Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(action): replace shell:pwsh with bash in local-ci-build (C8.5)

Browse Source 
The shared composite action ran 3 steps under `shell: pwsh`, making every
CI job depend on PowerShell on the Linux host. Rewrote them in bash and
dropped the dead $IsLinux / F:\CI branches (Phase B left a single Linux
host serving both windows-build and linux-build runners).

Closes Phase C / idea-3: no CI job or systemd timer requires pwsh on the
Linux host anymore. Ticked all C1-C8 subtask checkboxes and set the plans
to "C chiusa". pwsh is deliberately left installed (operator choice, not a
technical blocker).
This commit is contained in:
Simone
2026-07-23 14:51:55 +02:00
parent 18b6e2b253
commit 844742b4c0
3 changed files with 252 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/actions/local-ci-build/action.yml
+170 -155
View File
@@ -2,9 +2,9 @@
#
# Reusable composite action — Local CI/CD System
#
# Wraps Invoke-CIJob.ps1 (ephemeral VMware VM pipeline) into a single callable
# step, usable from any Gitea repository without duplicating the orchestration
# logic.
# Wraps `python -m ci_orchestrator job` (ephemeral VMware VM pipeline) into a
# single callable step, usable from any Gitea repository without duplicating
# the orchestration logic.
#
# Stored in: Simone/local-ci-cd-system / .gitea/actions/local-ci-build/action.yml
#
@@ -37,10 +37,12 @@
name: Local CI Build
description: >
Builds a project using an ephemeral VMware VM managed by Invoke-CIJob.ps1.
Handles the full VM lifecycle: clone template -> start VM -> run build ->
collect artifacts -> destroy VM.
Compatible with windows-build (WinRM) and linux-build (SSH) runners.
Builds a project using an ephemeral VMware VM managed by the ci_orchestrator
Python CLI. Handles the full VM lifecycle: clone template -> start VM ->
run build -> collect artifacts -> destroy VM.
Compatible with windows-build (WinRM) and linux-build (SSH) runners — both
labels are served by the same Linux control-plane host; guest-os only picks
the VM template, never the shell this action itself runs under.
inputs:
build-command:
@@ -52,7 +54,7 @@ inputs:
artifact-source:
description: >
Path inside VM where build outputs are located, relative to the CI work
directory. Collected to F:\CI\Artifacts\{JobId}\ on the host.
directory. Collected to /var/lib/ci/artifacts/{JobId}/ on the host.
required: false
default: 'dist'
@@ -117,8 +119,8 @@ inputs:
description: >
Deprecated / no-op. Artifacts are no longer uploaded to the Gitea
Actions store (that needs the github.com-hosted upload-artifact
action). They stay on the host under F:\CI\Artifacts and are aged
out by scripts/Invoke-RetentionPolicy.ps1. Kept for caller
action). They stay on the host under /var/lib/ci/artifacts and are aged
out by `ci retention run` (see commands/retention.py). Kept for caller
back-compat.
required: false
default: '14'
@@ -188,9 +190,11 @@ inputs:
use-shared-cache:
description: >
Set to "true" to redirect NuGet and pip caches to VMware shared folders
on the host (F:\CI\Cache\NuGet and F:\CI\Cache\pip).
Requires Set-TemplateSharedFolders.ps1 to have been run on the template
and VMware Tools HGFS driver present in the guest.
on the host. Windows guests only (see build.py) — wired via
Set-TemplateSharedFolders.ps1, which still hardcodes Windows host
paths (F:\CI\Cache\...) and has not been re-pointed at the Linux
host post-migration; treat as unverified until that script is ported.
Requires VMware Tools HGFS driver present in the guest.
required: false
default: 'false'
@@ -228,8 +232,8 @@ inputs:
outputs:
artifact-path:
description: >
Host-side directory where Invoke-CIJob.ps1 placed collected artifacts.
Format: F:\CI\Artifacts\{run_id}-{run_attempt}
Host-side directory where the orchestrator collected artifacts.
