ci: run platform-libs CI on the java17 runner label (#300) #11
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "ci/java17-runner-label"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
platform-libs CI runner toolchain fix (#300)
TL;DR —
CONDITIONAL(needs runner re-register before CI can match). Repoints both CI jobs fromruns-on: aim2be-rework(→node:22-bookworm, no JDK/Maven →mvnexited 127 on every PR) toruns-on: java17, which the runner maps tomaven:3.9-eclipse-temurin-17(JDK 17 + Maven 3.9). Operator-chosen approach B (reusable label, DRY across the 8 Java services).Changes
.forgejo/workflows/ci.yml:maven-install+maven-verify→runs-on: java17; updated the JDK-provenance comments.scripts/forgejo-runner-setup.sh(RUNNER_LABELS+=java17:docker://maven:3.9-eclipse-temurin-17, committed68f5072).⚠️ Required before this CI is green (operator)
Re-register the runner so it advertises the
java17label:Until then this PR's own CI stays pending (no runner advertises
java17). The hib-pr-reviewer R-cycle reviews the diff regardless.Follow-up (not in this PR)
maven-verify(main-push) runs Testcontainers-Valkey ITs → the maven container needs Docker-socket access (act_runnervalid_volumes+DOCKER_HOST). The per-PRmvn install(unit tests) needs only the image.Verdict
CONDITIONAL— workflow-only; green pending the runner re-register.im2be-platform-libs • #300 (approach B) • base main • 2026-05-28
Show previous round
hib-pr-reviewer review — PR #11 (affinity-intelligence-rework/im2be-platform-libs)
Round 1 — head
b9cb8279152e, basemain, triggeropenedTL;DR: CONDITIONAL_APPROVE — kept 1 info-level unique-to-A finding (verified); B returned empty; no blocking or major issues.
Summary
Reconciliation: Round 1 — first arbitration for this PR (no prior Memora history).
No reusable patterns found in Memora for this repo. Reviewed the full file at
.forgejo/workflows/ci.yml.A's 1 finding (unique-to-A, info): Verified. Lines 29 and 53 both contain
runs-on: java17— a bare string label with no fallback. The comment block at lines 39-43 documents the runner dependency within the YAML, but there is no external ops-doc (e.g.,RUNNER_REQUIREMENTS.md). Finding is factually grounded; kept atinfo.B's 0 findings: B noted in its prose summary that
pull_request: branches: [main](line 24) limits CI to PRs targetingmain— which contradicts the comment at line 9 that says "pull_request to any branch". However, B explicitly chose not to surface this as a structured finding (empty array), it appears pre-existing (not introduced by this diff), and A did not raise it either. Not elevated per Rule 4 / no-fresh-review principle.Kept 1 finding (info). Persisted Run 1 summary to Memora (ID 315).
Blast Radius
Only one file changed: the Forgejo Actions CI workflow. The change affects the build pipeline runner label for both CI jobs but touches no application code, library interfaces, or shared configuration. Impact is limited to CI execution environment correctness.
