == b"RIFF" and b[8:12] == b"WEBP" 2026-10-25T22:43:50.362Z if b[12:16] == b"VP8 ": 2026-10-25T22:43:50.362Z size = (struct.unpack(" 5000: 2026-10-25T22:43:50.362Z print("::error::the 64 px avatar is not a 64x64 WebP under 5 KB"); sys.exit(1) 2026-10-25T22:43:50.362Z EOF 2026-10-25T22:43:50.362Z curl -fsS -X DELETE "$DIFFINERY/api/v3/user/avatar" -H "Authorization: Bearer $TOKEN" >/dev/null 2026-10-25T22:43:50.362Z # A `v` that is not current bypasses the edge cache, so this sees the removal from any colo. 2026-10-25T22:43:50.362Z type=$(curl -fsS -o /dev/null -w '%{content_type}' "$av?s=64&v=1") 2026-10-25T22:43:50.362Z [[ "$type" == image/svg+xml* ]] || { echo "::error::after removal expected the initials SVG, got $type"; exit 1; } 2026-10-25T22:43:50.362Z echo "removed: initials again ($type)" 2026-10-25T22:43:50.362Z ##[endgroup] 2026-10-25T22:43:52.289Z uploaded: https://diffinery.com/api/avatars/cnbrkdmrci?v=1792968231 2026-10-25T22:43:52.618Z 64 px avatar: 256 bytes, (64, 64) 2026-10-25T22:43:53.367Z removed: initials again (image/svg+xml; charset=utf-8) 2026-10-25T22:43:55.788Z restored the previous picture: https://diffinery.com/api/avatars/cnbrkdmrci?v=1792968233 2026-10-25T22:43:55.875Z ##[group]Run set -euo pipefail 2026-10-25T22:43:55.875Z check() { # path, content type, text it must contain 2026-10-25T22:43:55.875Z body=$(curl -fsS -D /tmp/h "$DIFFINERY$1") 2026-10-25T22:43:55.875Z grep -qi "content-type: $2" /tmp/h || { echo "::error::$1 is not $2"; exit 1; } 2026-10-25T22:43:55.875Z grep -qF -- "$3" <<<"$body" || { echo "::error::$1 doesn't contain: $3"; exit 1; } 2026-10-25T22:43:55.875Z echo "$1 ok ($(wc -c <<<"$body") bytes)" 2026-10-25T22:43:55.875Z } 2026-10-25T22:43:55.875Z check /docs "text/html" "Overview" 2026-10-25T22:43:55.875Z check /docs/actions/workflow-syntax "text/html" "View as Markdown" 2026-10-25T22:43:55.875Z check /docs/quickstart.md "text/markdown" "# Quickstart" 2026-10-25T22:43:55.875Z check /llms.txt "text/plain" "/docs/actions/workflow-syntax.md" 2026-10-25T22:43:55.875Z check /llms-full.txt "text/plain" "# REST API reference" 2026-10-25T22:43:55.875Z check /docs/api/openapi.json "application/json" '"openapi": "3.1.0"' 2026-10-25T22:43:55.875Z check /-/cli/diffinery.mjs "text/javascript" "#!/usr/bin/env node" 2026-10-25T22:43:55.875Z md=$(curl -fsS -H "Accept: text/markdown" "$DIFFINERY/docs/agents/mcp") 2026-10-25T22:43:55.875Z grep -q "^# MCP" <<<"$md" || { echo "::error::Accept: text/markdown didn't return Markdown"; exit 1; } 2026-10-25T22:43:55.875Z curl -fsS "$DIFFINERY/-/cli/diffinery.mjs" -o /tmp/diffinery.mjs && node /tmp/diffinery.mjs --version 2026-10-25T22:43:55.875Z ##[endgroup] 2026-10-25T22:43:55.964Z /docs ok (104154 bytes) 2026-10-25T22:43:56.180Z /docs/actions/workflow-syntax ok (190219 bytes) 2026-10-25T22:43:56.233Z /docs/quickstart.md ok (17955 bytes) 2026-10-25T22:43:56.292Z /llms.txt ok (32378 bytes) 2026-10-25T22:43:56.574Z /llms-full.txt ok (2851870 bytes) 2026-10-25T22:43:56.683Z /docs/api/openapi.json ok (865461 bytes) 2026-10-25T22:43:56.753Z /-/cli/diffinery.mjs ok (259606 bytes) 2026-10-25T22:43:56.907Z diffinery 0.1.0 2026-10-25T22:43:56.986Z ##[group]Run set -euo pipefail 2026-10-25T22:43:56.986Z s=$(curl -sS -w '\n%{http_code}' "$DIFFINERY/api/v3/diffinery/admin/email" -H "Authorization: Bearer $TOKEN") 2026-10-25T22:43:56.986Z code=${s##*$'\n'}; s=${s%$'\n'*} 2026-10-25T22:43:56.986Z # Only a site administrator's token reads the email settings, and the live-test account isn't one. 2026-10-25T22:43:56.986Z if [ "$code" = 403 ]; then echo "::notice::skipped: the live-test token isn't a site administrator's"; exit 0; fi 2026-10-25T22:43:56.986Z [ "$code" = 200 ] || { echo "::error::/diffinery/admin/email answered $code"; exit 1; } 2026-10-25T22:43:56.987Z echo "$s" | jq '{sending, queue, from, last_24h}' 2026-10-25T22:43:56.987Z [ "$(jq -r .sending <<<"$s")" = true ] || { echo "::error::the Worker has no Email Sending binding"; exit 1; } 2026-10-25T22:43:56.987Z [ "$(jq -r .queue <<<"$s")" = true ] || { echo "::error::the Worker has no mail queue binding"; exit 1; } 2026-10-25T22:43:56.987Z failed=$(jq -r .last_24h.failed <<<"$s") 2026-10-25T22:43:56.987Z [ "$failed" = 0 ] || echo "::warning::$failed emails failed in the last 24 hours; see Settings -> Email in site administration" 2026-10-25T22:43:56.987Z ##[endgroup] 2026-10-25T22:43:57.196Z { 2026-10-25T22:43:57.196Z "sending": true, 2026-10-25T22:43:57.196Z "queue": true, 2026-10-25T22:43:57.196Z "from": "notifications@diffinery.com", 2026-10-25T22:43:57.196Z "last_24h": { 2026-10-25T22:43:57.196Z "sent": 12, 2026-10-25T22:43:57.196Z "failed": 0, 2026-10-25T22:43:57.196Z "skipped": 0 2026-10-25T22:43:57.196Z } 2026-10-25T22:43:57.196Z } 2026-10-25T22:43:57.273Z ##[group]Run set -euo pipefail 2026-10-25T22:43:57.273Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } 2026-10-25T22:43:57.273Z api POST /user/repos "{\"name\":\"$REPO\",\"private\":true}" >/dev/null 2026-10-25T22:43:57.273Z # Webhooks may only reach public hosts other than Diffinery itself; the push's delivery goes to example.com. 2026-10-25T22:43:57.273Z code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST "$DIFFINERY/api/v3/repos/$OWNER/$REPO/hooks" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data "{\"config\":{\"url\":\"$DIFFINERY/healthz\"},\"events\":[\"push\"]}") 2026-10-25T22:43:57.273Z [ "$code" = 422 ] || { echo "::error::a webhook to Diffinery itself answered $code, not 422"; exit 1; } 2026-10-25T22:43:57.273Z api POST "/repos/$OWNER/$REPO/hooks" "{\"config\":{\"url\":\"https://example.com/diffinery-live-test\"},\"events\":[\"push\"]}" >/dev/null 2026-10-25T22:43:57.273Z echo "created $OWNER/$REPO" 2026-10-25T22:43:57.273Z ##[endgroup] 2026-10-25T22:43:59.084Z created cnbrkdmrci/live-1048-1 2026-10-25T22:43:59.157Z ##[group]Run set -euo pipefail 2026-10-25T22:43:59.157Z # A deploy's container rollout updates instances over a while after it starts, and an 2026-10-25T22:43:59.157Z # instance not yet updated starts jobs on the previous runner image. Jobs report their 2026-10-25T22:43:59.157Z # image (`runner.image`), so a probe workflow runs until three jobs in a row land on the 2026-10-25T22:43:59.157Z # image the deploy set (/meta's runner_image) before the Docker and registry checks. 2026-10-25T22:43:59.157Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } 2026-10-25T22:43:59.157Z expected=$(api GET /meta | jq -r '.runner_image // empty') 2026-10-25T22:43:59.157Z if [ -z "$expected" ]; then 2026-10-25T22:43:59.157Z echo "::warning::/meta doesn't name the deployed runner image, so jobs aren't checked against it" 2026-10-25T22:43:59.157Z exit 0 2026-10-25T22:43:59.157Z fi 2026-10-25T22:43:59.157Z echo "DEPLOYED_RUNNER_IMAGE=$expected" >> "$GITHUB_ENV" 2026-10-25T22:43:59.157Z mkdir -p src/.github/workflows && cd src 2026-10-25T22:43:59.157Z git init -q -b main 2026-10-25T22:43:59.157Z git config user.name "Live test" && git config user.email "live-test@diffinery.com" 2026-10-25T22:43:59.157Z cat > .github/workflows/probe.yml <<'EOF' 2026-10-25T22:43:59.157Z on: workflow_dispatch 2026-10-25T22:43:59.157Z jobs: 2026-10-25T22:43:59.157Z probe: 2026-10-25T22:43:59.157Z runs-on: ubuntu-latest 2026-10-25T22:43:59.157Z strategy: 2026-10-25T22:43:59.157Z matrix: 2026-10-25T22:43:59.157Z n: [1, 2, 3] 2026-10-25T22:43:59.157Z steps: 2026-10-25T22:43:59.157Z - run: echo "probe ok" 2026-10-25T22:43:59.157Z EOF 2026-10-25T22:43:59.157Z git add -A && git commit -q -m "Runner image probe" 2026-10-25T22:43:59.157Z git push -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" main 2026-10-25T22:43:59.157Z deadline=$(( $(date +%s) + 15 * 60 )) 2026-10-25T22:43:59.157Z while :; do 2026-10-25T22:43:59.157Z before=$(api GET "/repos/$OWNER/$REPO/actions/runs?event=workflow_dispatch" | jq '.workflow_runs | length') 2026-10-25T22:43:59.157Z api POST "/repos/$OWNER/$REPO/actions/workflows/probe.yml/dispatches" '{"ref":"main"}' >/dev/null 2026-10-25T22:43:59.157Z run="" 2026-10-25T22:43:59.157Z # Up to 10 minutes: a job turned away from a replaced image starts again after 30 s, 1, 2 and 4 minutes. 2026-10-25T22:43:59.157Z for i in $(seq 1 120); do 2026-10-25T22:43:59.157Z runs=$(api GET "/repos/$OWNER/$REPO/actions/runs?event=workflow_dispatch") 2026-10-25T22:43:59.157Z if [ "$(jq '.workflow_runs | length' <<<"$runs")" -gt "$before" ]; then 2026-10-25T22:43:59.157Z run=$(jq -c '.workflow_runs[0]' <<<"$runs") 2026-10-25T22:43:59.157Z [ "$(jq -r .status <<<"$run")" = completed ] && break 2026-10-25T22:43:59.157Z fi 2026-10-25T22:43:59.157Z sleep 5 2026-10-25T22:43:59.157Z done 2026-10-25T22:43:59.157Z [ -n "$run" ] || { echo "::error::the probe workflow didn't start"; exit 1; } 2026-10-25T22:43:59.157Z probe=$(api GET "/repos/$OWNER/$REPO/actions/runs/$(jq -r .id <<<"$run")/jobs") 2026-10-25T22:43:59.157Z images=$(jq -r '.jobs[] | .runner.image // "no image reported"' <<<"$probe") 2026-10-25T22:43:59.157Z echo "probe jobs ran on: $(sort <<<"$images" | uniq -c | sed 's/^ *//' | paste -sd ','), started again $(jq '[.jobs[].placementTries // 0] | add // 0' <<<"$probe") time(s) in all" 2026-10-25T22:43:59.157Z [ "$(grep -cxF "$expected" <<<"$images" || true)" = 3 ] && { echo "jobs start on $expected"; exit 0; } 2026-10-25T22:43:59.157Z if [ "$(date +%s)" -ge "$deadline" ]; then 2026-10-25T22:43:59.157Z echo "::error::15 minutes after the deploy, jobs still start on a runner image other than the deployed $expected" 2026-10-25T22:43:59.157Z exit 1 2026-10-25T22:43:59.157Z fi 2026-10-25T22:43:59.157Z sleep 20 2026-10-25T22:43:59.157Z done 2026-10-25T22:43:59.157Z ##[endgroup] 2026-10-25T22:44:13.621Z probe jobs ran on: 3 diffinery-runner:4d3bf17f06575e64ab4155b3, started again 0 time(s) in all 2026-10-25T22:44:13.623Z jobs start on diffinery-runner:4d3bf17f06575e64ab4155b3 2026-10-25T22:44:13.719Z ##[group]Run set -euo pipefail 2026-10-25T22:44:13.719Z mkdir -p src/.github/workflows && cd src 2026-10-25T22:44:13.719Z git init -q -b main 2026-10-25T22:44:13.719Z git config user.name "Live test" && git config user.email "live-test@diffinery.com" 2026-10-25T22:44:13.719Z git lfs install --local >/dev/null 2026-10-25T22:44:13.719Z git lfs track "*.bin" >/dev/null 2026-10-25T22:44:13.719Z head -c 3145728 /dev/urandom > blob.bin 2026-10-25T22:44:13.719Z sha256sum blob.bin | cut -d' ' -f1 > ../blob.sha 2026-10-25T22:44:13.719Z echo "# $REPO" > README.md 2026-10-25T22:44:13.719Z cat > .github/workflows/ci.yml <<'EOF' 2026-10-25T22:44:13.719Z on: push 2026-10-25T22:44:13.719Z jobs: 2026-10-25T22:44:13.719Z hosted: 2026-10-25T22:44:13.719Z runs-on: ubuntu-latest 2026-10-25T22:44:13.719Z strategy: 2026-10-25T22:44:13.719Z matrix: 2026-10-25T22:44:13.719Z n: [1, 2] 2026-10-25T22:44:13.719Z steps: 2026-10-25T22:44:13.719Z - uses: actions/checkout@v4 2026-10-25T22:44:13.719Z - run: echo "live ok ${{ matrix.n }} $(cat README.md)" 2026-10-25T22:44:13.719Z # Passwordless sudo, as on GitHub's runners (`sudo apt-get install ...` is common). 2026-10-25T22:44:13.719Z - run: sudo -n true && echo "sudo ok $(sudo -n id -u)" 2026-10-25T22:44:13.719Z docker: 2026-10-25T22:44:13.719Z runs-on: ubuntu-latest 2026-10-25T22:44:13.719Z services: 2026-10-25T22:44:13.719Z cache: 2026-10-25T22:44:13.719Z image: redis:7-alpine 2026-10-25T22:44:13.719Z ports: ["6379"] 2026-10-25T22:44:13.719Z options: --health-cmd "redis-cli ping" --health-interval 1s --health-retries 30 2026-10-25T22:44:13.719Z steps: 2026-10-25T22:44:13.719Z - run: | 2026-10-25T22:44:13.719Z printf 'FROM alpine:3.20\nRUN echo built > /msg\nCMD ["cat", "/msg"]\n' > Dockerfile 2026-10-25T22:44:13.719Z docker build -q -t live-image . 2026-10-25T22:44:13.719Z echo "docker ok $(docker run --rm live-image)" 2026-10-25T22:44:13.719Z exec 3<>/dev/tcp/127.0.0.1/${{ job.services.cache.ports['6379'] }} 2026-10-25T22:44:13.719Z printf 'PING\r\n' >&3 2026-10-25T22:44:13.719Z read -r line <&3 2026-10-25T22:44:13.719Z echo "service ok ${line%$'\r'}" 2026-10-25T22:44:13.719Z # Container registry: a layer pushed with the job's GITHUB_TOKEN (over Cloudflare's 2026-10-25T22:44:13.719Z # 100 MB request limit on full runs), plus the docker/*-action route most ghcr.io 2026-10-25T22:44:13.719Z # workflows use. __BIG__ and __BUILDX__ are the layer sizes. 2026-10-25T22:44:13.719Z publish: 2026-10-25T22:44:13.719Z runs-on: ubuntu-latest 2026-10-25T22:44:13.719Z permissions: 2026-10-25T22:44:13.719Z packages: write 2026-10-25T22:44:13.719Z steps: 2026-10-25T22:44:13.719Z - run: | 2026-10-25T22:44:13.719Z image="diffinery.com/${GITHUB_REPOSITORY,,}" 2026-10-25T22:44:13.719Z echo "${{ secrets.GITHUB_TOKEN }}" | docker login diffinery.com -u "${{ github.actor }}" --password-stdin 2026-10-25T22:44:13.719Z head -c __BIG__ /dev/urandom > big.bin 2026-10-25T22:44:13.719Z sha256sum big.bin | cut -d' ' -f1 > big.sha 2026-10-25T22:44:13.719Z printf 'FROM scratch\nCOPY big.bin big.sha /\n' > Dockerfile 2026-10-25T22:44:13.719Z docker build -q -t "$image:live" . 2026-10-25T22:44:13.719Z docker push "$image:live" 2026-10-25T22:44:13.719Z echo "pushed $(cat big.sha)" 2026-10-25T22:44:13.719Z buildx: 2026-10-25T22:44:13.719Z runs-on: ubuntu-latest 2026-10-25T22:44:13.719Z permissions: 2026-10-25T22:44:13.719Z packages: write 2026-10-25T22:44:13.719Z steps: 2026-10-25T22:44:13.719Z - run: | 2026-10-25T22:44:13.719Z echo "IMAGE=diffinery.com/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" 2026-10-25T22:44:13.719Z head -c __BUILDX__ /dev/urandom > big.bin 2026-10-25T22:44:13.719Z printf 'FROM scratch\nCOPY big.bin /\n' > Dockerfile 2026-10-25T22:44:13.719Z - uses: docker/setup-buildx-action@v3 2026-10-25T22:44:13.719Z - uses: docker/login-action@v3 2026-10-25T22:44:13.719Z with: 2026-10-25T22:44:13.719Z registry: diffinery.com 2026-10-25T22:44:13.719Z username: ${{ github.actor }} 2026-10-25T22:44:13.719Z password: ${{ secrets.GITHUB_TOKEN }} 2026-10-25T22:44:13.719Z - uses: docker/build-push-action@v6 2026-10-25T22:44:13.719Z with: 2026-10-25T22:44:13.719Z context: . 