@@ -1332,6 +1332,37 @@ Key highlights: gitea upstream shipped its first 2-digit stable (28.0.0-rootless
Per-recipe logs: .cc-ci-logs/upgrades/<recipe>-upgrade-2026-10-02.md (10 files incl. survey).
NEVER MERGED anything; all PRs await operator review + the operator's ` abra recipe release <recipe> -x/y/z` after each merge.
### Event 2026-10-05 ~17:45 UTC — gitea PR #10 stale test fixed (cc-ci PR #44, verified GREEN, NOT merged)
Operator invoked --with-tests for gitea PR #10 (28.0.0-rootless, RED on test_lfs_roundtrip run #31).
Diagnosis: stale test — ` _api()` caught only HTTPError so one urlopen(timeout=20) socket timeout
during the 28.0.0 post-restart migration window escaped the poll loop; poll also hard-coded 120s
deadline vs recipe_meta HTTP_TIMEOUT=600 (STYLE.md §5). Fix: never-raising _api (mirrors
lifecycle.http_fetch) + deadline from recipe_meta.HTTP_TIMEOUT; assertions untouched.
cc-ci PR #44 (branch fix/gitea-lfs-restart-wait) also carries the two PRE-EXISTING main lint
failures (warm.py ruff format; acme-dns.nix statix W201, eval-identical restructure) that had made
push build #33 RED and would have blocked merge — build #34 now success, lint.sh PASS.
Verified: full cold suite on host worktree (e83cd46) vs recipe head 91e42c8 → 5/5 tiers pass,
test_lfs_roundtrip PASSED; unit sample 315 pass / 4 fail = identical pre-existing failures on main.
Pair note posted on both PRs: merge #44, then re-!testme #10. Nothing merged.
### Event 2026-10-05 ~18:00 UTC — wrong-recipe card screenshot root-caused; runner fix #45 merged; gitea !testme re-run GREEN
Operator's !testme on gitea PR #10 (drone build 35) showed a custom-html-tiny screenshot in the card.
Root cause: drone build numbers restarted when its DB was re-created (2026-09-27) while
/var/lib/cc-ci-runs still holds old-era dirs (numbered to 1377) — build 35 collided with a May-31
run 35 whose fossil screenshot.png (12950 B = exactly custom-html-tiny's real shot) was embedded
because screenshot.capture()'s hook branch SKIPPED the snap when out_path existed (no hook saves
itself). Run itself was genuinely gitea level 5. Fix (cosmetics-only, R7): results.fresh_artifact_dir()
wipes owned artifacts at run start + capture() always snaps; 4 unit tests (non-vacuous: capture test
fails on main). Adversary verification PASS (independent fresh clones + own E2E collision test).
cc-ci PR #45 merged (squash, 35ba9976); push self-tests 38/39 green; lint gate now green on main
(#44 had already fixed the two pre-existing lint failures).
Merged #44 first (operator informed; verified earlier via full cold harness run).
Re-ran !testme on gitea PR #10 → drone build 40: GREEN, level 5, card links /runs/40/, screenshot
is a fresh PNG of the run's own gitea (footer 1.24.2 = the upgrade-tier BASE deploy, the last-green
warm canonical — pre-existing capture timing, correct behavior, only freshness was broken before).
Gitea PR #10 now fully green incl. the fixed LFS test (uses merged #44 test). NOTHING else merged;
recipe PR #10 + unrelated PR #4 still await operator merge + ` abra recipe release gitea -x`.
Cleanup: host /tmp/v /tmp/r, local worktrees, test-file mis-commit in orch cc-ci clone reverted.
### Event 2026-10-23 04:15 UTC — weekly /upgrade-all run complete (DEFAULT mode, nothing merged)
Run 2026-10-23: 19 considered · 9 upgraded with !testme GREEN · 2 PRs open pending the warm-canonical
minio-prepull fix (lasuite-docs PR #11, lasuite-drive PR #8 — !testme RED at the upgrade BASE prepull:
@@ -1358,3 +1389,24 @@ onlyoffice direct checks) · matrix-synapse #8 · n8n #10 · wordpress #3.
Summary: .cc-ci-logs/upgrades/upgrade-all-2026-10-30.md (per-recipe logs alongside). Step-0 sweep
reclaimed 66.76GB images + orphan stacks (disk 92%->49%); end-of-run reap 0 leaked dev deploys.
NEVER MERGED anything; PRs await operator review + ` abra recipe release` after each merge.
### Event 2026-10-30 19:00–
One-off upgrade requested from scratch: public mirror ` recipe-maintainers/rustdesk-server` created +
synced; recipe PR https://git.autonomic.zone/recipe-maintainers/rustdesk-server/pulls/1 (1.1.12→1.1.16,
branch upgrade-2e65135, unmerged — operator merges). Upstream checked (low-churn, stray 1.4.5 docker
tags = aborted push; CVE fix POV: UDP punch-hole amplification GH #670 + mio bump; scan 0 CVE-ids,
client-side CVEs fixed in client 1.4.9). Dev-deploy converged clean twice, then !== enrollment: tests
authored (status-key health sidecar overlay compose.ccci.yml serving the private-tool-unreachable
real hbbs public key; ports 21115-21119 + UDP; ws 101 on 21118/19; identity-key cross-source assert;
punch-hole-amplification regression test w/ version-gate), committed d71a53c, cc-ci PR #48.
Verify: run 1 RED (custom tier) — hand-rolled version read returned None so the punch-hole gate
didn't skip on the 1.1.12 head; fixed via harness lifecycle.deployed_identity + loud fail on
unparsable tag (1653582, f5f11cd); runs 2+3 GREEN level 5/5 (recipe main with gate skipping, AND
the upgrade head with the punch-hole test passing actively). PR #48 evidence-commented + MERGED
(200); --cc-ci-only deploy: flake.lock cc-ci 2f6787f→a8b836e, lock commit 4e286ba pushed,
/etc/cc-ci ff to a8b836e, detached nixos-rebuild test → health (0 failed, swarm 1/1) → switch
(21:17 UTC). Bridge env confirms POLL_REPOS += recipe-maintainers/rustdesk-server (1/1, no auth
errors). !testme posted on recipe PR #1 via testme-on-pr.sh → build 119 VERDICT=GREEN (level 5,
lint pass, clean_teardown, no_secret_leak; card embedded in PR by bridge). Card saved:
.cc-ci-logs/upgrades/rustdesk-server-testme-20261030.png. Next weekly /upgrade-all picks
rustdesk-server up automatically (used-recipes.md row committed cd1ec01). /root/cc-ci-test-verify
removed. Operator merges PR #1 then ` abra recipe release`.