BLAST_SCORE: 2/10
CI status (head
b9cb8279152e)Overall: ⏳ pending
2 checks: 2 pending
Findings (1)
[INFO] Runner label is a bare string with no fallback — label availability is fully implicit
.forgejo/workflows/ci.yml:29
Both jobs (lines 29 and 53) specify
runs-on: java17. If this self-hosted runner label is offline, deregistered, or renamed, all CI jobs will queue indefinitely with no diagnostic error — there is no fallback label or failure-fast guard in Forgejo Actions YAML. The inline comment at lines 39-43 documents the dependency well inside the file, but there is no external operations document (e.g.,RUNNER_REQUIREMENTS.mdor repoCLAUDE.md) that informs future platform operators which runner labels must be provisioned. Consider adding a brief note to an ops or onboarding doc listing the required self-hosted runner labels for this repository.Verdict
CONDITIONAL_APPROVE
hib-pr-reviewer • round 1 • 1 finding (1i) • 2026-05-28T19:30:47.316Z → 2026-05-28T19:31:48.451Z • posted-as: pr-reviewer-bot
R1 verdict CONDITIONAL_APPROVE (kept=1 info): (1) info .forgejo/workflows/ci.yml:9 — header said "pull_request to any branch" but the `on:` block (line 24) is `pull_request: branches: [main]`. Reviewer-B also noted this line-9↔line-24 contradiction but did not elevate it. platform-libs is a library with `main` as its sole integration branch, so the trigger filter is correct; the comment was the stale half. Fix: reword the line-9 trigger doc to "pull_request targeting `main`" so the header matches the actual trigger. The R1 info finding (no external ops-doc for the `java17` label) is already covered by the line 3-4 pointer to im2be-mono scripts/forgejo-runner-setup.sh — no RUNNER_REQUIREMENTS.md added (over-doc for an info-level finding, rule 63). Re-trigger rationale: run #78 (mvn install) failed pre-registration because no runner advertised `java17`. The label is now registered server-side (.runner re-declared on daemon restart: "declare successfully", labels [aim2be-rework java17 ubuntu-latest ubuntu-22.04 ubuntu-24.04]). This push re-runs CI on maven:3.9-eclipse-temurin-17. Verification: - runner labels (server-side declare): java17 present - CI re-run: pending this push — will confirm green before mergeShow previous round
hib-pr-reviewer review — PR #11 (affinity-intelligence-rework/im2be-platform-libs)
Round 2 — head
3349798d8c20, basemain, triggersynchronizeTL;DR: CONDITIONAL_APPROVE — kept 1 unique-to-A finding (queue-forever risk) and 1 unique-to-B finding (idiomatic array form), both verified against HEAD; no blocking issues.
Summary
Arbitration Summary
No prior Memora run history existed for this PR (first entry created as Run 2). Verified the HEAD file at
/var/lib/pr-reviewer/repos/affinity-intelligence-rework/im2be-platform-libs/1063/.forgejo/workflows/ci.yml.Finding A (unique): Confirmed
runs-on: java17bare scalar at line 29 and line 53.timeout-minutes: 15(line 30) andtimeout-minutes: 20(line 54) are present and verified — these count execution time only, not queue wait. The queue-forever risk if thejava17label is unregistered is real and grounded. Kept.Finding B (unique): Confirmed the same
runs-on: java17scalar form at lines 29 and 53. The[self-hosted, java17]array convention is the documented idiomatic form for Forgejo/GitHub Actions self-hosted runners; it prevents accidental match with a future hosted runner and signals scheduling intent clearly. The suggestion is actionable and costs nothing. Kept.The two findings address distinct concerns at the same location (A = operational readiness; B = mechanical convention). No findings overlap or contradict. Persisted Run 2 block to Memora (memory id 316).
Blast Radius
Only one CI workflow file changed (.forgejo/workflows/ci.yml). The blast radius is limited to the CI pipeline for this single library repo — no production code, no shared libraries, no migration files are touched.
BLAST_SCORE: 1/10
CI status (head
3349798d8c20)Overall: ✗ failure
2 checks: 2 pending
Findings (2)
[MINOR] Bare
java17runner label — queue-forever risk if label is not yet registered.forgejo/workflows/ci.yml:29
Both
maven-install(line 29) andmaven-verify(line 53) useruns-on: java17.timeout-minutes: 15/20(lines 30, 54) count execution time only — if no runner carrying thejava17label is registered with the Forgejo instance, both jobs will silently queue indefinitely.Pre-merge question: has the
java17label been registered on at least one active self-hosted runner before this PR lands? The comment referencesim2be-mono scripts/forgejo-runner-setup.sh RUNNER_LABELS; task #300— confirming that script has been run (or linking to the tracking commit/issue in im2be-mono) would close this concern.[MINOR] Single-string
