vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-forge: mirror actions/upload-artifact alongside actions/checkout

Browse source 
With actionsFromSelf, Forgejo resolves bare `uses: actions/<name>` against
the forge itself, so every action a workflow names needs a mirror there.
Only actions/checkout was seeded, and coverage.yml's
`actions/upload-artifact@v3` has failed at job setup with "repository not
found" since the CI runner moved to swarm-ci-runner (e2da5509).

The single hardcoded checkout mirror becomes a list of action names both
share, mirrored from github.com/actions/* like checkout already was. v3
points at the same commit (ff15f03) on github.com and code.forgejo.org.

The controller's forge-objects pass creates any missing mirror on every
pass, and the changed SWARM_CONTROLLER_FORGE_MIRRORS env restarts the unit
on switch, so an existing forge picks the mirror up on deploy.

Closes #5040
This commit is contained in:
atlas 2026-10-09 09:54:40 +02:00 • committed by mara
commit 9b711d5ffa
5 changed files with 51 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

50
nix/host-modules/hive-forge/default.nix
View file

@ -88,18 +88,24 @@ let
effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;
# `actionsFromSelf` resolves `uses:` against this forge, which then has to
# hold the action.
# hold every action a workflow in `.forgejo/workflows/` names.
actionsFromSelf = deployCfg.forgejo.actionsFromSelf;
actionCheckoutMirror = {
upstream = "https://github.com/actions/checkout";
dest = "actions/checkout";
};
# Unless the operator already declared that dest, which would duplicate it.
actionMirrors =
map
(name: {
upstream = "https://github.com/actions/${name}";
dest = "actions/${name}";
})
[
"checkout"
"upload-artifact"
];
# Minus any dest the operator already declared, which would duplicate it.
effectiveMirrors =
deployCfg.forgejo.mirrors
++ lib.optional (
actionsFromSelf && !(lib.any (m: m.dest == actionCheckoutMirror.dest) deployCfg.forgejo.mirrors)
) actionCheckoutMirror;
++ lib.optionals actionsFromSelf (
lib.filter (a: !(lib.any (m: m.dest == a.dest) deployCfg.forgejo.mirrors)) actionMirrors
);
# Share host netns — forgejo's HTTP / SSH listeners then look
# exactly like a host-side service, no port forwarding dance,
@ -199,8 +205,9 @@ in
failure on whatever reads it.
With {option}`services.hyperhive.deploy.forgejo.actionsFromSelf`
enabled (the default on a host that runs the swarm-controller), an
`actions/checkout` mirror is appended to this list.
enabled (the default on a host that runs the swarm-controller),
`actions/checkout` and `actions/upload-artifact` mirrors are appended
to this list.
'';
};
@ -211,17 +218,16 @@ in
example = false;
description = ''
Resolve a workflow's `uses: <org>/<action>@vN` against this forge
instead of `data.forgejo.org`, and add an `actions/checkout`
pull-mirror to {option}`services.hyperhive.deploy.forgejo.mirrors`
so the checkout step has something to resolve to. A CI job's
checkout then needs no external DNS; only the mirror's re-sync
does.
instead of `data.forgejo.org`, and add `actions/checkout` and
`actions/upload-artifact` pull-mirrors to
{option}`services.hyperhive.deploy.forgejo.mirrors` so those steps
have something to resolve to. A CI job's actions then need no
external DNS; only the mirrors' re-sync does.
Defaults to on when this host runs the swarm-controller, which seeds
the `actions/checkout` mirror, and off otherwise. Setting it `true` on
a host without the controller leaves `actions/checkout` unresolved:
nothing seeds the mirror, and the warning about unseeded mirrors
fires.
the mirrors, and off otherwise. Setting it `true` on a host without
the controller leaves both actions unresolved: nothing seeds the
mirrors, and the warning about unseeded mirrors fires.
Any other action a workflow names has to be mirrored here too. Set to
`false` to resolve actions from `data.forgejo.org` and seed no mirror.
@ -663,7 +669,7 @@ in
# reads it.
actions.ENABLED = true;
# With `actionsFromSelf`, resolve `uses: <org>/<action>@vN` from
# THIS instance (the seeded `actions/checkout` pull-mirror)
# THIS instance (the seeded `actions/*` pull-mirrors)
# instead of the upstream default `data.forgejo.org` — keeps
# the checkout step on loopback, immune to a host-resolver
# blip. `self` = forgejo expands actions against its
@ -1196,7 +1202,7 @@ in
systemd.services.swarm-controller.environment.SWARM_CONTROLLER_FORGE_MIRRORS =
lib.mkIf deployCfg.swarm-controller.enable (builtins.toJSON effectiveMirrors);
warnings = lib.optional (effectiveMirrors != [ ] && !deployCfg.swarm-controller.enable) ''
services.hyperhive.deploy.forgejo.mirrors (or the actions/checkout mirror
services.hyperhive.deploy.forgejo.mirrors (or the actions/* mirrors
deploy.forgejo.actionsFromSelf adds) is set on a host that does not run the
swarm-controller. The controller seeds mirrors from its own host's list,
so these are not seeded: declare them on the swarm-controller's host.