recipe-maintainers/keycloak
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: upgrade app to 26.7.0 #5

Closed
autonomic-bot wants to merge 0 commits from upgrade-526f6b5 into main
pull from: upgrade-526f6b5
merge into: :main
Conversation 7 Commits - Files Changed -
autonomic-bot commented 2026-07-13 20:31:19 +00:00
Owner
Copy Link
Copy Source

Recipe upgrade.

Commits on top of upstream main:

  • a0e1579 chore: upgrade app to 26.7.0

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

Recipe upgrade. Commits on top of upstream main: - a0e1579 chore: upgrade app to 26.7.0 Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-07-13 20:31:19 +00:00
chore: upgrade app to 26.7.0
cc-ci/testme install-tier canonical baseline healthy again; full pass
Details
526f6b57c1
autonomic-bot requested review from trav 2026-07-13 20:31:20 +00:00
autonomic-bot requested review from notplants 2026-07-13 20:31:20 +00:00
autonomic-bot commented 2026-07-13 20:31:38 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-07-13 20:31:40 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — keycloak @ 526f6b57 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `keycloak` @ `526f6b57` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1120/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1120) [![level](https://ci.commoninternet.net/runs/1120/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1120) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1120) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot commented 2026-07-24 04:19:37 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-07-24 04:19:51 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — keycloak @ 526f6b57 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `keycloak` @ `526f6b57` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1135/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1135) [![level](https://ci.commoninternet.net/runs/1135/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1135) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1135) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot commented 2026-08-04 01:05:02 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — keycloak @ 526f6b5 ❌ VERDICT=RED (Drone builds 1179 + 1181, both red)

Bridge note: the ccci-bridge is silently dropping !testme (stale mounted Gitea-bot swarm secret → HTTP 401 "user does not exist"), so this run was driven directly via the Drone API with the bridge's exact query-string params (RECIPE=keycloak REF=526f6b5 PR=5 SRC=recipe-maintainers/keycloak) + a freshly-minted scoped GITEA_TOKEN for the runner's clone. The verdict was reflected back here manually as commit-status cc-ci/testme=failure. (Bridge secret not touched — operator infra.)

Diagnosis (this is NOT a recipe regression and NOT a stale test for the new version):

  • Both Drone runs fail identically at the install stage: deploy/readiness of the canonical baseline 10.8.0+26.6.3 (Keycloak 26.6.3 — the published tag immediately below the PR head's 10.8.1+26.6.4 label) times out with HTTP 404 on /realms/master over HTTPS. The upgrade stage (our 26.7.0) is never reached.
  • The 26.6.4 → 26.7.0 bump itself is verified green in a direct deploy on the cc-ci host (step 2b of the run): Keycloak 26.7.0 started in 7.6s, Migrating older model to 26.7.0, migrated realm master to 26.7.0, HTTP 200 on https://dev-keycloak.ci.commoninternet.net/realms/master. Torn down cleanly.
  • The canonical baseline 10.8.0+26.6.3 was ALSO redeployed directly on the host just now and serves HTTP 200 on /realms/master — so the recipe + the canonical tag + the host's abra are all fine.
  • The same PR head (526f6b5) was GREEN on 2026-07-24 (Drone build 1135) with an identical install baseline. The only delta between 07-24 GREEN and 08-03 RED is on the cc-ci/harness side: cc-ci main merged flake: bump nixpkgs + sops-nix (2026-08-03) (5366e061, includes 4772e312 nixpkgs bump + c541cb14 networking pin) earlier today. That infra change is the most likely root cause of the harness install readiness regression (the per-run Drone build 1179/1181 also did not persist a /var/lib/cc-ci-runs/1179 dir to the host, unlike concurrent other-recipe builds 1178/1180/1182 — suggesting a Drone-runner volume/env change).

A pre-existing recipe typo exists (compose.yml has depends_on: - mariadb referencing a non-existent service; the db service is named db and the volume is named mariadb), but it is not what is blocking CI: docker swarm docker stack deploy (what abra app deploy runs) ignores undefined depends_on, and the host deploy of both 26.6.3 and 26.7.0 succeeds with the typo present (HTTP 200). The harness's abra recipe config --images prepull step does rc=15 on this typo but treats it as a non-fatal skip ("deploy will pull as usual"). I did not edit it — it is out of scope for this upgrade PR and not the root cause.

Recommendation: this is a harness/infra regression on the 2026-08-03 nixpkgs bump, not a recipe/up graded-side problem. The recipe PR (#5) stands as-is (the 26.6.4 → 26.7.0 bump is correct and was direct-deploy-verified). Operator actions:

  1. Investigate cc-ci main commits 4772e312/c541cb14/5366e061 (nixpkgs + networking pin) — likely changed Drone-runner abra/traefik/network behavior so the per-run install readiness 404s.
  2. Re-run /recipe-upgrade keycloak --with-tests once the harness is fixed, to flip !testme to GREEN on this PR head (no recipe change expected to be needed).
  3. (Optional, separate PR) fix the depends_on: - mariadb → - db typo for cleanliness.

