fix(kubernetes): don't make non-DinD runners ping a docker daemon #31

Merged
rcsheets merged 26 commits from fix/non-dind-runner-docker-host into master 2026-06-25 14:48:25 +00:00
Owner

A RunnerPool without privileged/dockerImage has no DinD sidecar, yet the
generated runner container still received DOCKER_HOST=tcp://localhost:2375
and the default config used docker_host: "" (auto-detect). On startup
forgejo-runner pinged a daemon that does not exist and crashlooped:

Error: cannot ping the docker daemon. is it running?
Cannot connect to the Docker daemon at tcp://localhost:2375.

Only set DOCKER_HOST on the runner container when a DinD sidecar is
present, and generate docker_host: "-" (disable the docker client, run
jobs on the host) for non-privileged pools instead of "".

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

This also wound up bringing in a huge number of CI fixes.

A RunnerPool without privileged/dockerImage has no DinD sidecar, yet the generated runner container still received DOCKER_HOST=tcp://localhost:2375 and the default config used docker_host: "" (auto-detect). On startup forgejo-runner pinged a daemon that does not exist and crashlooped: Error: cannot ping the docker daemon. is it running? Cannot connect to the Docker daemon at tcp://localhost:2375. Only set DOCKER_HOST on the runner container when a DinD sidecar is present, and generate docker_host: "-" (disable the docker client, run jobs on the host) for non-privileged pools instead of "". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> This also wound up bringing in a huge number of CI fixes.
fix(kubernetes): don't make non-DinD runners ping a docker daemon
Some checks failed
CI / ci (push) Has been cancelled
CI / ci (pull_request) Has been cancelled
E2E smoke test / e2e (pull_request) Has been cancelled
519d91936d
A RunnerPool without privileged/dockerImage has no DinD sidecar, yet the
generated runner container still received DOCKER_HOST=tcp://localhost:2375
and the default config used docker_host: "" (auto-detect). On startup
forgejo-runner pinged a daemon that does not exist and crashlooped:

  Error: cannot ping the docker daemon. is it running?
  Cannot connect to the Docker daemon at tcp://localhost:2375.

Only set DOCKER_HOST on the runner container when a DinD sidecar is
present, and generate docker_host: "-" (disable the docker client, run
jobs on the host) for non-privileged pools instead of "".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3ceb80-5b7ff8
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3ceb80-5b7ff8 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3ceb80-5b7ff8`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3ceb80-5b7ff8` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: target the trusted DinD runner instead of ubuntu-latest
Some checks failed
CI / ci (push) Failing after 1m48s
CI / ci (pull_request) Failing after 22s
E2E smoke test / e2e (pull_request) Failing after 24s
df6cb59bbf
The operator's own CI was stuck ("Waiting for a runner with the following
label: ubuntu-latest") because no such runner exists. The dedicated pool
for this repo (trusted-forgejo-runner-operator) registers the labels
[trusted dind runner-operator], matching the convention used by the other
repos' build/publish workflows.

