Switch requirements.yml to type: url entries pointing to the Gitea
package registry. The devx setup.py downloads these with token auth
and installs offline, falling back to galaxy.ansible.com if the
mirror is unavailable.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-09 01:07:38 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The prune service and healthcheck were force-removing ALL containers
(except GITEA-ACTIONS-TASK), including molecule test containers that
CI jobs were actively using. This caused "No such container" errors
during molecule prepare/converge phases.
Filter by RunningFor field — only remove containers showing
"hour/day/week/month/year ago", excluding "minutes/seconds ago".
This prevents killing molecule containers from running CI jobs
while still cleaning up stale containers from crashed jobs.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-09 01:07:38 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
docker network prune -f removes ALL unused networks, including ones
that molecule tests are actively creating (e.g. 'traefik' network
created during molecule create phase before containers are attached).
This caused "network traefik not found" errors in CI molecule tests.
Add --filter "until=1h" to only prune networks older than 1 hour,
matching the container prune filter.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-09 01:07:38 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The healthcheck's `journalctl --user` command fails with "No journal
files were opened due to insufficient permissions" for runner users
that lack journal access. This caused the healthcheck to always report
"OK: runner healthy" even when all runners were unregistered — the
auto-recovery never triggered.
Replace journal-based detection with a Gitea API query: read the
runner's ID from the .runner file and verify it exists in
GET /api/v1/admin/actions/runners. This works regardless of journal
permissions.
Also add scripts/cleanup_stale_runners.py for bulk cleanup of stale
runner registrations (runners that haven't been online for a
configurable threshold).
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-09 01:07:38 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The prune service and healthcheck force-remove ALL containers via
"docker ps -aq | xargs -r docker rm -f", but this includes the CI
job container itself (named GITEA-ACTIONS-TASK-*). Removing it causes
"RWLayer of container is unexpectedly nil" errors and kills the
active CI job.
Exclude containers whose name starts with GITEA-ACTIONS-TASK from
the force-remove step. Use "docker ps -a --format" with name filtering
instead of "docker ps -aq".
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-08-09 01:07:38 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The docker-prune systemd service and healthcheck script used
"docker container prune -f" which only removes stopped containers.
Running containers from failed/interrupted molecule tests accumulated
indefinitely on runner hosts, consuming disk and memory, causing CI
test speed variance (12s → 39s for identical test suites).
Changes:
- docker-prune.service.j2: stop+rm ALL containers before system prune
- runner-healthcheck.sh.j2: force-remove all containers when disk
threshold is hit, use "system prune -af --volumes" for thorough cleanup
- template-content/verify.yml: update assertions to match new templates
The molecule_ci_guard.py in devx was also updated to run "molecule
destroy" on test failure/interruption, preventing containers from
being left running in the first place.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
## Summary
Thoroughly cleans Docker artifacts on runner removal, updates devx to v0.9.11, fixes Makefile checkmake graceful skip, and comprehensive docs rewrite.
Molecule tests fail due to pre-existing Docker infrastructure issue (Docker socket not available in CI runners).
Closes GRM-75
The deregister scenario's verify.yml was missing the runner_name var,
which is required because gitea_runner_data_dir depends on it via
defaults/main.yml. Without it, the verify phase fails with
"'runner_name' is undefined".
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-21 00:45:47 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Ansible evaluates environment blocks even when when conditions are
false. The deregister scenario sets skip_runner_registration: true
but the environment block still references gitea_runner_uid, causing
"variable is undefined" errors. Add default(0) filter to prevent
this.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-21 00:34:07 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The Arch Linux pacman package for GPG is called 'gnupg', not 'gpg'.
The molecule prepare.yml was trying to install a non-existent 'gpg'
package, causing failures on the archlinux platform.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-21 00:22:20 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The "Enable lingering" task always reported changed=true, and the
"Download gitea_runner binary" task used force=true which always
re-downloads. Both caused molecule idempotence tests to fail.
- Check /var/lib/systemd/linger/<user> before enabling lingering
- Set force=false on get_url so binary is only downloaded if missing
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-21 00:13:19 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The "Restart gitea-runner" handler was not guarded by
docker_rootless_setup, causing failures in CI containers without a
systemd user bus. Also add failed_when: false to all lifecycle
side_effect.yml systemctl --user tasks.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-21 00:06:27 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The daemon-reload, service restart, and service check tasks in
service.yml, prune.yml, update_runner.yml, and integration_test.yml
were not guarded by docker_rootless_setup. In CI containers without
a systemd user bus, these tasks fail with "Failed to connect to bus".