Format: /var/lib/ci/artifacts/{run_id}-{run_attempt}
value: ${{ steps.invoke-ci.outputs.artifact-path }}
artifact-name:
@@ -241,9 +245,15 @@ runs:
steps:
# ── Invoke the CI orchestrator ─────────────────────────────────────────────
# The control-plane host is always Linux (Phase B): both the windows-build
# and linux-build runner labels are served by act_runner processes running
# on this same Linux Mint host (one `runner.envs` block per process picks
# the template; the host OS running act_runner itself never changes).
# guest-os only selects which VM template gets cloned — it has no bearing
# on the shell this action runs under.
- name: Invoke CI Job
id: invoke-ci
shell: pwsh
shell: bash
# Inputs are forwarded via environment variables to avoid shell injection
# from user-supplied build-command or path strings.
env:
@@ -269,63 +279,54 @@ runs:
INPUT_GUEST_CPU: ${{ inputs.guest-cpu }}
INPUT_GUEST_MEMORY_MB: ${{ inputs.guest-memory-mb }}
run: |
#Requires -Version 5.1
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
set -euo pipefail
# Resolve Python interpreter from venv (Phase A4 — Python orchestrator).
# Override with CI_VENV_PYTHON env var; OS-specific defaults otherwise.
$venvPython = $env:CI_VENV_PYTHON
if (-not $venvPython) {
if ($IsLinux) { $venvPython = '/opt/ci/venv/bin/python' }
else { $venvPython = 'F:\CI\python\venv\Scripts\python.exe' }
}
if (-not (Test-Path -LiteralPath $venvPython)) {
throw "Python interpreter not found at '$venvPython'. Set CI_VENV_PYTHON or run Setup-Host.ps1."
}
# Override with CI_VENV_PYTHON env var.
venv_python="${CI_VENV_PYTHON:-/opt/ci/venv/bin/python}"
if [[ ! -x "$venv_python" ]]; then
echo "Python interpreter not found at '$venv_python'. Set CI_VENV_PYTHON or run setup-host-linux.sh." >&2
exit 1
fi
# Build job ID — append suffix when provided (matrix disambiguation)
$jobId = '${{ github.run_id }}-${{ github.run_attempt }}'
if ($env:INPUT_JOB_ID_SUFFIX) { $jobId = "$jobId-$($env:INPUT_JOB_ID_SUFFIX)" }
if ($IsLinux) { $artifactPath = "/var/lib/ci/artifacts/$jobId" }
else { $artifactPath = "F:\CI\Artifacts\$jobId" }
job_id="${{ github.run_id }}-${{ github.run_attempt }}"
if [[ -n "$INPUT_JOB_ID_SUFFIX" ]]; then
job_id="${job_id}-${INPUT_JOB_ID_SUFFIX}"
fi
artifact_path="/var/lib/ci/artifacts/${job_id}"
# Resolve artifact name: caller-supplied or default to build-{run_id}-{sha}
if ($env:INPUT_ARTIFACT_NAME) {
$artifactName = $env:INPUT_ARTIFACT_NAME
}
else {
$artifactName = "build-${{ github.run_id }}-${{ github.sha }}"
}
if [[ -n "$INPUT_ARTIFACT_NAME" ]]; then
artifact_name="$INPUT_ARTIFACT_NAME"
else
artifact_name="build-${{ github.run_id }}-${{ github.sha }}"
fi
# Resolve repository URL: explicit override or construct from GitHub context
if ($env:INPUT_REPO_URL) {
$repoUrl = $env:INPUT_REPO_URL
}
else {
$repoUrl = '${{ github.server_url }}/${{ github.repository }}.git'
}
if [[ -n "$INPUT_REPO_URL" ]]; then
repo_url="$INPUT_REPO_URL"
else
repo_url="${{ github.server_url }}/${{ github.repository }}.git"
fi
# Resolve target branch/commit. github.ref_name/github.sha refer
# to the workflow's own repo — only valid when repo-url is NOT
# overridden. For a cross-repo build the caller must give
# repo-branch (and optionally repo-commit); an unset commit means
# "branch tip, no pin".
if ($env:INPUT_REPO_BRANCH) {
$repoBranch = $env:INPUT_REPO_BRANCH
}
else {
$repoBranch = '${{ github.ref_name }}'
}
if ($env:INPUT_REPO_COMMIT) {
$repoCommit = $env:INPUT_REPO_COMMIT
}
elseif ($env:INPUT_REPO_URL) {
$repoCommit = '' # cross-repo: don't pin the workflow's sha
}
else {
$repoCommit = '${{ github.sha }}'
}
if [[ -n "$INPUT_REPO_BRANCH" ]]; then
repo_branch="$INPUT_REPO_BRANCH"
else
repo_branch="${{ github.ref_name }}"
fi
if [[ -n "$INPUT_REPO_COMMIT" ]]; then
repo_commit="$INPUT_REPO_COMMIT"
elif [[ -n "$INPUT_REPO_URL" ]]; then
repo_commit="" # cross-repo: don't pin the workflow's sha
else
repo_commit="${{ github.sha }}"
