julien
a463199728
## Summary Closes the deferred-since-day-one cache-server gap (documented as "Cache server (deferred)" in `infra/README.md` and mentioned every time we hit a slow CI install). **Root cause.** `act_runner`'s built-in cache server binds inside the runner container and advertises an IP on the compose-defined `apf-portal-act-runners` bridge — but jobs are spawned via the mounted `/var/run/docker.sock`, which puts them on Docker's anonymous default `bridge`. The advertised URL is unreachable from the job, every cache request burns a ~2 min `ETIMEDOUT` (restore + save), the hit rate is zero. **Fix.** Tell `act_runner` to attach jobs to the same compose-defined bridge as the runners, via `container.network` in the shared `runner-config.yaml`. The advertised cache URL becomes a normal internal-network DNS hop, jobs reach the cache server, `cache: 'pnpm'` works end-to-end. **Blast-radius trade-off** (bounded). Every container on `apf-portal-act-runners` is one of our runner containers, plus the jobs they spawn — all of which already have full docker-socket access. Sharing a network doesn't widen what a malicious workflow can already do; it just lets jobs reach the cache server. ## What lands - `infra/runner-config.yaml` — add `container.network: apf-portal-act-runners`. Surface the `cache.enabled: true` default explicitly so the toggle is discoverable. - `.gitea/workflows/ci.yml` — re-enable `cache: 'pnpm'` on every `actions/setup-node` step (5 jobs). Drop the now-stale block comment that explained the disablement. - `.gitea/workflows/security-scheduled.yml` — same on the two setup-node steps. - `infra/README.md` "Cache server" section rewritten — was `"(deferred)"`, now describes the working setup, rationale, and the disable toggle. - `ci.yml`'s Trivy comment trimmed to drop the cross-reference to the deferred-cache-server section that no longer exists. ## Roll-out (manual, post-merge, on the runner host) ```bash cd <repo>/infra git pull ./ci-runners.sh rotate ``` `rotate` recreates the containers with the new `runner-config.yaml` mount intact (rolling restart, ~15 s pause between each runner so the CI pipeline stays online). ## Test plan - [ ] CI green on this PR (the gates run on the runners as configured **before** rollout, so this PR's run is one last "uncached" cycle). - [ ] After rollout, the next CI run's `Set up Node.js` step shows the cache restore attempt **succeed quickly** (no ETIMEDOUT). The `Run pnpm install --frozen-lockfile` step on the first post-rollout run still reports `Progress: resolved N, reused 0, downloaded N` (cold seed). - [ ] The **second** post-rollout run reports `reused N, downloaded 0` (or a small downloaded delta if Renovate moved a dep meanwhile) — the cache hit is real. - [ ] `Complete job` step at the end no longer shows `reserveCache failed: connect ETIMEDOUT` warnings. - [ ] Wall-clock for a typical PR's CI drops by ~5-10 min (5 jobs × ~30-90 s saved on `pnpm install` + the 2× ~2 min ETIMEDOUTs we used to eat). --------- Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr> Reviewed-on: #82
36 lines
1.8 KiB
YAML
36 lines
1.8 KiB
YAML
# act_runner config — shared by all three runner instances defined
|
|
# in ci-runners.compose.yml. Mounted read-only at /etc/runner/config.yaml
|
|
# inside each container, selected via the CONFIG_FILE environment variable.
|
|
#
|
|
# Generated from `act_runner generate-config` and trimmed to the keys we
|
|
# actually need to override. Defaults for everything else.
|
|
# See: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
|
|
|
|
container:
|
|
# Skip the per-job `docker pull` round-trip when the image is already
|
|
# cached locally. The default (true) re-checks the registry on every
|
|
# job start, adding 10-30s of latency per job for no value once the
|
|
# tag is pinned. Image upgrades happen deliberately on the runner
|
|
# host (see infra/README.md "Updating the runner job images") — not
|
|
# implicitly via :latest.
|
|
force_pull: false
|
|
|
|
# Attach every job to the same Docker bridge network as the runner
|
|
# containers themselves. Default behaviour (no value) is for jobs to
|
|
# join Docker's anonymous "bridge" network — different from the
|
|
# compose-defined `apf-portal-act-runners` bridge — which leaves
|
|
# jobs unable to reach the runner-hosted cache server (the IP it
|
|
# binds to and advertises is on the runners' bridge, not the jobs').
|
|
# Sharing the network closes the gap and lets `actions/setup-node`'s
|
|
# `cache: 'pnpm'` work end-to-end. The blast radius is bounded:
|
|
# every container on this network is one of our runner containers,
|
|
# all of which already have full docker-socket access.
|
|
network: apf-portal-act-runners
|
|
|
|
# Built-in cache server — defaults are good (enabled, listens on a
|
|
# pseudo-random port, stores cache under the runner's writable home).
|
|
# Documented here only so a future contributor knows where the toggle
|
|
# lives if it has to be disabled.
|
|
cache:
|
|
enabled: true
|