NOT merged — for operator review. cc @trav @notplants

🌻 **cc-ci** — `keycloak` @ `526f6b5` ❌ **VERDICT=RED** (Drone builds 1179 + 1181, both red) **Bridge note:** the `ccci-bridge` is silently dropping `!testme` (stale mounted Gitea-bot swarm secret → HTTP 401 "user does not exist"), so this run was driven **directly via the Drone API** with the bridge's exact query-string params (`RECIPE=keycloak REF=526f6b5 PR=5 SRC=recipe-maintainers/keycloak`) + a freshly-minted scoped GITEA_TOKEN for the runner's clone. The verdict was reflected back here manually as commit-status `cc-ci/testme=failure`. (Bridge secret not touched — operator infra.) **Diagnosis (this is NOT a recipe regression and NOT a stale test for the new version):** - Both Drone runs fail identically at the **install** stage: deploy/readiness of the canonical baseline `10.8.0+26.6.3` (Keycloak **26.6.3** — the published tag immediately below the PR head's `10.8.1+26.6.4` label) times out with HTTP 404 on `/realms/master` over HTTPS. The upgrade stage (our 26.7.0) is never reached. - The 26.6.4 → 26.7.0 bump itself is **verified green in a direct deploy** on the cc-ci host (step 2b of the run): `Keycloak 26.7.0 started in 7.6s`, `Migrating older model to 26.7.0`, `migrated realm master to 26.7.0`, HTTP 200 on `https://dev-keycloak.ci.commoninternet.net/realms/master`. Torn down cleanly. - The canonical baseline `10.8.0+26.6.3` was ALSO redeployed directly on the host just now and serves HTTP 200 on `/realms/master` — so the recipe + the canonical tag + the host's abra are all fine. - The same PR head (526f6b5) was **GREEN on 2026-07-24** (Drone build 1135) with an identical install baseline. The only delta between 07-24 GREEN and 08-03 RED is on the cc-ci/harness side: cc-ci main merged `flake: bump nixpkgs + sops-nix (2026-08-03)` (`5366e061`, includes `4772e312` nixpkgs bump + `c541cb14` networking pin) earlier today. That infra change is the most likely root cause of the harness install readiness regression (the per-run Drone build 1179/1181 also did not persist a `/var/lib/cc-ci-runs/1179` dir to the host, unlike concurrent other-recipe builds 1178/1180/1182 — suggesting a Drone-runner volume/env change). **A pre-existing recipe typo exists** (`compose.yml` has `depends_on: - mariadb` referencing a non-existent service; the db service is named `db` and the volume is named `mariadb`), but it is **not** what is blocking CI: docker swarm `docker stack deploy` (what `abra app deploy` runs) ignores undefined `depends_on`, and the host deploy of both 26.6.3 and 26.7.0 succeeds with the typo present (HTTP 200). The harness's `abra recipe config --images` prepull step does rc=15 on this typo but treats it as a non-fatal skip ("deploy will pull as usual"). I did **not** edit it — it is out of scope for this upgrade PR and not the root cause. **Recommendation:** this is a harness/infra regression on the 2026-08-03 nixpkgs bump, not a recipe/up graded-side problem. The recipe PR (#5) stands as-is (the 26.6.4 → 26.7.0 bump is correct and was direct-deploy-verified). Operator actions: 1. Investigate cc-ci main commits `4772e312`/`c541cb14`/`5366e061` (nixpkgs + networking pin) — likely changed Drone-runner abra/traefik/network behavior so the per-run install readiness 404s. 2. Re-run `/recipe-upgrade keycloak --with-tests` once the harness is fixed, to flip `!testme` to GREEN on this PR head (no recipe change expected to be needed). 3. (Optional, separate PR) fix the `depends_on: - mariadb` → `- db` typo for cleanliness. NOT merged — for operator review. cc @trav @notplants
autonomic-bot commented 2026-08-04 17:32:27 +00:00
Author
Owner
Copy Link
Copy Source

Harness regression RESOLVED — verdict now GREEN (drone build #1199).

The canonical-baseline 404 that red'd builds #1179/#1181 during the 2026-08-03 weekly run is no longer reproducible: the same baseline install now converges and serves 200 through the full Drone path (router registered, artifacts persisted). The regression window was ~21:00 Aug 3 – early Aug 4 and healed after the cc-ci host's 2026-08-04 re-activation (bridge-secret deploy); the recipe was never at fault (as diagnosed — direct deploys were green throughout).

Status reflected as cc-ci/testme=success on head 526f6b57c1. Ready for operator review/merge.

**Harness regression RESOLVED — verdict now GREEN** (drone build [#1199](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1199)). The canonical-baseline 404 that red'd builds #1179/#1181 during the 2026-08-03 weekly run is no longer reproducible: the same baseline install now converges and serves 200 through the full Drone path (router registered, artifacts persisted). The regression window was ~21:00 Aug 3 – early Aug 4 and healed after the cc-ci host's 2026-08-04 re-activation (bridge-secret deploy); the recipe was never at fault (as diagnosed — direct deploys were green throughout). Status reflected as `cc-ci/testme=success` on head `526f6b57c1`. Ready for operator review/merge.
autonomic-bot commented 2026-08-07 02:21:06 +00:00
Author
Owner
Copy Link
Copy Source

Auto-closed by /recipe-upgrade: its changes are already in upstream main (merged upstream); mirror main re-synced

Auto-closed by /recipe-upgrade: its changes are already in upstream main (merged upstream); mirror main re-synced
autonomic-bot closed this pull request 2026-08-07 02:21:06 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/keycloak#5