fi
# Resolve guest OS.
#
@@ -339,23 +340,21 @@ runs:
# guestOS field from the cloned VMX — but that happens *after* the
# clone, so the template and snapshot must already be known. Hence:
# Auto requires both template-path and snapshot-name.
$resolvedGuestOS = $env:INPUT_GUEST_OS
if ($resolvedGuestOS -eq 'Auto' -and (-not $env:INPUT_TEMPLATE_PATH -or -not $env:INPUT_SNAPSHOT_NAME)) {
throw ("guest-os: 'Auto' cannot select a template or snapshot on its own — " +
"act_runner does not expose the job's runs-on label to the action. " +
"Either set guest-os to 'Windows'/'Linux' (uses the runner env defaults), " +
"or pass both template-path and snapshot-name explicitly.")
}
resolved_guest_os="$INPUT_GUEST_OS"
if [[ "$resolved_guest_os" == "Auto" && ( -z "$INPUT_TEMPLATE_PATH" || -z "$INPUT_SNAPSHOT_NAME" ) ]]; then
echo "guest-os: 'Auto' cannot select a template or snapshot on its own -- act_runner does not expose the job's runs-on label to the action. Either set guest-os to 'Windows'/'Linux' (uses the runner env defaults), or pass both template-path and snapshot-name explicitly." >&2
exit 1
fi
# Select template path: explicit input overrides OS-based runner env var
$resolvedTemplatePath = $env:INPUT_TEMPLATE_PATH
if (-not $resolvedTemplatePath) {
if ($resolvedGuestOS -eq 'Linux') {
$resolvedTemplatePath = $env:GITEA_CI_LINUX_TEMPLATE_PATH
} else {
$resolvedTemplatePath = $env:GITEA_CI_TEMPLATE_PATH
}
}
resolved_template_path="$INPUT_TEMPLATE_PATH"
if [[ -z "$resolved_template_path" ]]; then
if [[ "$resolved_guest_os" == "Linux" ]]; then
resolved_template_path="${GITEA_CI_LINUX_TEMPLATE_PATH:-}"
else
resolved_template_path="${GITEA_CI_TEMPLATE_PATH:-}"
fi
fi
# Select snapshot name: explicit input > OS-based default.
# GITEA_CI_SNAPSHOT_NAME applies to Windows (template-refresh override);
@@ -363,110 +362,126 @@ runs:
# runner instance dedicated to a Linux variant (e.g. the rust-build
# runner pointing at LinuxRust2404) declare its own snapshot instead of
# every workflow repeating it.
$resolvedSnapshotName = $env:INPUT_SNAPSHOT_NAME
if (-not $resolvedSnapshotName) {
if ($resolvedGuestOS -eq 'Linux') {
$resolvedSnapshotName = if ($env:GITEA_CI_LINUX_SNAPSHOT_NAME) { $env:GITEA_CI_LINUX_SNAPSHOT_NAME } else { 'BaseClean-Linux' }
} else {
$resolvedSnapshotName = if ($env:GITEA_CI_SNAPSHOT_NAME) { $env:GITEA_CI_SNAPSHOT_NAME } else { 'BaseClean' }
}
}
Write-Host "[local-ci-build] template: $resolvedTemplatePath"
Write-Host "[local-ci-build] snapshot: $resolvedSnapshotName"
Write-Host "[local-ci-build] guest-os: $resolvedGuestOS"
resolved_snapshot_name="$INPUT_SNAPSHOT_NAME"
if [[ -z "$resolved_snapshot_name" ]]; then
if [[ "$resolved_guest_os" == "Linux" ]]; then
resolved_snapshot_name="${GITEA_CI_LINUX_SNAPSHOT_NAME:-BaseClean-Linux}"
else
resolved_snapshot_name="${GITEA_CI_SNAPSHOT_NAME:-BaseClean}"
fi
fi
echo "[local-ci-build] template: $resolved_template_path"
echo "[local-ci-build] snapshot: $resolved_snapshot_name"
echo "[local-ci-build] guest-os: $resolved_guest_os"
