From 2df1647b4e0f934510842f39c5ccfa340b600690 Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 27 Aug 2026 13:43:36 +0100 Subject: [PATCH 1/6] test: argo workflows access from CI runner --- .github/workflows/ci.yaml | 234 ++++++++------------------------------ 1 file changed, 50 insertions(+), 184 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index bbc455313..175658f99 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1,191 +1,57 @@ -name: CI +name: Test internal runner on: - push: - pull_request: + workflow_dispatch: -jobs: - - detect_files_changed: - runs-on: ubuntu-latest - outputs: - identity_mapper: ${{ steps.filter.outputs.identity_mapper }} - steps: - - uses: actions/checkout@v6 - - - name: Detect detect files changed - id: filter - uses: dorny/paths-filter@v3 - with: - filters: | - identity_mapper: - - 'backend/identity-mapper/**' - - helm_lint: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_helm_lint.yaml - - kyverno_policy: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_kyverno_policy.yaml - - sessionspaces_code: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_sessionspaces_code.yaml - - sessionspaces_container: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - needs: sessionspaces_code - uses: ./.github/workflows/_sessionspaces_container.yaml - permissions: - contents: read - packages: write - - graph_proxy_code: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_graph_proxy_code.yaml - - graph_proxy_schema: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - needs: graph_proxy_code - uses: ./.github/workflows/_graph_proxy_schema.yaml - - graph_proxy_container: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - needs: graph_proxy_code - uses: ./.github/workflows/_graph_proxy_container.yaml - permissions: - contents: read - packages: write - - auth_daemon_code: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_auth_daemon_code.yaml - - auth_daemon_container: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - needs: auth_daemon_code - uses: ./.github/workflows/_auth_daemon_container.yaml - permissions: - contents: read - packages: write - - auth_broker_code: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_auth_broker_code.yaml +permissions: + contents: read - auth_broker_container: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - needs: auth_broker_code - uses: ./.github/workflows/_auth_broker_container.yaml - permissions: - contents: read - packages: write - - auth_gateway_code: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_auth_gateway_code.yaml - - auth_gateway_container: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - needs: auth_gateway_code - uses: ./.github/workflows/_auth_gateway_container.yaml - permissions: - contents: read - packages: write - - identity_mapper_code: - needs: detect_files_changed - if: needs.detect_files_changed.outputs.identity_mapper == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository) - uses: ./.github/workflows/_identity_mapper_code.yaml - - identity_mapper_container: - needs: detect_files_changed - if: (startsWith(github.ref, 'refs/tags/identity-mapper@') || needs.detect_files_changed.outputs.identity_mapper == 'true') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository) - uses: ./.github/workflows/_identity_mapper_container.yaml - permissions: - contents: read - packages: write - - auth_core_code: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_auth_core_code.yaml - - frontend_code: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - needs: graph_proxy_schema - uses: ./.github/workflows/_frontend_code.yaml - - dashboard_container: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - needs: frontend_code - uses: ./.github/workflows/_dashboard_container.yaml - permissions: - contents: read - packages: write - - github_pages: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_github_pages.yaml - permissions: - pages: write - id-token: write - - commit_lint: - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_commit_lint.yaml - permissions: - contents: read - pull-requests: read - - release_please: - if: github.event_name == 'push' && (startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main') - uses: ./.github/workflows/_release_please.yaml - secrets: - release_please_token: ${{ secrets.RELEASE_PLEASE_CLIENT_SECRET }} - permissions: - contents: write - pull-requests: write - - telemetry_code: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_telemetry_code.yaml - - dev_resources: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_dev_resources.yaml +jobs: + test-internal-runner: + name: Test internal connectivity + runs-on: + group: IRIS + labels: iris-cpu - cli_code: - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_cli_code.yaml + timeout-minutes: 5 - lint_workflows: - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - runs-on: ubuntu-latest steps: - - name: Lint Workflows - uses: diamondlightsource/workflows@main - - prek: - # Deduplicate jobs from pull requests and branch pushes within the same repo. - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository - uses: ./.github/workflows/_prek.yaml + - name: Show runner information + shell: bash + run: | + set -euo pipefail + + echo "Runner name: $RUNNER_NAME" + echo "Runner OS: $RUNNER_OS" + echo "Runner architecture: $RUNNER_ARCH" + echo "Hostname: $(hostname)" + echo "User: $(id -un)" + + - name: Check internal DNS + shell: bash + run: | + set -euo pipefail + + getent hosts argo-cd.workflows.diamond.ac.uk + + - name: Check Argo CD HTTPS connectivity + shell: bash + run: | + set -euo pipefail + + curl \ + --fail \ + --silent \ + --show-error \ + --connect-timeout 10 \ + --max-time 30 \ + --output /dev/null \ + --write-out "HTTP status: %{http_code}\n" \ + https://argo-cd.workflows.diamond.ac.uk/api/version + + - name: Check Argo CD CLI + shell: bash + run: | + set -euo pipefail + + argocd version --client From a3f3a677202a33ce6b83e6b9af104a355af13937 Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 27 Aug 2026 13:49:11 +0100 Subject: [PATCH 2/6] test: try again --- .github/workflows/ci.