mathiasandClaude Opus 5
cc86a74dc5
Two runs of the full build+deploy fired for every push, and the second died:
nothing to commit, working tree clean
❌ Failure - Main Update infra repo
The deploy was fine both times — the second run had nothing left to do. The
cause is the pair of triggers meeting: ci.yml ran on `push` to main AND on a
`v*` tag, and cd.yml keys off "CI succeeded", so `git push origin main` followed
by `git push origin refs/tags/vX` produced two CI runs for one sha and two
deploys behind them. The tag run carries the same github.sha, so it rebuilt the
same image and then found the infra manifest already pointing at it.
Nothing consumed the tag-triggered run: there is no release workflow, and cd.yml
reads github.sha rather than the tag. Dropping `tags:` removes the duplicate
build outright.
The idempotency guard stays anyway, because a manual re-run has the same shape
and should not ring the CI-red alarm for work that is already done — infra#366
turns a red run into a tracked issue, so a false red costs a real triage.
Closes #118
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
name: CI
|
|
|
|
"on":
|
|
push:
|
|
# Branch only. A `v*` tag here points at a commit main already tested, so
|
|
# the tag push re-ran the whole gate and — because cd.yml keys off "CI
|
|
# succeeded" — triggered a SECOND full image build and deploy for the same
|
|
# sha. That second deploy then died on "nothing to commit" (hyperguild#118).
|
|
# Nothing consumes a tag-triggered run: there is no release workflow, and
|
|
# cd.yml reads github.sha, not the tag.
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
# ── 1. Quality gate ─────────────────────────────────────────────────────────
|
|
check:
|
|
name: Lint / Test / Vet
|
|
runs-on: self-hosted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false # self-hosted: Go cache persists on disk between runs
|
|
|
|
- name: Verify toolchain
|
|
run: |
|
|
go version
|
|
task --version
|
|
govulncheck -version 2>&1 || true
|
|
|
|
- name: Install golangci-lint
|
|
run: |
|
|
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
|
|
| sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
|
|
golangci-lint --version
|
|
|
|
- name: Run checks
|
|
run: task check
|
|
|
|
# ── 2. Mirror to GitHub ─────────────────────────────────────────────────────
|
|
mirror:
|
|
name: Mirror to GitHub
|
|
needs: check
|
|
runs-on: self-hosted
|
|
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Push to GitHub
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo '${{ secrets.GH_DEPLOY_KEY }}' > ~/.ssh/id_rsa_gh_mirror
|
|
chmod 600 ~/.ssh/id_rsa_gh_mirror
|
|
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
|
|
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa_gh_mirror -o IdentitiesOnly=yes" \
|
|
git push git@github.com:mathiasb/hyperguild.git HEAD:main --follow-tags
|
|
rm ~/.ssh/id_rsa_gh_mirror
|
|
echo "✓ Mirrored to GitHub"
|