# Build argument list for the Python CLI. Long-form kebab-case flags only.
# NOTE: never put an empty string in the splatted array — PowerShell
# 5.1 drops zero-length args when calling a native exe, which would
# shift the flag/value pairing. Add optional args conditionally.
$pyArgs = @(
'-m', 'ci_orchestrator', 'job',
'--job-id', $jobId,
'--repo-url', $repoUrl,
'--branch', $repoBranch,
'--build-command', $env:INPUT_BUILD_COMMAND,
'--guest-artifact-source', $env:INPUT_ARTIFACT_SOURCE,
'--guest-os', $resolvedGuestOS,
'--configuration', $env:INPUT_CONFIGURATION,
'--snapshot-name', $resolvedSnapshotName
py_args=(
-m ci_orchestrator job
--job-id "$job_id"
--repo-url "$repo_url"
--branch "$repo_branch"
--build-command "$INPUT_BUILD_COMMAND"
--guest-artifact-source "$INPUT_ARTIFACT_SOURCE"
--guest-os "$resolved_guest_os"
--configuration "$INPUT_CONFIGURATION"
--snapshot-name "$resolved_snapshot_name"
)
if ($resolvedTemplatePath) { $pyArgs += @('--template-path', $resolvedTemplatePath) }
if ($repoCommit) { $pyArgs += @('--commit', $repoCommit) }
[[ -n "$resolved_template_path" ]] && py_args+=(--template-path "$resolved_template_path")
[[ -n "$repo_commit" ]] && py_args+=(--commit "$repo_commit")
# Submodules and transport default to ON; pass the explicit
# negative flag when the caller opted out so the Python default
# (also ON) is overridden deterministically.
if ($env:INPUT_SUBMODULES -eq 'false') { $pyArgs += '--no-submodules' }
else { $pyArgs += '--submodules' }
if ($env:INPUT_USE_GIT_CLONE -eq 'false') { $pyArgs += '--host-clone' }
else { $pyArgs += '--use-git-clone' }
if ($env:INPUT_USE_SHARED_CACHE -eq 'true') { $pyArgs += '--use-shared-cache' }
if ($env:INPUT_SKIP_ARTIFACT -eq 'true') { $pyArgs += '--skip-artifact' }
if [[ "$INPUT_SUBMODULES" == "false" ]]; then
py_args+=(--no-submodules)
else
py_args+=(--submodules)
fi
if [[ "$INPUT_USE_GIT_CLONE" == "false" ]]; then
py_args+=(--host-clone)
else
py_args+=(--use-git-clone)
fi
[[ "$INPUT_USE_SHARED_CACHE" == "true" ]] && py_args+=(--use-shared-cache)
[[ "$INPUT_SKIP_ARTIFACT" == "true" ]] && py_args+=(--skip-artifact)
# Release tags build cold: they verify a release artifact, not a
# change, so the clean room is worth the two minutes (furyrs#13).
$cargoCacheMode = if ($env:INPUT_CARGO_CACHE) { $env:INPUT_CARGO_CACHE } else { 'auto' }
switch ($cargoCacheMode) {
'on' { $useCargoCache = $true }
'off' { $useCargoCache = $false }
'auto' { $useCargoCache = -not ($env:GITHUB_REF_FOR_CACHE -like 'refs/tags/v*') }
default {
throw ("cargo-cache must be one of 'auto', 'on', 'off' - got " +
"'$cargoCacheMode'.")
}
}
if (-not $useCargoCache) { $pyArgs += '--no-cargo-cache' }
Write-Host ("[job] Cargo cache: " + $(if ($useCargoCache) { 'on' } else { 'off (cold)' }))
if ($env:INPUT_XVFB -eq 'true') { $pyArgs += '--xvfb' }
# VMX overrides: forward only when > 0 (0 = keep template value).
if ([int]($env:INPUT_GUEST_CPU) -gt 0) { $pyArgs += @('--guest-cpu', $env:INPUT_GUEST_CPU) }
if ([int]($env:INPUT_GUEST_MEMORY_MB) -gt 0) { $pyArgs += @('--guest-memory-mb', $env:INPUT_GUEST_MEMORY_MB) }
if ($env:INPUT_EXTRA_GUEST_ENV_JSON -and $env:INPUT_EXTRA_GUEST_ENV_JSON -ne '{}') {
$pyArgs += @('--extra-env-json', $env:INPUT_EXTRA_GUEST_ENV_JSON)
}
cargo_cache_mode="${INPUT_CARGO_CACHE:-auto}"
case "$cargo_cache_mode" in
on) use_cargo_cache=true ;;
off) use_cargo_cache=false ;;
auto)
if [[ "$GITHUB_REF_FOR_CACHE" == refs/tags/v* ]]; then
use_cargo_cache=false
else
use_cargo_cache=true
fi
;;
*)
echo "cargo-cache must be one of 'auto', 'on', 'off' - got '$cargo_cache_mode'." >&2
exit 1
;;
esac
[[ "$use_cargo_cache" == false ]] && py_args+=(--no-cargo-cache)
if [[ "$use_cargo_cache" == true ]]; then
echo "[job] Cargo cache: on"
else
echo "[job] Cargo cache: off (cold)"
fi
& $venvPython @pyArgs
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
[[ "$INPUT_XVFB" == "true" ]] && py_args+=(--xvfb)
