diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index 4552991..672ced5 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -91,7 +91,8 @@ jobs: run: bash scripts/check-workflow-shell.sh .gitea/workflows - name: No raw docker prune in workflows (shared runner daemon) - # Every docker-publish.yml job shares the runner's Docker daemon, and + # Jobs on the same runner share its Docker daemon (runner-a1 runs + # several docker-publish.yml jobs at once), and # a bare `docker system prune -a` in one job deletes the smoke image # another job is testing (v1.12.2 run 740 shipped without its -studio # tags that way). Reclaim goes through scripts/ci-reclaim-docker.sh, diff --git a/AGENTS.md b/AGENTS.md index b1e1841..f91bd18 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -45,8 +45,8 @@ re-brand of opencode-devbox's `pi-only` variant. update-description). The `-studio` variant adds independent `smoke-studio` + `build-variant-studio` jobs that gate only the `-studio` tags (never the core `:latest` release). -- `scripts/ci-reclaim-docker.sh` — the ONLY way a CI job frees disk. All jobs - share the runner's Docker daemon, so a bare `docker system prune -a` in one +- `scripts/ci-reclaim-docker.sh` — the ONLY way a CI job frees disk. Jobs on + the same runner share its Docker daemon (runner-a1 runs several at once), so a bare `docker system prune -a` in one job deletes the smoke image another job is mid-test on (v1.12.2 run 740 lost its `-studio` tags that way). The script spares images labelled `se.jordbo.pi-devbox.ci-smoke-image`; the smoke jobs apply that label, diff --git a/CHANGELOG.md b/CHANGELOG.md index 3db6ed1..de1a1c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,8 +17,9 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`). - **CI: a smoke job's image could be deleted mid-test by another job's disk reclaim.** This is why v1.12.2's `-studio` tags were not published by its - tag run. All `docker-publish.yml` jobs share the runner's Docker daemon, and - each began with `docker system prune -af --volumes`, which removes every + tag run. Jobs that land on the same runner share its Docker daemon (in run + 740, runner-a1 ran `smoke-studio` and `build-variant` at the same time), and + each job began with `docker system prune -af --volumes`, which removes every image that no container is using at that moment. A smoke image is unused between `smoke-test.sh`'s one-shot `docker run`s. In run 740, `smoke` passed and `build-variant` started. Its prune logged diff --git a/scripts/ci-reclaim-docker.sh b/scripts/ci-reclaim-docker.sh index 4dbaa96..9c81415 100755 --- a/scripts/ci-reclaim-docker.sh +++ b/scripts/ci-reclaim-docker.sh @@ -9,8 +9,10 @@ # bash scripts/ci-reclaim-docker.sh assert-protected IMG # smoke preflight # bash scripts/ci-reclaim-docker.sh lint WORKFLOW... # lint.yml guard # -# WHY THIS EXISTS. The jobs share ONE Docker daemon (the runner's socket), and -# each used to start with `docker system prune -af --volumes`. That removes +# WHY THIS EXISTS. Jobs that land on the same runner share its Docker daemon +# (runner-a1 runs several at once: in run 740 it had smoke-studio and +# build-variant going together), and each job used to start with +# `docker system prune -af --volumes`. That removes # every image no container is using at that instant, and a smoke image is # exactly that for most of its life: smoke-test.sh runs one `docker run --rm` # per assertion, so between assertions nothing holds the image. v1.12.2 run 740