autonomic-bot
fae2fbe21b
25 open recipe PRs had accumulated, and the list had stopped being readable: CI sweep artifacts that were never meant to merge sat next to genuine CVE fixes, and three PRs the operator had been told were outstanding were in fact already merged upstream (discourse #6 with 140 CVEs, keycloak #6 with 12, n8n #5) — visible only once the mirrors were reconciled. The skill: reconcile every mirror from true upstream FIRST (that step alone closed those three), survey every open PR deterministically, close the ones that cannot merge or were never meant to, and report prioritised action items — CVE-carrying first — for the ones that should land. It never merges a recipe PR. pr-survey.py gathers the facts and decides nothing: behind_main, mergeable, diff_files, which images the PR adds vs which are already pinned in main, the newest !testme verdict, branch kind, age. One correctness detail worth the extra state: a FAILED diff fetch is reported as unknown, never as an empty diff. gitea #4 reads that way (force-pushed branch) while being a verified green fix, and 'empty diff' is a close signal — so the tool says DIFF-UNREADABLE(do not close on this) instead.
111 lines
6.6 KiB
Markdown
111 lines
6.6 KiB
Markdown
---
|
|
name: help
|
|
description: Operator orientation - lists every skill available on this orchestrator with what it does and when to reach for it, grouped by purpose (status, weekly maintenance, host updates, tests, enrollment, recovery, reporting), plus a "what do you want to do?" guide for common situations. Read-only. Invoke as /help.
|
|
---
|
|
|
|
# help
|
|
|
|
Orient the operator: what this orchestrator can do, via which skill, and what's sensible next.
|
|
|
|
**First, enumerate the live roster** (skills get added — don't trust this file's list blindly):
|
|
```
|
|
ls /srv/cc-ci-orch/.opencode/skills/ # canonical definitions (one dir per skill)
|
|
```
|
|
For any skill not described below, read its `SKILL.md` frontmatter description and include it.
|
|
Then present the roster grouped as follows, and close with the situation guide.
|
|
|
|
## The roster (curated descriptions — merge with the live listing)
|
|
|
|
**Status & orientation**
|
|
- **/cc-ci-status** — the comprehensive read-only health/status check: weekly-run outcomes,
|
|
report publishing, stale tests, CVE-PR aging, host update recency, service health, bridge
|
|
`!testme` path. Ends `ALL HEALTHY` or prioritized findings each mapped to a skill. **Start
|
|
here when unsure.**
|
|
- **/help** — this orientation.
|
|
|
|
**Weekly maintenance (recipes)**
|
|
- **/upgrade-all** — the weekly sweep: survey every `weekly` recipe, open verified upgrade PRs,
|
|
write the summary + report. Runs on a timer (`cc-ci-upgrade-all.timer`, Fri 02:00 UTC);
|
|
invoke manually to run it now.
|
|
- **/recipe-upgrade <recipe>** — the same pipeline for ONE recipe (plan → bump → verify green →
|
|
PR). `--with-tests` also fixes that recipe's stale test.
|
|
- **/recipe-report** — (re)generate the weekly report page for report.ci.commoninternet.net.
|
|
|
|
**Keeping the PR list honest**
|
|
- **/cc-ci-cleanup** — reconciles every mirror from true upstream (which alone closes PRs upstream
|
|
already merged), then closes the open recipe PRs that can no longer merge or were never meant to
|
|
(CI sweep artifacts, obsolete bumps, superseded duplicates) and reports what is actually blocking
|
|
the ones that should land. Never merges.
|
|
|
|
**Security (CVEs)**
|
|
- **/cve-check** — fleet-wide CVE sweep with **no upgrading**: for every recipe, work out what
|
|
upgrade is available (per image, sidecars included), scan it for CVEs, and publish a CVE report.
|
|
Read-only and quick — the "what are we exposed to?" answer without an upgrade run.
|
|
- **/cve-check-and-upgrade** — the same sweep, then open verified PRs **only** for the recipes whose
|
|
upgrade actually fixes a CVE, worst severity first. `--min-severity high` for just the urgent ones.
|
|
Never merges.
|
|
|
|
**Tests**
|
|
- **/cc-ci-tests-update** — fleet-wide stale-test cleanup: find tests broken by legitimate
|
|
upstream changes, fix without weakening, verify, merge the test PRs.
|
|
- **/ci-test-review** — diagnose a specific red CI run: classify recipe bug vs stale test vs
|
|
CI-server bug, then fix on the right side.
|
|
|
|
**cc-ci itself**
|
|
- **/cc-ci-server-update** — bump the CI **server** host's nixpkgs/sops-nix, deploy with
|
|
build → `nixos-rebuild test` → switch + health gate, PR merged on green.
