From d5d529dcd940241b921fe566befd7f1673556699 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Wed, 9 Sep 2026 18:03:22 +0000 Subject: [PATCH] fix(ci): install uv from official PyPI --- .gitea/workflows/lint.yml | 22 ++++++++++++++-------- CHANGELOG.md | 2 +- 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index ce3566d..e43b2be 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -12,12 +12,6 @@ on: pull_request: env: - # pypi.org is NOT reachable from this network — it resolves fine but TCP/443 to - # Fastly (151.101.x) times out, while github.com and cloudflare.com are fine. - # This is not the usual flaky-WAN symptom and a plain `uv tool install` will - # hang until timeout. Use a mirror; verified reachable 2026-07-28. - UV_DEFAULT_INDEX: https://pypi.tuna.tsinghua.edu.cn/simple - # ansible-lint and ansible-core install as SEPARATE uv tools, each with its own # venv. Collections installed under the ansible-core tool are invisible to # ansible-lint, which then reports every module as `syntax-check[unknown-module]` @@ -29,7 +23,14 @@ jobs: runs-on: self-hosted steps: - uses: actions/checkout@v4 - - uses: astral-sh/setup-uv@v6 + + - name: Bootstrap uv + # setup-uv queries api.github.com, which is unreachable from the nested + # job network. Official PyPI is reachable; pin the tool for reproducibility. + run: | + python3 -m pip install --user --break-system-packages \ + --index-url https://pypi.org/simple --quiet uv==0.11.7 + echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Install yamllint # The WAN drops at random (see CLAUDE.md); retry rather than fail a run. @@ -53,7 +54,12 @@ jobs: runs-on: self-hosted steps: - uses: actions/checkout@v4 - - uses: astral-sh/setup-uv@v6 + + - name: Bootstrap uv + run: | + python3 -m pip install --user --break-system-packages \ + --index-url https://pypi.org/simple --quiet uv==0.11.7 + echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Install ansible-lint and collections # pywinrm is not optional — without it every ansible.windows.* task dies diff --git a/CHANGELOG.md b/CHANGELOG.md index 5cda881..c1293ad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,7 +26,7 @@ What changed in this homelab, when, and why. Newest first. | secrets | Recorded that ESO 2.8.0, five ExternalSecrets and the scoped OpenBao Kubernetes-auth path already exist; the next gate is live recovery testing and migration of any remaining manual Secrets | | Terraform | Recorded Gitea 1.27 State Registry as the preferred candidate for local roots after version and recovery testing; the OCI recovery root remains in OCI Object Storage to avoid a home-control-plane dependency loop | | cleanup | Removed the retired NapCat tree, the Contour and Kanidm archive trees, and seven generated Terraform plan files before establishing the clean Git baseline; plans may embed complete state and remain globally ignored | -| CI | Added a review-first Gitea Actions runner bootstrap: official actions chart 0.1.1, pinned runner 2.3.0, one persistent instance-scoped Kubernetes runner with capacity four, plus an ESO reference to its registration token in OpenBao. The first deployment proved that rootlesskit is blocked by the node's AppArmor unprivileged-userns policy; because the chart requires privileged DinD in either mode, the reviewed fix uses regular DinD instead of weakening the host-wide policy. The runner image intentionally carries neither `uv` nor Terraform, so the lint workflow now bootstraps both with versioned setup actions instead of relying on developer-machine state | +| CI | Added a review-first Gitea Actions runner bootstrap: official actions chart 0.1.1, pinned runner 2.3.0, one persistent instance-scoped Kubernetes runner with capacity four, plus an ESO reference to its registration token in OpenBao. The first deployment proved that rootlesskit is blocked by the node's AppArmor unprivileged-userns policy; because the chart requires privileged DinD in either mode, the reviewed fix uses regular DinD instead of weakening the host-wide policy. The runner image intentionally carries neither `uv` nor Terraform: Terraform uses its versioned setup action, while `uv` is pinned and installed from official PyPI because the nested job network reaches PyPI but times out against the GitHub API queried by `setup-uv` | | identity | Declared the Samba AD `gitea-admins` group with `panxiao81` as its initial member. Gitea already maps this OIDC group to site administrators; the local `gitea_admin` account remains as break-glass access | `Carried forward`: re-verify OpenBao/ESO recovery and remaining Secret inventory;