Runs used GitHub's artifact storage and cache service, which ran out of
the monthly included quota and blocked publishing. Caches and job
handoffs now stay on the self-hosted runner host, the desktop release
hands builds over through its draft release, and Windows waits for a
self-hosted runner instead of a GitHub-hosted one. A test enforces it.
Claude-Session: https://claude.ai/code/session_01R8L4XgqjAemFR2remB5hVY
Co-authored-by: Claude <noreply@anthropic.com>
Every main push since the concurrency change cancelled two of the three
image builds: the build job's concurrency group named only the ref, so
the app, updater and computer legs of one run shared it and cancelled
each other, and the publish job never ran. Main has not published an
edge image since. The build and publish groups now name the matrix leg.
The Playwright report publisher also read the jobs of a run's latest
attempt, so a re-run already in progress made it fail on an empty
conclusion. It now reads the attempt that finished.
Claude-Session: https://claude.ai/code/session_01R8L4XgqjAemFR2remB5hVY
Co-authored-by: Claude <noreply@anthropic.com>
* ci: isolate buildx builders for parallel publish-server-image builds
Parallel matrix jobs on shared evo runners raced on ~/.docker/buildx current
builder; one job's setup-buildx cleanup then stopped another job's BuildKit during
cache export. Use per-job DOCKER_CONFIG, stable builder names, and wire build-push
to steps.buildx.outputs.name.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* test: avoid biome noTemplateCurlyInString in publish workflow asserts
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Drop Linux label from gh-only and Node gate jobs so air/mini can pick them up.
Replace mapfile in autopilot for macOS bash 3.2. Remove unverified GHCR tag
DELETE step; document that ci-* handoff aliases are harmless.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Use per-job DOCKER_CONFIG under RUNNER_TEMP so login-action logout on
shared self-hosted runners cannot strip another job's credentials. Drop
broken buildx imagetools rm; untag ci-* handoff labels via the registry
distribution API after publish.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Skip heavy jobs for docs-only and out-of-scope paths while keeping
Product CI as the branch-protection gate. Cancel superseded PR image
validation runs; on main cancel stale builds but serialize publish so
attest/manifest steps are never interrupted.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Build jobs already push each architecture by digest. Tag those manifests
with ephemeral ci-${run_id}-${image}-${arch} refs instead of uploading
digest marker files to Actions artifact storage, which is blocked by the
account-wide quota.
Publish resolves handoff tags back into RUNNER_TEMP digest markers, then
assembles semver/edge tags and attestation as before. Handoff tags are
removed after publish with continue-on-error.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Disable build-push-action build record uploads in publish-server-image;
they are large and unused by the digest publish flow. Digest artifacts
already expire after one day. Set seven-day retention on desktop e2e
screenshots so CI debug uploads do not inherit the org default.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Every image publish on main failed at "Resolve registry attestation
eligibility" with "accepts 1 arg(s), received 2". The step ran
`gh api ... --jq -r '.owner.type'`, but gh api has no -r option: --jq
took "-r" as its filter and the real filter became a second positional
argument. gh api --jq already prints strings without quotes, so the
filter is now passed directly. The images were built and their
manifests pushed; only the attestation decision failed.
The workflow test now rejects `--jq -r`. Run with the repository's
values, the fixed step reports a personal account and a private
repository and skips attestation, as the guard intends.
Claude-Session: https://claude.ai/code/session_01EyQw3AEaHYXegvgvTPAsi1
Co-authored-by: Claude <noreply@anthropic.com>
* ci: resolve attestation eligibility from repository API
The publish guard in #103 used github.repository_owner_type, which is not
part of the documented github context and evaluates empty on push. That
made the OR condition true and the attest step always ran.
Query repos/{owner}/{repo} for owner.type and private, skip attestation
only for User-owned private repositories, and gate the attest action on
the resolved step output.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* test: escape workflow placeholders for Biome noTemplateCurlyInString
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
GitHub artifact attestations are unavailable for private repositories
under personal accounts. The publish job already tags images successfully;
only the attest step failed. Gate attestation on visibility and owner type
so org and public repositories still attest.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Build and publish used /tmp/digests, which persists on evoo-ci hosts.
Uploading /tmp/digests/* picked up stale digest markers from earlier runs,
so the manifest step saw 13 digests instead of one amd64 image.
