[deploy-runner-fleet] runner fleet deployment with status beacon

Run the one-shot scheduler/runner deployment again under the private CO-SERVER runner with a phase/result beacon posted to merged ops PR #27. This is temporary infrastructure code and will be cleaned up after verification.

.github/ops/deploy-runner-fleet.sh

@@ -2,6 +2,47 @@
 set -euo pipefail
 umask 077
 
+phase="initializing"
+work=""
+
+cleanup() {
+  if [ -n "${work:-}" ]; then
+    sudo rm -rf -- "$work" >/dev/null 2>&1 || true
+  fi
+}
+
+report_status() {
+  local rc=$?
+  local state="success"
+  if [ "$rc" -ne 0 ]; then
+    state="failure"
+  fi
+
+  if [ -n "${GH_STATUS_TOKEN:-}" ] && command -v python3 >/dev/null 2>&1 && command -v curl >/dev/null 2>&1; then
+    local body payload
+    body="Runner fleet deployment ${state}. Phase: ${phase}. Exit: ${rc}. Commit: ${GITHUB_SHA:-unknown}."
+    payload="$(python3 - "$body" <<'PY'
+import json
+import sys
+print(json.dumps({"body": sys.argv[1]}))
+PY
+)"
+    curl -fsS \
+      -X POST \
+      -H "Authorization: Bearer ${GH_STATUS_TOKEN}" \
+      -H "Accept: application/vnd.github+json" \
+      -H "X-GitHub-Api-Version: 2022-11-28" \
+      https://api.github.com/repos/G-A-R-D-E-N/CO-SERVER/issues/27/comments \
+      -d "$payload" \
+      >/dev/null 2>&1 || true
+  fi
+
+  cleanup
+  exit "$rc"
+}
+trap report_status EXIT
+
+phase="host-preflight"
 echo "== host preflight =="
 id
 hostname
@@ -10,16 +51,13 @@ sudo -n -u nomad -H sudo -n true
 sudo -n -u nomad -H gh auth status >/dev/null
 
 work="$(sudo -n -u nomad -H mktemp -d /tmp/runner-fleet-deploy.XXXXXX)"
-cleanup() {
-  sudo rm -rf -- "$work"
-}
-trap cleanup EXIT
 
 scheduler_repo="$work/plugin-scheduler"
 light_repo="$work/plugin-light"
 fleet_repo="$work/ghrunner"
 tarball="$work/actions-runner-linux-x64-2.336.0.tar.gz"
 
+phase="fetch-sources"
 echo "== fetch approved deployment sources =="
 sudo -n -u nomad -H gh repo clone \
   PRISMA-USER-INTERFACE-FRAMEWORK/PluginEditTool \
@@ -31,10 +69,12 @@ sudo -n -u nomad -H gh repo clone \
   G-A-R-D-E-N/GHRUNNER \
   "$fleet_repo" -- --branch feat/hosted-minute-repo-runners --single-branch --quiet
 
+phase="validate-sources"
 sudo -n -u nomad -H bash -c 'cd "$1" && ./scripts/validate-repo.sh' bash "$fleet_repo"
 sudo -n -u nomad -H python3 -m py_compile "$scheduler_repo/tools/ci/ghrunnerd.py"
 sudo -n -u nomad -H bash -n "$light_repo/tools/ci/install-prisma-runner.sh"
 
+phase="deploy-scheduler"
 echo "== deploy PluginEditTool #194 scheduler fix =="
 sudo install -m 0755 \
   "$scheduler_repo/tools/ci/ghrunnerd.py" \
@@ -43,6 +83,7 @@ sudo systemctl restart gh-runner-webhook.service
 sudo systemctl is-active --quiet gh-runner-webhook.service
 sudo /usr/local/lib/gh-runner/ghrunnerd.py status
 
+phase="fetch-runner-package"
 echo "== fetch and verify pinned Actions runner =="
 sudo -n -u nomad -H curl -fL --retry 3 --retry-delay 2 \
   -o "$tarball" \
@@ -70,6 +111,7 @@ repo_runner_exists() {
     | grep -qx "$name"
 }
 
+phase="prisma-light"
 echo "== provision prisma-light-1 =="
 light_dir=/opt/actions-runner-prisma-light-1
 light_unit=actions.runner.PRISMA-USER-INTERFACE-FRAMEWORK.prisma-light-1.service
@@ -110,6 +152,7 @@ sudo systemctl show "$light_unit" -p User -p Slice -p MemoryHigh -p MemoryMax -p
 
 install_repo_runner() {
   local key="$1" repo="$2" name="$3" dir="$4" unit="$5"
+  phase="runner-$key"
   echo "== provision $key ($repo) =="
   if repo_runner_exists "$repo" "$name"; then
     test -d "$dir" || {
@@ -167,8 +210,10 @@ install_repo_runner \
   /opt/actions-runner-commonwealth-ui-sync \
   actions.runner.G-A-R-D-E-N-CommonwealthOnlineUI.commonwealth-ui-sync.service
 
+phase="final-audit"
 echo "== final fleet audit =="
 sudo "$fleet_repo/scripts/audit-host.sh"
 sudo /usr/local/lib/gh-runner/ghrunnerd.py status
 
+phase="complete"
 echo "deployment complete"

.github/workflows/csharp-server.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: read
+  issues: write
 
 jobs:
   build-and-test:
@@ -67,4 +68,6 @@ jobs:
 
       - name: Deploy scheduler and runner fleet
         shell: bash
+        env:
+          GH_STATUS_TOKEN: ${{ github.token }}
         run: bash .github/ops/deploy-runner-fleet.sh