2026-10-25T22:44:13.719Z push: true 2026-10-25T22:44:13.719Z tags: ${{ env.IMAGE }}:buildx 2026-10-25T22:44:13.719Z pull: 2026-10-25T22:44:13.719Z needs: [publish, buildx] 2026-10-25T22:44:13.719Z runs-on: ubuntu-latest 2026-10-25T22:44:13.719Z permissions: 2026-10-25T22:44:13.719Z packages: read 2026-10-25T22:44:13.719Z steps: 2026-10-25T22:44:13.719Z - run: | 2026-10-25T22:44:13.719Z image="diffinery.com/${GITHUB_REPOSITORY,,}" 2026-10-25T22:44:13.719Z echo "${{ secrets.GITHUB_TOKEN }}" | docker login diffinery.com -u "${{ github.actor }}" --password-stdin 2026-10-25T22:44:13.719Z docker pull -q "$image:live" 2026-10-25T22:44:13.719Z id=$(docker create "$image:live" true) 2026-10-25T22:44:13.719Z docker cp "$id:/big.bin" big.bin && docker cp "$id:/big.sha" big.sha 2026-10-25T22:44:13.719Z [ "$(sha256sum big.bin | cut -d' ' -f1)" = "$(cat big.sha)" ] && echo "registry ok $(stat -c %s big.bin) bytes" 2026-10-25T22:44:13.719Z docker pull -q "$image:buildx" 2026-10-25T22:44:13.719Z id=$(docker create "$image:buildx" true) 2026-10-25T22:44:13.719Z docker cp "$id:/big.bin" buildx.bin 2026-10-25T22:44:13.719Z echo "buildx ok $(stat -c %s buildx.bin) bytes" 2026-10-25T22:44:13.719Z EOF 2026-10-25T22:44:13.719Z cat > .github/workflows/tick.yml <<'EOF' 2026-10-25T22:44:13.719Z on: 2026-10-25T22:44:13.719Z schedule: 2026-10-25T22:44:13.719Z - cron: "*/5 * * * *" 2026-10-25T22:44:13.719Z jobs: 2026-10-25T22:44:13.719Z tick: 2026-10-25T22:44:13.719Z runs-on: ubuntu-latest 2026-10-25T22:44:13.719Z steps: 2026-10-25T22:44:13.719Z - run: echo "scheduled ok" 2026-10-25T22:44:13.719Z EOF 2026-10-25T22:44:13.719Z sed -i "s/__BIG__/$BIG/g; s/__BUILDX__/$BUILDX/g" .github/workflows/ci.yml 2026-10-25T22:44:13.719Z git add -A && git commit -q -m "Live test" 2026-10-25T22:44:13.719Z git push -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" main 2026-10-25T22:44:13.719Z git lfs ls-files 2026-10-25T22:44:13.719Z ##[endgroup] 2026-10-25T22:44:13.729Z warning: re-init: ignored --initial-branch=main 2026-10-25T22:44:18.684Z 5f5ff32c96 * blob.bin 2026-10-25T22:44:18.764Z ##[group]Run set -euo pipefail 2026-10-25T22:44:18.764Z page() { curl -fsS "$DIFFINERY$1" -H "Authorization: Bearer $TOKEN"; } 2026-10-25T22:44:18.764Z has() { grep -qF -- "$2" <<<"$1" || { echo "::error::$3"; exit 1; }; } 2026-10-25T22:44:18.764Z html=$(page "/$OWNER/$REPO/blob/main/.github/workflows/ci.yml") 2026-10-25T22:44:18.764Z has "$html" '' "the workflow file is not syntax highlighted" 2026-10-25T22:44:18.764Z has "$html" "--shiki-dark" "highlighted code has no dark theme colours" 2026-10-25T22:44:18.764Z has "$html" "@view-transition{navigation:auto}" "pages don't opt in to view transitions" 2026-10-25T22:44:18.764Z has "$html" "prefers-reduced-motion:no-preference" "view transitions ignore reduced motion" 2026-10-25T22:44:18.764Z has "$(page /settings/appearance)" 'name="appearance"' "Settings -> Appearance has no theme choice" 2026-10-25T22:44:18.764Z has "$(page /notifications)" 'href="/settings/notifications"' "the notifications page doesn't link to notification settings" 2026-10-25T22:44:18.764Z code=$(curl -sS -o /tmp/out -w '%{http_code}' -X POST "$DIFFINERY/api/v3/user/repos" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data "{\"name\":\"$REPO-internal\",\"visibility\":\"internal\"}") 2026-10-25T22:44:18.764Z [ "$code" = 422 ] || { echo "::error::visibility internal got $code, expected 422"; curl -sS -o /dev/null -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$REPO-internal" -H "Authorization: Bearer $TOKEN"; exit 1; } 2026-10-25T22:44:18.764Z org=$(page /api/v3/user/orgs | jq -r '.[0].login // empty') 2026-10-25T22:44:18.764Z if [ -n "$org" ]; then 2026-10-25T22:44:18.764Z perm=$(page "/api/v3/orgs/$org" | jq -r '.default_repository_permission // empty') 2026-10-25T22:44:18.764Z case "$perm" in none|read|write|admin) echo "$org's base permission: $perm" ;; *) echo "::error::GET /orgs/$org has no default_repository_permission"; exit 1 ;; esac 2026-10-25T22:44:18.764Z # A malformed rename is refused before anything is written (422 for owners, 403 for everyone else). 