Also fix the integration_test.yml validation task to not fail on
service status when docker_rootless_setup is false.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-21 00:00:07 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The validate.yml had an unconditional 'docker version' check, and
service.yml/prune.yml unconditionally enabled services that need
Docker running. Added when: docker_rootless_setup to:
- validate.yml: Verify rootless Docker connectivity
- service.yml: Enable and start gitea-runner service
- prune.yml: Enable and start docker-prune timer
Also made lifecycle side_effect tolerant of service start failure
since Docker daemon isn't available in molecule containers.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 22:50:25 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Rootless Docker requires newuidmap/newgidmap kernel support which
doesn't work in nested Docker containers (Operation not permitted).
Added docker_rootless_setup variable (default true) to skip the
daemon startup steps. Set to false in all molecule converge playbooks
so tests verify package installation, user creation, service file
rendering, and config without requiring a working rootless daemon.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 22:37:31 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Three changes:
1. CI: add set -e and fail-fast: true to stop on first molecule failure
instead of continuing (all pairs fail for same reason anyway)
2. Docker APT repo: use copy module to write sources.list directly
instead of apt_repository module which wasn't picking up the repo
3. Fix arch mapping: ansible_facts returns x86_64, Docker repo needs amd64
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 22:31:08 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
ansible_facts['architecture'] returns x86_64 but Docker APT repo
expects amd64. Added docker_apt_arch mapping. Also added debug tasks
to show apt sources and apt-cache search results for docker-ce.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 22:24:02 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The apt_repository update_cache option wasn't reliably picking up the
new Docker APT repo. Split into separate apt update step. Also moved
the long repo string to a default variable to satisfy yaml line-length
lint rule.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 22:15:28 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The geerlingguy Docker containers don't include curl or gpg, which
are needed by the rootless Docker role to download and dearmor the
Docker APT repository GPG key. Added these prerequisites to the
molecule common prepare playbook.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 22:07:55 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The deb822_repository module isn't available in the CI Ansible
collection. Reverted to apt_repository but now properly dearmors
the GPG key using gpg --dearmor before referencing it in signed-by.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 21:46:33 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The apt_repository module with signed-by wasn't working because the
downloaded GPG key wasn't properly dearmored. The deb822_repository
module handles GPG key download and dearmoring automatically.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 21:35:19 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The rootless_docker.yml task was trying to apt install docker-ce
without first adding the Docker APT repository, causing package not
found errors on Debian/Ubuntu containers.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 21:23:54 +02:00
Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Three major improvements:
1. Rootless Docker refactor: Removes docker/binary modes, unifies to
rootless Docker with per-runner system users. Each runner gets its
own rootless Docker daemon, systemd user service, and isolated
environment. Simplifies CLI (removes --mode option), Ansible role
(single code path), and molecule scenarios (removes binary scenario).
2. Auto-merge fix: Fixes status check context mismatch in branch
protection (was requiring "lint", "unit-tests", "molecule-tests" but
actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
retry/wait logic to auto_merge.py that polls commit statuses for up
to 15 minutes before attempting merge, eliminating the chicken-and-egg
problem where auto-merge would fail because CI hadn't completed yet.
3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
debian-12, archlinux) = 24 test pairs distributed across 3 parallel
runners. Updates distribute_molecule.py to distribute (scenario,
platform) pairs. Updates Makefile with molecule-all target for
local multi-platform testing.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The lifecycle scenario runs in a Docker container without systemd
as PID 1. The side_effect and verify playbooks used systemd module
operations unconditionally, causing failures like:
System has not been booted with systemd as init system
Add a systemd availability check (/run/systemd/system stat) to both
playbooks and conditionally skip systemd tasks when running in
environments without systemd (e.g. Molecule Docker containers).
The multi-instance scenario verify playbook expects config files at
/etc/gitea-runner/<name>/config.yaml (binary mode path). Without
runner_mode set, the role defaulted to docker mode, which places the
config in /var/lib/gitea-runner/<name>/config.yaml instead.
Add runner_mode: binary to both converge plays so config placement
matches the verify assertions.
The binary_mode.yml task file did not create gitea_runner_data_dir
when runner registration was skipped (as in molecule tests). This
caused the binary scenario verify playbook to fail because the
data directory assertion expected it to exist.
Add an explicit directory creation step before config creation,
mirroring the docker_mode.yml structure.
gitea-admin
kireto
emil