Use RUNNER_TEMP for recording, uploading, and assembling digests so each
job only sees its own architecture marker.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* ci: publish amd64 images under a lowercase name and deploy only after green CI
Image publishing never succeeded: GHCR rejects the capitalized repository
slug, and the arm64 jobs failed on the macOS runners, which have no Docker
buildx. Resolve the namespace in lowercase and build amd64 only until an
arm64 runner with buildx exists; the manifest check expects one digest.
The Evo deploy ran on every push to main regardless of the result of
Product CI, so red commits went live. Trigger it from the completed ci
workflow instead and deploy the head it verified; manual dispatch stays.
The Playwright report publish failed every nightly run because the S3
settings are not configured. The script now skips the gallery with a
notice when they are missing instead of failing the job.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
* ci: give each runner on a shared host its own E2E ports
Two Linux runners live on the same host. Every Web E2E job first frees
"stale" listeners on the fixed ports 3110, 3111, 5180 and 4321 with
fuser -k, so a job starting on the second runner killed the Vite server
of the job already running on the first one. The victim died with
SIGKILL (exit 137), and its remaining tests failed on reloads that could
no longer reach a server. This is what made the Web E2E run on this PR
red, and it explains the recurring reload failures on main whenever two
runs overlapped.
The workflow now derives API_PORT, WEB_PORT and WWW_PORT from the runner
name (suffix -N means an offset of N times 100), and the port-freeing
script follows those settings instead of a hard-coded list. The harness,
Vite, the API and the marketing site already read these variables.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
* test(testkit): cover the env-driven E2E ports instead of a fixed list
The ports test parsed a hard-coded array that no longer exists. It now
runs the script on a fake host whose fuser finds nothing, and checks the
default ports, the per-runner override, the rejection of a non-numeric
setting, and that the workflow picks the ports before freeing them.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
* test(updater): expect the amd64-only publish and the lowercase namespace
The workflow test still described the multi-arch publish. It now checks
that only amd64 builds natively, that arm64 is documented as paused, that
one digest feeds the manifest, and that every image name comes from the
lowercase namespace step.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
* ci: keep every runner off the default E2E ports
Branches that still free the fixed ports 3110, 3111, 5180 and 4321 keep
running on the shared host (main, the nightly run, other open PRs) until
they carry the per-runner ports. A job of ours on the runner without a
numeric suffix used exactly those defaults, so such a neighbour could
still kill it, and its own port freeing could kill the neighbour. The
unsuffixed runner now starts at offset 100, so no job from this workflow
touches the defaults in either direction.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
* fix(web): recover lazy routes and overlays from a failed module fetch
When the browser aborts a module request while a page loads, the lazy
import rejects and the route throws, leaving a blank page. Chromium does
this whenever a network interface appears or disappears mid-request
(net::ERR_NETWORK_CHANGED), which happens on a laptop that changes
networks and on the CI host every time a container starts or stops. A
Web E2E run hit exactly this: two modules of the onboarding page failed
to load and the suite waited on an empty document.
Lazy routes and overlays now load through a helper that retries the
import once and, when the browser keeps rejecting it from its module
map, reloads the page a single time before surfacing the error.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
(cherry picked from commit d5dacb12f14380071ef14ba8845d18c9d39e3fac)
* fix(web): reload once when the module graph is aborted while booting
The lazy-route recovery cannot help when the browser aborts a module of
the static import graph: nothing of the app runs, the root stays empty,
and the only trace is a console error. A Web E2E run hit this right
after a page reload, when four modules of the shell failed with
net::ERR_NETWORK_CHANGED and the shell never rendered.
An inline script in the HTML entry now listens for the error event of
the module script and reloads the page once, guarded by a session flag
that the entry module clears after a successful boot. The existing
preload recovery stays in place; it only covers Vite's chunk preloads of
production builds.
A new E2E spec aborts one module request during boot and one lazy route
request, and expects the sign-in page to render in both cases.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
(cherry picked from commit e5b7e036e1a60e7e270592c4b9382ee23ed45ccb)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Switch PR/push CI, Playwright, image publish validation, and manual
workflows from GitHub-hosted labels to the repo's online self-hosted
runners (evo Linux, air/mini macOS). release-desktop keeps
windows-2022 only when Windows signing credentials are configured;
there is no self-hosted Windows runner.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