2026-10-25T22:44:18.764Z code=$(curl -sS -o /tmp/out -w '%{http_code}' -X PATCH "$DIFFINERY/api/v3/orgs/$org" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"name":123}') 2026-10-25T22:44:18.764Z case "$code" in 422|403) ;; *) echo "::error::PATCH /orgs/$org with a numeric name got $code"; cat /tmp/out; exit 1 ;; esac 2026-10-25T22:44:18.764Z fi 2026-10-25T22:44:18.764Z page "/api/v3/repos/$OWNER/$REPO/invitations" | jq -e 'type == "array"' >/dev/null || { echo "::error::GET /repos/$OWNER/$REPO/invitations doesn't list pending invitations"; exit 1; } 2026-10-25T22:44:18.764Z tools=$(curl -fsS -X POST "$DIFFINERY/mcp" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" -H "accept: application/json, text/event-stream" --data '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq -r '.result.tools[].name') 2026-10-25T22:44:18.764Z for t in get_organization list_invitations revoke_invitation; do grep -qx "$t" <<<"$tools" || { echo "::error::the MCP server has no $t tool"; exit 1; }; done 2026-10-25T22:44:18.764Z echo "highlighting, Appearance, notification settings link, view transitions, visibility, organization and invitation checks passed" 2026-10-25T22:44:18.764Z ##[endgroup] 2026-10-25T22:44:20.577Z codician's base permission: write 2026-10-25T22:44:21.258Z highlighting, Appearance, notification settings link, view transitions, visibility, organization and invitation checks passed 2026-10-25T22:44:21.331Z ##[group]Run set -euo pipefail 2026-10-25T22:44:21.331Z page() { curl -fsS "$DIFFINERY$1" -H "Authorization: Bearer $TOKEN"; } 2026-10-25T22:44:21.331Z api() { curl -fsS -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } 2026-10-25T22:44:21.331Z code() { curl -sS -o /tmp/out -w '%{http_code}' -X "$1" "$DIFFINERY/api/v3$2" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" ${3:+--data "$3"}; } 2026-10-25T22:44:21.331Z fail() { echo "::error::$1"; cat /tmp/out 2>/dev/null || true; exit 1; } 2026-10-25T22:44:21.331Z has() { grep -qF -- "$2" <<<"$1" || fail "$3"; } 2026-10-25T22:44:21.331Z R="/repos/$OWNER/$REPO" 2026-10-25T22:44:21.331Z has "$(page /new/import)" 'diffy/hello-world' "the importer's placeholder isn't Diffy" 2026-10-25T22:44:21.331Z has "$(page "/$OWNER/$REPO/settings/actions")" 'Allow GitHub Actions to create and approve pull requests' "repository settings have no Actions page" 2026-10-25T22:44:21.331Z # Milestones: created closed, checked before an issue edit is saved, shown in the response, and filterable. 2026-10-25T22:44:21.331Z [ "$(api POST "$R/milestones" '{"title":"Shipped","state":"closed"}' | jq -r .state)" = closed ] || fail "POST milestones ignored state" 2026-10-25T22:44:21.331Z ms=$(api POST "$R/milestones" '{"title":"Live v1"}' | jq -r .number) 2026-10-25T22:44:21.331Z n=$(api POST "$R/issues" '{"title":"Planned"}' | jq -r .number) 2026-10-25T22:44:21.331Z [ "$(code PATCH "$R/issues/$n" '{"title":"Renamed","milestone":999999}')" = 422 ] || fail "an unknown milestone wasn't refused with 422" 2026-10-25T22:44:21.331Z [ "$(api GET "$R/issues/$n" | jq -r .title)" = Planned ] || fail "a refused milestone edit saved the title" 2026-10-25T22:44:21.331Z [ "$(api PATCH "$R/issues/$n" "{\"milestone\":$ms}" | jq -r .milestone.number)" = "$ms" ] || fail "PATCH issue doesn't return the new milestone" 2026-10-25T22:44:21.331Z [ "$(api GET "$R/issues?milestone=$ms&state=all" | jq -r '[.[].number] | join(",")')" = "$n" ] || fail "issues aren't filtered by milestone" 2026-10-25T22:44:21.331Z loc=$(curl -sS -o /dev/null -w '%{redirect_url}' "$DIFFINERY/$OWNER/$REPO/milestone/$ms" -H "Authorization: Bearer $TOKEN") 2026-10-25T22:44:21.331Z has "$loc" "/issues?milestone=$ms" "the milestone link doesn't open its issue list" 2026-10-25T22:44:21.331Z # Repository variable deletes ignore letter case. 2026-10-25T22:44:21.331Z [ "$(code PUT "$R/actions/variables/LIVE_CASE" '{"value":"x"}')" = 204 ] || fail "couldn't set a repository variable" 2026-10-25T22:44:21.331Z [ "$(code DELETE "$R/actions/variables/live_case")" = 204 ] || fail "couldn't delete a repository variable" 2026-10-25T22:44:21.331Z [ "$(code GET "$R/actions/variables/LIVE_CASE")" = 404 ] || fail "deleting a variable in lower case left it in place" 2026-10-25T22:44:21.331Z org=$(page /api/v3/user/orgs | jq -r '.[0].login // empty') 2026-10-25T22:44:21.331Z if [ -n "$org" ]; then 2026-10-25T22:44:21.331Z # Deleting an organization variable or secret that doesn't exist is a 404 (403 for someone who isn't an admin). 2026-10-25T22:44:21.331Z for path in variables secrets; do 2026-10-25T22:44:21.331Z c=$(code DELETE "/orgs/$org/actions/$path/LIVE_NEVER_SET_$GITHUB_RUN_ID") 2026-10-25T22:44:21.331Z case "$c" in 404|403) ;; *) fail "DELETE of a missing organization $path entry got $c" ;; esac 2026-10-25T22:44:21.331Z done 2026-10-25T22:44:21.331Z fi 2026-10-25T22:44:21.331Z echo "Diffy placeholders, Actions settings page, milestone and variable checks passed" 2026-10-25T22:44:21.331Z ##[endgroup] 2026-10-25T22:44:25.949Z Diffy placeholders, Actions settings page, milestone and variable checks passed 2026-10-25T22:44:26.570Z ##[group]Run set -euo pipefail 2026-10-25T22:44:26.570Z api() { curl -fsS "$DIFFINERY/api/v3$1" -H "Authorization: Bearer $TOKEN"; } 2026-10-25T22:44:26.570Z for i in $(seq 1 90); do 2026-10-25T22:44:26.570Z run=$(api "/repos/$OWNER/$REPO/actions/runs?event=push" | jq -c '.workflow_runs[0] // empty') 2026-10-25T22:44:26.570Z [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break 2026-10-25T22:44:26.570Z sleep 10 2026-10-25T22:44:26.570Z done 2026-10-25T22:44:26.570Z echo "$run" | jq '{id, status, conclusion}' 2026-10-25T22:44:26.570Z id=$(jq -r .id <<<"$run") 2026-10-25T22:44:26.570Z jobs=$(api "/repos/$OWNER/$REPO/actions/runs/$id/jobs") 2026-10-25T22:44:26.570Z # placementTries: times a job went back in line (no machine, or a runner on a replaced image turned away). 