# VMX overrides: forward only when > 0 (0 = keep template value).
if (( INPUT_GUEST_CPU > 0 )); then
py_args+=(--guest-cpu "$INPUT_GUEST_CPU")
fi
if (( INPUT_GUEST_MEMORY_MB > 0 )); then
py_args+=(--guest-memory-mb "$INPUT_GUEST_MEMORY_MB")
fi
if [[ -n "$INPUT_EXTRA_GUEST_ENV_JSON" && "$INPUT_EXTRA_GUEST_ENV_JSON" != "{}" ]]; then
py_args+=(--extra-env-json "$INPUT_EXTRA_GUEST_ENV_JSON")
fi
"$venv_python" "${py_args[@]}"
# Emit outputs consumed by subsequent steps.
# PowerShell 5.1 `Out-File -Encoding utf8` writes a BOM; the act_runner
# GITHUB_OUTPUT parser then reads the key as "artifact-path" and
# the output resolves empty. An empty artifact-path made the upload
# step glob the entire F: drive. Write UTF-8 without BOM.
if (-not $artifactPath) { throw "artifactPath is empty; refusing to emit." }
$utf8NoBom = New-Object System.Text.UTF8Encoding($false)
[System.IO.File]::AppendAllText(
$env:GITHUB_OUTPUT, "artifact-path=$artifactPath`n", $utf8NoBom)
[System.IO.File]::AppendAllText(
$env:GITHUB_OUTPUT, "artifact-name=$artifactName`n", $utf8NoBom)
if [[ -z "$artifact_path" ]]; then
echo "artifact_path is empty; refusing to emit." >&2
exit 1
fi
{
echo "artifact-path=${artifact_path}"
echo "artifact-name=${artifact_name}"
} >> "$GITHUB_OUTPUT"
# ── Report artifact location ──────────────────────────────────────────────
# No actions/upload-artifact: that action's code is fetched from
# github.com (and v4 is GHES-incompatible, v3 deprecated). The runner
# host is single and its filesystem is shared across jobs, so the
# orchestrator's host-side collect dir IS the artifact handoff.
# Downstream jobs read F:\CI\Artifacts\{run_id}-{run_attempt}[-suffix]
# Downstream jobs read /var/lib/ci/artifacts/{run_id}-{run_attempt}[-suffix]
# directly (see build-nsInnoUnp.yml release job).
- name: Report artifact location
if: success() && inputs.skip-artifact != 'true'
shell: pwsh
shell: bash
run: |
$p = '${{ steps.invoke-ci.outputs.artifact-path }}'
if (-not (Test-Path -LiteralPath $p) -or
-not (Get-ChildItem -Force -LiteralPath $p)) {
throw "no artifacts at $p"
}
Write-Host "Artifacts on host: $p"
Get-ChildItem -Recurse -File -LiteralPath $p |
ForEach-Object { Write-Host " $($_.FullName)" }
set -euo pipefail
p='${{ steps.invoke-ci.outputs.artifact-path }}'
if [[ ! -e "$p" ]] || [[ -z "$(ls -A "$p")" ]]; then
echo "no artifacts at $p" >&2
exit 1
fi
echo "Artifacts on host: $p"
find "$p" -type f -print | sed 's/^/ /'
- name: Report diagnostic log location on failure
if: failure()
shell: pwsh
shell: bash
run: |
$p = '${{ steps.invoke-ci.outputs.artifact-path }}'
if ($p -and (Test-Path -LiteralPath $p)) {
Write-Host "Diagnostic logs (if any) on host: $p"
Get-ChildItem -Recurse -File -Filter '*.log' -LiteralPath $p `
-ErrorAction SilentlyContinue |
ForEach-Object { Write-Host " $($_.FullName)" }
}
set -euo pipefail
p='${{ steps.invoke-ci.outputs.artifact-path }}'
if [[ -n "$p" && -e "$p" ]]; then
echo "Diagnostic logs (if any) on host: $p"
find "$p" -type f -name '*.log' -print 2>/dev/null | sed 's/^/ /'
fi