44 lines
2.3 KiB
Markdown
44 lines
2.3 KiB
Markdown
---
|
|
tags: [cc-ci, enrollment, testing, deploy]
|
|
---
|
|
|
|
# Enroll-verify gate fixtures must fail loudly
|
|
|
|
## Context
|
|
|
|
During rustdesk-server enrollment (2026-10-30, cc-ci PR #48) the first full-suite verification
|
|
run came back RED only because of the *fixture*, not the app: the punch-hole regression test's
|
|
version gate read the deployed image with a hand-rolled `docker service inspect`, got None, and
|
|
the `if version is not None and version < (1,1,16)` gate silently decided to RUN on a 1.1.12 head
|
|
where pre-fix answering is the expected behavior. An expected-RED looked like a real bug.
|
|
|
|
## Lesson
|
|
|
|
- A test gate that cannot decide its condition must `pytest.fail` LOUDLY with the raw value —
|
|
never default to None-into-an-if (silently runs → wrong RED) or silent skip (vacuous green).
|
|
- cc-ci already has a first-class image reader: `runner/harness/lifecycle.py::deployed_identity(domain)`
|
|
→ `{"version","image","chaos"}`; parse the tag from `.image` and strip any `@sha256:` digest.
|
|
Hand-rolled service inspects in recipe_meta/custom tests are a duplication hazard.
|
|
- Version-gated custom tests skip on pre-fix heads by design (STYLE §2) — that is fine as long
|
|
as the version read itself cannot fail silently.
|
|
|
|
# cc-ci host deploy mechanism (post host-merge, 2026-09+)
|
|
|
|
To run any merged cc-ci main change on the live host now, use the `--cc-ci-only` path from
|
|
/cc-ci-orchestrator-update — merge the PR first (enrollment PRs: comment verification evidence,
|
|
then merge — invocation = authorization), then:
|
|
|
|
```
|
|
ssh cc-ci 'sudo -H -u loops bash -lc "cd /srv/cc-ci-orch && nix flake update cc-ci &&
|
|
git -c user.name=auto-update -c user.email=auto-update@cc-ci commit -qm \"flake.lock: cc-ci -> main\" -- flake.lock &&
|
|
git push -q origin HEAD:main"'
|
|
ssh cc-ci 'git -C /etc/cc-ci pull --ff-only --recurse-submodules'
|
|
systemd-run --unit=ccci-rebuild-test --collect -E HOME=/root -p WorkingDirectory=/srv/cc-ci-orch \
|
|
bash -lc "nixos-rebuild test --flake /srv/cc-ci-orch#cc-ci" # := health checks := then switch
|
|
```
|
|
|
|
The old staging procedure (branch clone at /root/cc-ci-deploy, referenced by the retired
|
|
/cc-ci-server-update skill and old enroll SKILL.md step 7 lines) is obsolete — the combined-host
|
|
flake takes the cc-ci module from the lockfile, so a BRANCH cannot be staged that way; deploy
|
|
after merge instead.
|