2026-10-25T22:44:26.570Z # restarts: times it started over because the platform replaced its runner before its steps ran. 2026-10-25T22:44:26.570Z jq -r '.jobs[] | " \(.name): \(.conclusion)\(if .failure then " - " + (.failure.message // "") else "" end)\(try " (\((.completed_at | fromdateiso8601) - (.started_at | fromdateiso8601))s)" catch "")\(if (.placementTries // 0) > 0 then ", started again \(.placementTries) time(s)" else "" end)\(if (.restarts // 0) > 0 then ", restarted \(.restarts) time(s) after its runner was replaced" else "" end)"' <<<"$jobs" 2026-10-25T22:44:26.570Z if [ "$(jq -r .conclusion <<<"$run")" != success ]; then 2026-10-25T22:44:26.570Z for job in $(jq -r '.jobs[] | select(.conclusion == "failure" or .conclusion == "timed_out") | .id' <<<"$jobs"); do 2026-10-25T22:44:26.570Z echo "::group::Last log lines of job $job" 2026-10-25T22:44:26.570Z api "/repos/$OWNER/$REPO/actions/jobs/$job/logs" | tail -n 80 || true 2026-10-25T22:44:26.570Z echo "::endgroup::" 2026-10-25T22:44:26.570Z done 2026-10-25T22:44:26.570Z echo "::error::the push run did not succeed" 2026-10-25T22:44:26.570Z exit 1 2026-10-25T22:44:26.570Z fi 2026-10-25T22:44:26.570Z if [ -n "${DEPLOYED_RUNNER_IMAGE:-}" ]; then 2026-10-25T22:44:26.570Z # Every job ran the deployed runner, so these checks test what was just deployed. 2026-10-25T22:44:26.570Z stale=$(jq -r --arg want "$DEPLOYED_RUNNER_IMAGE" '.jobs[] | select(.runner.image != $want) | "\(.name) on \(.runner.image // "no image reported")"' <<<"$jobs") 2026-10-25T22:44:26.570Z [ -z "$stale" ] || { echo "::error::jobs ran on a runner image other than the deployed $DEPLOYED_RUNNER_IMAGE: $(paste -sd ';' <<<"$stale")"; exit 1; } 2026-10-25T22:44:26.570Z echo "every job ran on $DEPLOYED_RUNNER_IMAGE" 2026-10-25T22:44:26.570Z fi 2026-10-25T22:44:26.570Z for job in $(jq -r '.jobs[] | select(.name | startswith("hosted")) | .id' <<<"$jobs"); do 2026-10-25T22:44:26.570Z log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs") 2026-10-25T22:44:26.570Z grep -F "live ok" <<<"$log" | grep -F "# $REPO" || { echo "::error::job $job did not print its line (checkout or run step failed)"; exit 1; } 2026-10-25T22:44:26.570Z grep -F "sudo ok 0" <<<"$log" || { echo "::error::job $job could not run sudo without a password"; exit 1; } 2026-10-25T22:44:26.570Z done 2026-10-25T22:44:26.570Z job=$(jq -r '.jobs[] | select(.name == "docker") | .id' <<<"$jobs") 2026-10-25T22:44:26.570Z log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs") 2026-10-25T22:44:26.570Z grep -F "docker ok built" <<<"$log" || { echo "::error::docker build or run failed on a hosted runner"; exit 1; } 2026-10-25T22:44:26.570Z grep -F "service ok +PONG" <<<"$log" || { echo "::error::the redis service container was not reachable"; exit 1; } 2026-10-25T22:44:26.570Z job=$(jq -r '.jobs[] | select(.name == "pull") | .id' <<<"$jobs") 2026-10-25T22:44:26.570Z log=$(api "/repos/$OWNER/$REPO/actions/jobs/$job/logs") 2026-10-25T22:44:26.570Z grep -F "registry ok $BIG bytes" <<<"$log" || { echo "::error::the image pushed with a $BIG-byte layer did not come back intact from the registry"; exit 1; } 2026-10-25T22:44:26.570Z grep -F "buildx ok $BUILDX bytes" <<<"$log" || { echo "::error::the image pushed by docker/build-push-action did not come back from the registry"; exit 1; } 2026-10-25T22:44:26.570Z api "/users/$OWNER/packages/container/${REPO,,}/versions" | jq -c '.