|
|
- **/cc-ci-orchestrator-update** — same for **this** orchestrator host (self-update caveats).
|
|
- **/cc-ci-update** — both of the above plus /cc-ci-tests-update in one pass.
|
|
- **/ci-dev-workflow** — harness/CI-server development discipline (changing cc-ci itself).
|
|
|
|
**Enrollment**
|
|
- **/recipe-enroll <recipe>** — add a NEW recipe to the maintained set end-to-end: mirror,
|
|
test suite, bridge + inventory enrollment, full-suite-green verification, bridge deploy.
|
|
|
|
**Recovery**
|
|
- **hetzner-server-recovery** — when a Hetzner host is unreachable over SSH/tailscale: API
|
|
reboot, rescue mode, GRUB generation selection (submenu ids are `1>N`), console access.
|
|
|
|
**Recipe-maintainer toolkit (`/cctest-*` — the ARM sandbox + cctest test server, NOT cc-ci)**
|
|
The full autonomic-recipe-maintainer skill set, vendored as a pinned submodule
|
|
(`references/recipe-maintainer`) and exposed with the `cctest-` prefix — ~30 skills for
|
|
hands-on recipe work against the recipe-maintainer **cctest** test server and local abra
|
|
sandbox: `/cctest-intro` (start here), `/cctest-recipe-overview`, `/cctest-recipe-init`,
|
|
`/cctest-recipe-deploy`, `/cctest-recipe-test*`, `/cctest-recipe-upgrade-plan|apply|full`,
|
|
`/cctest-new-recipe-guide`, sandbox/instance management (`/cctest-setup-sandbox`,
|
|
`/cctest-t1cc-start|stop`), and more — enumerate with `ls .opencode/skills | grep ^cctest-`.
|
|
**Rule of thumb:** verifying/shipping against the CI pipeline → the cc-ci skills above;
|
|
exploratory or hands-on recipe development on a test instance → `/cctest-*`. Policy is
|
|
unified: recipe PRs are never agent-merged on either side (operator reviews + merges), and
|
|
ARM skills never touch cc-ci infra. After a submodule bump run `scripts/gen-cctest-skills.py`.
|
|
|
|
## "What do you want to do?"
|
|
|
|
| Situation | Do this |
|
|
|---|---|
|
|
| "How is everything?" | `/cc-ci-status` |
|
|
| "Run the weekly upgrades now" | `/upgrade-all` (or `systemctl start cc-ci-upgrade-all.service`) |
|
|
| "Upgrade just <recipe>" | `/recipe-upgrade <recipe>` |
|
|
| "The report site is stale/missing a week" | `/recipe-report` |
|
|
| "The open PR list is a mess / what should I merge?" | `/cc-ci-cleanup` |
|
|
| "What CVEs are we exposed to right now?" | `/cve-check` (read-only, no PRs) |
|
|
| "A CVE just dropped — check and patch it" | `/cve-check-and-upgrade` (add `--min-severity high` to skip the noise) |
|
|
| "Is <recipe> vulnerable?" | `/cve-check <recipe>` |
|
|
| "Tests are red because upstream changed" | `/cc-ci-tests-update` (fleet) or `/recipe-upgrade <r> --with-tests` |
|
|
| "A CI run failed and I don't know why" | `/ci-test-review` |
|
|
| "Update the CI server OS/deps" | `/cc-ci-server-update` |
|
|
| "Update this orchestrator's OS/deps" | `/cc-ci-orchestrator-update` |
|
|
| "Add <recipe> to what we maintain" | `/recipe-enroll <recipe>` |
|
|
| "A host is unreachable" | `hetzner-server-recovery` |
|
|
| "Hack on / bootstrap a recipe in a sandbox" | `/cctest-recipe-init`, `/cctest-recipe-deploy`, `/cctest-recipe-test` |
|
|
| "New to recipe work, where do I start?" | `/cctest-intro` |
|
|
| "What needs my review?" | `/cc-ci-status` → its open-PR section lists CVE-urgent + ready-to-merge PRs |
|
|
|
|
**Standing conventions** (all skills follow these): PRs are opened for visibility and merged
|
|
directly once verified (invocation = authorization) — except recipe upgrade PRs, which stay
|
|
operator-merged; `nixos-rebuild test` before any `switch`; never weaken a test; single-writer
|
|
branches; serialize deploy-heavy work on the shared swarm.
|
|
|
|
If several things need doing, run `/cc-ci-status` first — its findings come pre-prioritized
|
|
with the skill to invoke for each.
|