From 79ba88485929234393da1acb25de16ccaf107a16 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 18 Oct 2026 20:34:59 +0200 Subject: [PATCH] CI workflow: the failure mail links the public run page, by run id (R-1135) The alarm step built its link from GITHUB_SERVER_URL, which on this runner is the in-cluster Gitea address, and from the run NUMBER, which Gitea 1.26 reads as a run id first (felhom.eu /actions/runs/1116 opened run id 1116 = run number 613). Now https://gitea.dooplex.hu + GITHUB_RUN_ID, and the link is printed into the job log as ALARM-LINK. Same change in all four repos. --- .gitea/workflows/gates.yml | 12 ++++++++++-- CHANGELOG.md | 9 +++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/gates.yml b/.gitea/workflows/gates.yml index daeb7f0..72b17f9 100644 --- a/.gitea/workflows/gates.yml +++ b/.gitea/workflows/gates.yml @@ -108,8 +108,16 @@ jobs: repo = os.environ.get("GITHUB_REPOSITORY", "?") sha = os.environ.get("GITHUB_SHA", "?") - run = os.environ.get("GITHUB_RUN_NUMBER", "?") - srv = os.environ.get("GITHUB_SERVER_URL", "https://gitea.dooplex.hu") + # R-1135: the link is for a PERSON, so it is the public address and the run ID. + # NOT GITHUB_SERVER_URL: the runner registers at the in-cluster address, so that variable + # reads http://gitea.gitea-system.svc.cluster.local:3000, which nobody outside the cluster + # can open (forced-test mail, job 1997). NOT GITHUB_RUN_NUMBER: Gitea 1.26 reads + # /actions/runs/ as a run id first, so a run number that is also an older run's id + # opens THAT run (measured 2026-10-18: felhom.eu /actions/runs/1116 opened the run whose + # id is 1116 = run number 613). The link is printed too, so the job log carries it. + run = os.environ.get("GITHUB_RUN_ID", "?") + srv = "https://gitea.dooplex.hu" + print("ALARM-LINK %s/%s/actions/runs/%s" % (srv, repo, run)) body = json.dumps({ "from": "Felhom CI ", diff --git a/CHANGELOG.md b/CHANGELOG.md index e3f3772..14ee10a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +## Unreleased (2026-10-18) — CI workflow: the failure mail links the public run page, by run id (R-1135); no code change + +`.gitea/workflows/gates.yml`, the alarm step: the mail's run link is now `https://gitea.dooplex.hu//actions/runs/`. +It used `GITHUB_SERVER_URL`, which on this runner is the in-cluster address (`http://gitea.gitea-system.svc.cluster.local:3000`, +the address the runner registers at), so nobody outside the cluster could open it. It also used the run NUMBER, and +Gitea 1.26 reads `/actions/runs/` as a run id first: a number that is also an older run's id opened that other run +(measured 2026-10-18: `felhom.eu/actions/runs/1116` opened run id 1116, run number 613). It now uses `GITHUB_RUN_ID` and +prints the link (`ALARM-LINK …`) into the job log. Same change in all four repos' workflows. + ## Unreleased — three fixes from the 2026-10-12 security review and the storage build (R-1093, R-978, R-973) (2026-10-18) Committed, not released — the release and its vouch are the operator's.