[] | {tags: .metadata.container.tags, size, platforms}' 2026-10-25T22:44:26.570Z ##[endgroup] 2026-10-25T22:44:57.441Z { 2026-10-25T22:44:57.441Z "id": "8be72600a22e4e87bb2454ecb0ae042b", 2026-10-25T22:44:57.441Z "status": "completed", 2026-10-25T22:44:57.441Z "conclusion": "success" 2026-10-25T22:44:57.441Z } 2026-10-25T22:44:57.654Z hosted (1): success (2s) 2026-10-25T22:44:57.654Z hosted (2): success (2s) 2026-10-25T22:44:57.654Z publish: success (10s) 2026-10-25T22:44:57.654Z docker: success (13s) 2026-10-25T22:44:57.654Z buildx: success (20s) 2026-10-25T22:44:57.654Z pull: success (8s) 2026-10-25T22:44:57.662Z every job ran on diffinery-runner:4d3bf17f06575e64ab4155b3 2026-10-25T22:44:58.094Z 2026-10-25T22:44:23.104Z live ok 1 # live-1048-1 2026-10-25T22:44:58.096Z 2026-10-25T22:44:23.206Z sudo ok 0 2026-10-25T22:44:58.542Z 2026-10-25T22:44:23.997Z live ok 2 # live-1048-1 2026-10-25T22:44:58.543Z 2026-10-25T22:44:24.164Z sudo ok 0 2026-10-25T22:44:59.157Z 2026-10-25T22:44:33.902Z docker ok built 2026-10-25T22:44:59.159Z 2026-10-25T22:44:33.904Z service ok +PONG 2026-10-25T22:44:59.576Z 2026-10-25T22:44:49.487Z registry ok 5000000 bytes 2026-10-25T22:44:59.577Z 2026-10-25T22:44:52.331Z buildx ok 4000000 bytes 2026-10-25T22:44:59.979Z {"tags":["buildx"],"size":4001849,"platforms":["linux/amd64","unknown/unknown"]} 2026-10-25T22:44:59.979Z {"tags":["live"],"size":5002317,"platforms":["linux/amd64","unknown/unknown"]} 2026-10-25T22:45:00.063Z ##[group]Run set -euo pipefail 2026-10-25T22:45:00.063Z org=$(curl -fsS "$DIFFINERY/api/v3/user/orgs" -H "Authorization: Bearer $TOKEN" | jq -r '.[0].login // empty') 2026-10-25T22:45:00.063Z [ -n "$org" ] || { echo "$OWNER is in no organization; skipped"; exit 0; } 2026-10-25T22:45:00.063Z html=$(curl -fsS "$DIFFINERY/$org/-/packages" -H "Authorization: Bearer $TOKEN") 2026-10-25T22:45:00.063Z grep -qF "" <<<"$html" || { echo "::error::$org's packages page lost the organization's tab bar"; exit 1; } 2026-10-25T22:45:00.063Z grep -qF "href=\"/$org?tab=repositories\"" <<<"$html" || { echo "::error::$org's packages page has no Repositories tab"; exit 1; } 2026-10-25T22:45:00.063Z echo "$org's packages page shows the organization's tabs with Packages selected" 2026-10-25T22:45:00.063Z ##[endgroup] 2026-10-25T22:45:00.540Z codician's packages page shows the organization's tabs with Packages selected 2026-10-25T22:45:00.618Z ##[group]Run set -euo pipefail 2026-10-25T22:45:00.618Z git clone -q "https://x-token:${TOKEN}@${DIFFINERY#https://}/$OWNER/$REPO.git" clone 2026-10-25T22:45:00.618Z [ "$(sha256sum clone/blob.bin | cut -d' ' -f1)" = "$(cat blob.sha)" ] || { echo "::error::the LFS file came back different"; exit 1; } 2026-10-25T22:45:00.618Z echo "LFS file matches ($(stat -c %s clone/blob.bin) bytes)" 2026-10-25T22:45:00.618Z ##[endgroup] 2026-10-25T22:45:02.815Z LFS file matches (3145728 bytes) 2026-10-25T22:45:02.961Z ##[group]Run set -euo pipefail 2026-10-25T22:45:02.961Z for i in $(seq 1 30); do 2026-10-25T22:45:02.961Z hook=$(curl -fsS "$DIFFINERY/api/v3/repos/$OWNER/$REPO/hooks" -H "Authorization: Bearer $TOKEN" | jq -c '.[0]') 2026-10-25T22:45:02.961Z # GitHub's hook shape: the target is config.url, the last delivery's status last_response.code. 2026-10-25T22:45:02.961Z [ "$(jq -r '.last_response.code // empty' <<<"$hook")" != "" ] && break 2026-10-25T22:45:02.961Z sleep 5 2026-10-25T22:45:02.961Z done 2026-10-25T22:45:02.961Z echo "$hook" | jq '{target: .config.url, last_response, updated_at}' 2026-10-25T22:45:02.961Z [ "$(jq -r '.last_response.code // empty' <<<"$hook")" != "" ] || { echo "::error::the push webhook was never delivered"; exit 1; } 2026-10-25T22:45:02.961Z ##[endgroup] 2026-10-25T22:45:03.175Z { 2026-10-25T22:45:03.176Z "target": "https://example.com/diffinery-live-test", 2026-10-25T22:45:03.176Z "last_response": { 2026-10-25T22:45:03.176Z "code": 405, 2026-10-25T22:45:03.176Z "status": "failed", 2026-10-25T22:45:03.176Z "message": null 2026-10-25T22:45:03.176Z }, 2026-10-25T22:45:03.176Z "updated_at": "2026-10-25T22:44:21Z" 2026-10-25T22:45:03.176Z } 2026-10-25T22:45:03.253Z ##[group]Run set -euo pipefail 2026-10-25T22:45:03.253Z # Revokes anything a failed check minted, then fails. 2026-10-25T22:45:03.253Z minted() { echo "::error::$1"; curl -fsS "$DIFFINERY/api/v3/diffinery/tokens" -H "Authorization: Bearer $TOKEN" | jq -r '.[] | select(.name == "live-test escalation") | .id' | while read -r id; do curl -sS -o /dev/null -X DELETE "$DIFFINERY/api/v3/diffinery/tokens/$id" -H "Authorization: Bearer $TOKEN"; done; exit 1; } 2026-10-25T22:45:03.253Z code=$(curl -sS -o /tmp/out -w '%{http_code}' -X POST "$DIFFINERY/api/v3/diffinery/tokens" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"name":"live-test escalation","scopes":["read"],"expires_in_days":1}') 2026-10-25T22:45:03.253Z [ "$code" = 403 ] || minted "an admin token minted a token through the API ($code)" 2026-10-25T22:45:03.253Z grep -q "browser session" /tmp/out || minted "unexpected refusal: $(cat /tmp/out)" 2026-10-25T22:45:03.253Z code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST "$DIFFINERY/api/v3/diffinery/agents" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"login":"live-test-escalation"}') 2026-10-25T22:45:03.253Z [ "$code" = 403 ] || { echo "::error::an admin token created an agent ($code); disable live-test-escalation by hand"; exit 1; } 