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 175658f99..d35170946 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -2,6 +2,8 @@ name: Test internal runner on: workflow_dispatch: + push: + pull_request: permissions: contents: read From 24abc5733fb37b978d2fa532830c7c36639076f7 Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 27 Aug 2026 13:51:02 +0100 Subject: [PATCH 3/6] test: try again --- .github/workflows/ci.yaml | 50 +++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 26 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d35170946..7ca8db926 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -3,57 +3,55 @@ name: Test internal runner on: workflow_dispatch: push: - pull_request: permissions: contents: read jobs: test-internal-runner: - name: Test internal connectivity + name: Test Argo CD connectivity + runs-on: - group: IRIS - labels: iris-cpu + group: iris + labels: + - self-hosted + - linux + + container: + image: curlimages/curl:8.16.0 timeout-minutes: 5 steps: - name: Show runner information - shell: bash + shell: sh run: | - set -euo pipefail + set -eu - echo "Runner name: $RUNNER_NAME" - echo "Runner OS: $RUNNER_OS" - echo "Runner architecture: $RUNNER_ARCH" - echo "Hostname: $(hostname)" - echo "User: $(id -un)" + echo "Runner name: ${RUNNER_NAME}" + echo "Runner OS: ${RUNNER_OS}" + echo "Runner architecture: ${RUNNER_ARCH}" + echo "Container hostname: $(hostname)" + id - name: Check internal DNS - shell: bash + shell: sh run: | - set -euo pipefail + set -eu - getent hosts argo-cd.workflows.diamond.ac.uk + nslookup argo-cd.workflows.diamond.ac.uk || + getent hosts argo-cd.workflows.diamond.ac.uk - name: Check Argo CD HTTPS connectivity - shell: bash + shell: sh run: | - set -euo pipefail + set -eu curl \ - --fail \ + --fail-with-body \ --silent \ --show-error \ --connect-timeout 10 \ --max-time 30 \ - --output /dev/null \ - --write-out "HTTP status: %{http_code}\n" \ + --write-out '\nHTTP status: %{http_code}\n' \ https://argo-cd.workflows.diamond.ac.uk/api/version - - - name: Check Argo CD CLI - shell: bash - run: | - set -euo pipefail - - argocd version --client From 6c466bcaa2650f3abba9f3f62e444322857f3ac4 Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 27 Aug 2026 14:10:00 +0100 Subject: [PATCH 4/6] test: try again --- .github/workflows/ci.yaml | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 7ca8db926..dafa215be 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1,27 +1,20 @@ name: Test internal runner on: - workflow_dispatch: push: - -permissions: - contents: read + workflow_dispatch: jobs: - test-internal-runner: - name: Test Argo CD connectivity - - runs-on: - group: iris - labels: - - self-hosted - - linux - + build-1: + runs-on: ["iris-cpu"] + container: + image: summerwind/actions-runner:latest + steps: + - uses: actions/checkout@v4 + build-2: + runs-on: ["iris-cpu"] container: image: curlimages/curl:8.16.0 - - timeout-minutes: 5 - steps: - name: Show runner information shell: sh From 6bca16d9547ee81ff5e7b4b672fb0619ecf838fb Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 27 Aug 2026 14:14:22 +0100 Subject: [PATCH 5/6] test: try again --- .github/workflows/ci.yaml | 37 ------------------------------------- 1 file changed, 37 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index dafa215be..d9bfd55ed 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -11,40 +11,3 @@ jobs: image: summerwind/actions-runner:latest steps: - uses: actions/checkout@v4 - build-2: - runs-on: ["iris-cpu"] - container: - image: curlimages/curl:8.16.0 - steps: - - name: Show runner information - shell: sh - run: | - set -eu - - echo "Runner name: ${RUNNER_NAME}" - echo "Runner OS: ${RUNNER_OS}" - echo "Runner architecture: ${RUNNER_ARCH}" - echo "Container hostname: $(hostname)" - id - - - name: Check internal DNS - shell: sh - run: | - set -eu - - nslookup argo-cd.workflows.diamond.ac.uk || - getent hosts argo-cd.workflows.diamond.ac.uk - - - name: Check Argo CD HTTPS connectivity - shell: sh - run: | - set -eu - - curl \ - --fail-with-body \ - --silent \ - --show-error \ - --connect-timeout 10 \ - --max-time 30 \ - --write-out '\nHTTP status: %{http_code}\n' \ - https://argo-cd.workflows.diamond.ac.uk/api/version From bb5e70aebb6592ceca99abcbf82962acc6414ab5 Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 27 Aug 2026 14:17:02 +0100 Subject: [PATCH 6/6] test: try again --- .github/workflows/ci.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d9bfd55ed..d4bca747d 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -9,5 +9,6 @@ jobs: runs-on: ["iris-cpu"] container: image: summerwind/actions-runner:latest + options: --user root steps: - uses: actions/checkout@v4