Point all four workflows at [dind, trusted] so the existing runner picks
them up. All of them need Docker anyway (ci builds container images, e2e
runs kind, publish does docker build/push).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3cedeb-da8cc5
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3cedeb-da8cc5 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3cedeb-da8cc5`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3cedeb-da8cc5` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
fix: remove sudo invocation
Some checks failed
CI / ci (push) Failing after 24s
CI / ci (pull_request) Failing after 21s
E2E smoke test / e2e (pull_request) Failing after 26s
a94231969c
sudo doesn't exist in the CI environment; no idea if the commands will work without `sudo` but they absolutely don't work with it.
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3cf647-5d6f6c
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3cf647-5d6f6c — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3cf647-5d6f6c`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3cf647-5d6f6c` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
fix: install protobuf-compiler before using it
Some checks failed
CI / ci (push) Failing after 22s
CI / ci (pull_request) Failing after 21s
E2E smoke test / e2e (pull_request) Has been cancelled
2e4644173b
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3cf708-a46ed7
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3cf708-a46ed7 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3cf708-a46ed7`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3cf708-a46ed7` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
chore: try a little harder on the install step
Some checks failed
CI / ci (push) Failing after 25s
CI / ci (pull_request) Failing after 24s
E2E smoke test / e2e (pull_request) Failing after 24s
441d60ada8
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3cf745-d4c81b
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3cf745-d4c81b — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3cf745-d4c81b`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3cf745-d4c81b` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
fix: install another dependency
Some checks failed
CI / ci (push) Failing after 37s
CI / ci (pull_request) Failing after 36s
E2E smoke test / e2e (pull_request) Has been cancelled
41a6a107c0
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3cf7b5-c5ee02
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3cf7b5-c5ee02 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3cf7b5-c5ee02`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3cf7b5-c5ee02` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
fix: install another another dependency
Some checks failed
CI / ci (push) Failing after 1m0s
CI / ci (pull_request) Failing after 1m0s
E2E smoke test / e2e (pull_request) Failing after 24s
9405599c88
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3cf80a-95cc89
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3cf80a-95cc89 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3cf80a-95cc89`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3cf80a-95cc89` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: pin code-generation tool versions in the Makefile
Some checks failed
CI / ci (push) Failing after 1m1s
CI / ci (pull_request) Failing after 1m0s
E2E smoke test / e2e (pull_request) Failing after 24s
698551587e
The "Check generated code is up-to-date" step failed because controller-gen
and the protoc plugins were installed with @latest, so CI stamped a different
controller-gen version annotation than the committed CRD (v0.21.0 vs v0.20.1),
tripping `git diff --exit-code`.

Pin all Go-based generation tools once in the Makefile and have `make` provision
them (controller-gen via `go run`, protoc plugins via `go install` into bin/),
so the workflow no longer repeats any version strings. Regenerate the CRD with
the pinned controller-gen v0.21.0.

Note: not using go.mod `tool` directives — they merge the tools' deps into the
main module graph, which dragged k8s.io/* onto an alpha release.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d1508-acba70
This is an AI-generated reveiw and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d1508-acba70 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d1508-acba70`* *This is an AI-generated reveiw and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d1508-acba70` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
style: gofmt cmd/admin-registrar/main.go
Some checks failed
CI / ci (push) Failing after 1m40s
E2E smoke test / e2e (pull_request) Has been cancelled
CI / ci (pull_request) Has been cancelled
1b9614046a
Align the var block so `make fmt` is a no-op, fixing the CI formatting check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d15ae-4747ad
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d15ae-4747ad — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d15ae-4747ad`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d15ae-4747ad` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: emit output from verification steps; document CI conventions
Some checks failed
CI / ci (pull_request) Has been cancelled
E2E smoke test / e2e (pull_request) Has been cancelled
CI / ci (push) Has been cancelled
66eddfea9a
The "Check generated code is up-to-date" and "Check formatting" steps used a
bare `git diff --exit-code`, which prints nothing on success — indistinguishable
from a step that didn't run. Both now print a confirmation on success and an
actionable fix message on failure.

Add a CI Conventions section to CLAUDE.md: every step should normally emit
output, and tool versions are pinned once in the Makefile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d1678-53a99c
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d1678-53a99c — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d1678-53a99c`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d1678-53a99c` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: allow container builds on feature branches
Some checks failed
CI / ci (push) Failing after 1m41s
CI / ci (pull_request) Failing after 1m40s
E2E smoke test / e2e (pull_request) Failing after 24s
eebf5b93b2
The Makefile guards container-build against non-master branches to prevent
accidental local builds of mis-tagged :latest images. CI builds images on
every branch as a smoke test and never pushes them, so set ALLOW_BRANCH=1
(the documented override) on the build step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d16df-385ac0
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d16df-385ac0 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d16df-385ac0`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d16df-385ac0` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: install docker CLI for image build; clarify branch-guard message
Some checks failed
CI / ci (push) Failing after 1m54s
CI / ci (pull_request) Failing after 1m53s
E2E smoke test / e2e (pull_request) Failing after 24s
cc6711f10a
The container-build step failed with "docker: No such file or directory" — the
job container has no docker client. Install docker.io before building.