2026-10-25T22:45:03.253Z # A web form with a token and a forged double-submit CSRF pair. 2026-10-25T22:45:03.253Z code=$(curl -sS -o /dev/null -w '%{http_code}' -X POST "$DIFFINERY/settings/tokens" -H "Authorization: Bearer $TOKEN" -H "cookie: dfy_csrf=forged" --data "_csrf=forged&name=live-test%20escalation&scope=read&days=1") 2026-10-25T22:45:03.253Z [ "$code" = 403 ] || minted "a token submitted the web token form ($code)" 2026-10-25T22:45:03.253Z echo "tokens can't mint tokens or agents, through the API or the web forms" 2026-10-25T22:45:03.253Z ##[endgroup] 2026-10-25T22:45:03.756Z tokens can't mint tokens or agents, through the API or the web forms 2026-10-25T22:45:03.828Z ##[group]Run set -euo pipefail 2026-10-25T22:45:03.828Z base="$DIFFINERY/api/v3/repos/$OWNER/$REPO/diffinery/sandboxes" 2026-10-25T22:45:03.828Z id=$(curl -fsS --retry 1 --retry-delay 15 -X POST "$base" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{}' | jq -r .id) 2026-10-25T22:45:03.828Z echo "sandbox $id" 2026-10-25T22:45:03.828Z for i in $(seq 1 40); do 2026-10-25T22:45:03.828Z out=$(curl -sS -X POST "$base/$id/exec" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" --data '{"cmd":"cat README.md && git lfs ls-files | wc -l"}' || true) 2026-10-25T22:45:03.828Z jq -e '.exitCode == 0' >/dev/null 2>&1 <<<"$out" && break 2026-10-25T22:45:03.828Z sleep 6 2026-10-25T22:45:03.828Z done 2026-10-25T22:45:03.828Z echo "$out" | jq '{exitCode, stdout}' 2026-10-25T22:45:03.828Z curl -sS -X POST "$base/$id/close" -H "Authorization: Bearer $TOKEN" >/dev/null || true 2026-10-25T22:45:03.828Z jq -e --arg r "# $REPO" '.exitCode == 0 and (.stdout | contains($r))' >/dev/null <<<"$out" || { echo "::error::the sandbox did not run the command in the repository"; exit 1; } 2026-10-25T22:45:03.828Z ##[endgroup] 2026-10-25T22:45:07.394Z sandbox 2c1b2bcda006400e93290ffc09cefba8 2026-10-25T22:51:16.876Z jq: parse error: Invalid numeric literal at line 1, column 7 2026-10-25T22:51:16.877Z ##[error]Process completed with exit code 5. 2026-10-25T22:51:17.582Z ##[group]Run set -euo pipefail 2026-10-25T22:51:17.582Z # The cron trigger fires every 5 minutes, so allow two windows. 2026-10-25T22:51:17.582Z for i in $(seq 1 75); do 2026-10-25T22:51:17.582Z run=$(curl -fsS "$DIFFINERY/api/v3/repos/$OWNER/$REPO/actions/runs?event=schedule" -H "Authorization: Bearer $TOKEN" | jq -c '.workflow_runs[0] // empty') 2026-10-25T22:51:17.582Z [ -n "$run" ] && [ "$(jq -r .status <<<"$run")" = completed ] && break 2026-10-25T22:51:17.582Z sleep 10 2026-10-25T22:51:17.582Z done 2026-10-25T22:51:17.582Z if [ -z "$run" ]; then 2026-10-25T22:51:17.582Z # Whether the scheduler stopped ticking (last_tick_at is old) or ticked without starting the run 2026-10-25T22:51:17.582Z # (site administrators only: another token prints the 403). 2026-10-25T22:51:17.582Z echo "scheduler: $(curl -sS "$DIFFINERY/api/v3/diffinery/admin/scheduler" -H "Authorization: Bearer $TOKEN") (now $(date -u +%FT%TZ))" 2026-10-25T22:51:17.582Z echo "::error::no scheduled run started" 2026-10-25T22:51:17.582Z exit 1 2026-10-25T22:51:17.582Z fi 2026-10-25T22:51:17.582Z echo "$run" | jq '{id, event, status, conclusion}' 2026-10-25T22:51:17.582Z [ "$(jq -r .conclusion <<<"$run")" = success ] || { echo "::error::the scheduled run did not succeed"; exit 1; } 2026-10-25T22:51:17.582Z ##[endgroup] 2026-10-25T22:51:17.794Z { 2026-10-25T22:51:17.794Z "id": "3148274127894a029faa4ae70125651a", 2026-10-25T22:51:17.794Z "event": "schedule", 2026-10-25T22:51:17.794Z "status": "completed", 2026-10-25T22:51:17.795Z "conclusion": "success" 2026-10-25T22:51:17.795Z } 2026-10-25T22:51:17.865Z ##[group]Run curl -sS -o /dev/null -w 'package %{http_code}\n' -X DELETE "$DIFFINERY/api/v3/users/$OWNER/packages/container/${REPO,,}" -H "Authorization: Bearer $TOKEN" 2026-10-25T22:51:17.865Z curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$REPO" -H "Authorization: Bearer $TOKEN" 2026-10-25T22:51:17.865Z [ -z "${PR_REPO:-}" ] || curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$PR_REPO" -H "Authorization: Bearer $TOKEN" 2026-10-25T22:51:17.865Z [ -z "${IMPORT_REPO:-}" ] || curl -sS -o /dev/null -w '%{http_code}\n' -X DELETE "$DIFFINERY/api/v3/repos/$OWNER/$IMPORT_REPO" -H "Authorization: Bearer $TOKEN" 2026-10-25T22:51:17.865Z ##[endgroup] 2026-10-25T22:51:18.657Z package 204 2026-10-25T22:51:20.135Z 204 2026-10-25T22:51:20.170Z Host: 0% of the vCPUs' time went to other work on the host (steal) 2026-10-25T22:51:20.170Z Job completed with conclusion: failure 2026-10-25T22:51:20.171Z Resources: 0.0 of 4 vCPUs busy on average (0.1 at the 95th percentile), peak memory 0.4 GiB of 11.9 GiB, peak disk 1.1 GB of 19.2 GB