runs-onlabel — use[self-hosted, java17]array form.forgejo/workflows/ci.yml:29
Both
maven-install(line 29) andmaven-verify(line 53) useruns-on: java17as a bare scalar. The idiomatic Forgejo/GitHub Actions convention for self-hosted runners is the array form:The
self-hostedlabel is applied automatically to every self-hosted Forgejo runner, so no extra provisioning is required. Benefits: (a) immediately signals to readers this is NOT a hosted runner; (b) prevents a future hosted-runner option namedjava17from accidentally matching; (c) aligns with Forgejo Actions documentation examples. Applies identically to line 53.Verdict
CONDITIONAL_APPROVE
hib-pr-reviewer • round 2 • 2 findings (2m) • 2026-05-28T20:24:47.600Z → 2026-05-28T20:26:03.132Z • posted-as: pr-reviewer-bot
R2 verdict CONDITIONAL_APPROVE (2 info kept, neither blocking): - A: queue-forever risk if `java17` is unregistered — now registered + declared. - B: prefer `[self-hosted, java17]` array form — deferred; this runner carries no `self-hosted` label, so adopting the array would require adding it (tracked separately, not in this comment-only change). Root cause of the prior fast-fail (runs #78/#79): the `java17` label mapped to the bare maven:3.9-eclipse-temurin-17 image, which has NO Node. actions/checkout is a Node action run inside the job container, so it died before `mvn` ran. Approach A (operator-chosen): a custom image git.hemoglobina.store/affinity-intelligence-rework/maven-node-ci:3.9-temurin17 (maven base pinned by digest + Node 20 LTS), built/pushed by im2be-mono ci/forgejo-runner-maven-node/build-push.sh and mapped to the `java17` label. This commit updates the ci.yml header comments to cite the real image + the Node-for-checkout reason, and re-triggers CI on the now-correct mapping. Verification: - image pushed + public-pullable (anon OCI token -> HTTP 200) - runner re-declared: labels [aim2be-rework java17 ...]; java17 -> maven-node-ci - CI re-run: pending this push -- will confirm green before mergehib-pr-reviewer review — PR #11 (affinity-intelligence-rework/im2be-platform-libs)
Round 3 — head
b46554f88baf, basemain, triggersynchronizeTL;DR: CONDITIONAL_APPROVE — 1 agreed finding kept (bare
runs-on: java17on lines 32+57, open since round 1); no new issues introduced by this diff.Summary
Reconciliation — Round 3
Memora lookup: No prior run history found for this PR (both queries returned 0 results). Created new memory (ID 319) with
review_count: 3as the fall-back create-new path.File verification: Read
.forgejo/workflows/ci.ymlat HEAD. Lines 32 and 57 confirmed to containruns-on: java17(bare string) exactly as both reviewers described.Agreement: A and B cite the same file, same lines (32 and 57), materially equivalent body, same severity (minor). Rule 1 applies — agreed finding kept unchanged.
No unique-to-one findings requiring independent verification.
Result: 1 agreed finding kept, 0 dropped, 0 new findings added.
Blast Radius
Change is confined to a single CI workflow file. The only observable blast radius is Forgejo Actions job routing — if both runner labels resolve correctly the functional impact is zero. A mis-labeled runner would silently stall CI for this repo only.
BLAST_SCORE: 2/10
CI status (head
b46554f88baf)Overall: ✓ success
2 checks: 2 pending
Findings (1)
[MINOR] Both jobs use bare
runs-on: java17— recommend array form[self-hosted, java17](open since round 1).forgejo/workflows/ci.yml:32
Lines 32 (
maven-install) and 57 (maven-verify) both specifyruns-on: java17as a bare string. This finding has been raised in every round and remains unaddressed.Concrete risk: If no Forgejo runner is registered with exactly the label
java17, both jobs will queue silently and indefinitely — there is no routing error surfaced to the PR author. The array form[self-hosted, java17]is the idiomatic way to express intent (self-hosted target + capability label) and avoids any ambiguity in hybrid setups where a bare string might accidentally match a GitHub-hosted runner name.Suggested change for both jobs:
Forgejo automatically assigns the
self-hostedlabel to every self-hosted runner, so no runner-side change is required — just the YAML update. If the project intentionally omitsself-hostedbecause all runners are self-hosted and the label matching is unambiguous in this Forgejo instance, please add a comment in the YAML explaining that decision so this finding can be closed in a future round.Note: the
Verify JDK 17 availablestep mitigates the toolchain-absence risk (loud fail if the image drifts) but does not mitigate the silent-queue risk from an unregistered or mis-labeled runner.Verdict
CONDITIONAL_APPROVE
hib-pr-reviewer • round 3 • 1 finding (1m) • 2026-05-28T20:40:22.385Z → 2026-05-28T20:41:17.375Z • posted-as: pr-reviewer-bot