diff --git a/.github/ops/deploy-runner-fleet.sh b/.github/ops/deploy-runner-fleet.sh index 6cd5588..eff5919 100644 --- a/.github/ops/deploy-runner-fleet.sh +++ b/.github/ops/deploy-runner-fleet.sh @@ -2,6 +2,47 @@ set -euo pipefail umask 077 +phase="initializing" +work="" + +cleanup() { + if [ -n "${work:-}" ]; then + sudo rm -rf -- "$work" >/dev/null 2>&1 || true + fi +} + +report_status() { + local rc=$? + local state="success" + if [ "$rc" -ne 0 ]; then + state="failure" + fi + + if [ -n "${GH_STATUS_TOKEN:-}" ] && command -v python3 >/dev/null 2>&1 && command -v curl >/dev/null 2>&1; then + local body payload + body="Runner fleet deployment ${state}. Phase: ${phase}. Exit: ${rc}. Commit: ${GITHUB_SHA:-unknown}." + payload="$(python3 - "$body" <<'PY' +import json +import sys +print(json.dumps({"body": sys.argv[1]})) +PY +)" + curl -fsS \ + -X POST \ + -H "Authorization: Bearer ${GH_STATUS_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + https://api.github.com/repos/G-A-R-D-E-N/CO-SERVER/issues/27/comments \ + -d "$payload" \ + >/dev/null 2>&1 || true + fi + + cleanup + exit "$rc" +} +trap report_status EXIT + +phase="host-preflight" echo "== host preflight ==" id hostname @@ -10,16 +51,13 @@ sudo -n -u nomad -H sudo -n true sudo -n -u nomad -H gh auth status >/dev/null work="$(sudo -n -u nomad -H mktemp -d /tmp/runner-fleet-deploy.XXXXXX)" -cleanup() { - sudo rm -rf -- "$work" -} -trap cleanup EXIT scheduler_repo="$work/plugin-scheduler" light_repo="$work/plugin-light" fleet_repo="$work/ghrunner" tarball="$work/actions-runner-linux-x64-2.336.0.tar.gz" +phase="fetch-sources" echo "== fetch approved deployment sources ==" sudo -n -u nomad -H gh repo clone \ PRISMA-USER-INTERFACE-FRAMEWORK/PluginEditTool \ @@ -31,10 +69,12 @@ sudo -n -u nomad -H gh repo clone \ G-A-R-D-E-N/GHRUNNER \ "$fleet_repo" -- --branch feat/hosted-minute-repo-runners --single-branch --quiet +phase="validate-sources" sudo -n -u nomad -H bash -c 'cd "$1" && ./scripts/validate-repo.sh' bash "$fleet_repo" sudo -n -u nomad -H python3 -m py_compile "$scheduler_repo/tools/ci/ghrunnerd.py" sudo -n -u nomad -H bash -n "$light_repo/tools/ci/install-prisma-runner.sh" +phase="deploy-scheduler" echo "== deploy PluginEditTool #194 scheduler fix ==" sudo install -m 0755 \ "$scheduler_repo/tools/ci/ghrunnerd.py" \ @@ -43,6 +83,7 @@ sudo systemctl restart gh-runner-webhook.service sudo systemctl is-active --quiet gh-runner-webhook.service sudo /usr/local/lib/gh-runner/ghrunnerd.py status +phase="fetch-runner-package" echo "== fetch and verify pinned Actions runner ==" sudo -n -u nomad -H curl -fL --retry 3 --retry-delay 2 \ -o "$tarball" \ @@ -70,6 +111,7 @@ repo_runner_exists() { | grep -qx "$name" } +phase="prisma-light" echo "== provision prisma-light-1 ==" light_dir=/opt/actions-runner-prisma-light-1 light_unit=actions.runner.PRISMA-USER-INTERFACE-FRAMEWORK.prisma-light-1.service @@ -110,6 +152,7 @@ sudo systemctl show "$light_unit" -p User -p Slice -p MemoryHigh -p MemoryMax -p install_repo_runner() { local key="$1" repo="$2" name="$3" dir="$4" unit="$5" + phase="runner-$key" echo "== provision $key ($repo) ==" if repo_runner_exists "$repo" "$name"; then test -d "$dir" || { @@ -167,8 +210,10 @@ install_repo_runner \ /opt/actions-runner-commonwealth-ui-sync \ actions.runner.G-A-R-D-E-N-CommonwealthOnlineUI.commonwealth-ui-sync.service +phase="final-audit" echo "== final fleet audit ==" sudo "$fleet_repo/scripts/audit-host.sh" sudo /usr/local/lib/gh-runner/ghrunnerd.py status +phase="complete" echo "deployment complete"