Also fix the non-master guard message: when ALLOW_BRANCH=1 is set it no longer
tells you to set ALLOW_BRANCH=1 to suppress; it reports that the build is being
overridden and continues. Without the override it now prints a clear ERROR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d181f-acdea5
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d181f-acdea5 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d181f-acdea5`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d181f-acdea5` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: provide a docker:dind service for the image build
Some checks failed
CI / ci (pull_request) Has been cancelled
CI / ci (push) Has been cancelled
E2E smoke test / e2e (pull_request) Has been cancelled
582be1f636
The runner exposes no Docker socket at the default path, so the build hit
"Cannot connect to the Docker daemon". Run docker:dind as a privileged service
and point DOCKER_HOST at it over TCP, with a readiness wait before building.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d1989-9b29dd
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d1989-9b29dd — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d1989-9b29dd`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d1989-9b29dd` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: check system prerequisites before the build pipeline
Some checks failed
CI / ci (push) Successful in 5m11s
CI / ci (pull_request) Successful in 4m35s
E2E smoke test / e2e (pull_request) Failing after 41s
317010c4d0
Install the Docker CLI and verify the daemon is reachable up front, alongside
protobuf-compiler, so a misconfigured runner fails in seconds instead of after
generate, the diff checks, vet, the full test suite, and the build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d19e2-4894fc
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d19e2-4894fc — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d19e2-4894fc`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d19e2-4894fc` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: stop running CI twice per push on PR branches
Some checks failed
E2E smoke test / e2e (pull_request) Has been cancelled
CI / ci (pull_request) Has been cancelled
b60a7f77df
push was triggering on every branch ("**") while pull_request also fired for the
open PR, so each commit on a PR branch ran CI twice. Restrict push to master
(post-merge gate) and let pull_request cover branch validation, matching e2e.yml.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d1c70-ecf310
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d1c70-ecf310 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d1c70-ecf310`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d1c70-ecf310` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: allow e2e image build on non-master checkouts
Some checks failed
CI / ci (pull_request) Successful in 4m45s
E2E smoke test / e2e (pull_request) Failing after 44s
adbdb31c1c
The e2e smoke test builds the controller image via make, which tripped the
non-master branch guard — pull_request checks out a detached HEAD, so the branch
reads as "HEAD". The image is built locally and loaded into kind, never pushed,
so set ALLOW_BRANCH=1 in the step env (make imports env vars as variables).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d1cc3-c407ce
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d1cc3-c407ce — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d1cc3-c407ce`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d1cc3-c407ce` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: provide docker daemon + CLI for the e2e smoke test
Some checks failed
E2E smoke test / e2e (pull_request) Has been cancelled
CI / ci (pull_request) Has been cancelled
467c0c68c8
e2e failed with "docker: No such file or directory" — the job had no docker
client and no daemon. Mirror ci.yml: install the docker CLI, run docker:dind as
a service, point DOCKER_HOST at it, and wait for readiness before the test.
kind builds its cluster inside this same daemon.

Note: kind writes a kubeconfig pointing at 127.0.0.1, but with a separate dind
service the API server is reachable at the 'docker' host — expect the next
hurdle to be kubectl reaching the cluster, addressed once observed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d1edc-edd35a
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d1edc-edd35a — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d1edc-edd35a`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d1edc-edd35a` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: make e2e workflow self-testable
Some checks failed
CI / ci (pull_request) Successful in 4m37s
E2E smoke test / e2e (pull_request) Failing after 1m22s
6395948b76
Add workflow_dispatch for manual runs and include the e2e workflow file itself
in the pull_request paths, so changes to e2e CI re-run e2e instead of sitting
untested until an unrelated code/config change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d1f1f-e471af
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d1f1f-e471af — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d1f1f-e471af`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d1f1f-e471af` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
fix: make container build generate its own proto code
Some checks failed
CI / ci (pull_request) Successful in 4m44s
E2E smoke test / e2e (pull_request) Failing after 1m51s
30a89343e8
The controller/provisioner images import the gitignored protobuf package via
COPY . . in the Containerfile, so the image build only worked when make generate
had already run on the host (as in ci.yml). The e2e smoke test built the image
cold and failed: "no required module provides package .../proto/provisioner/v1".

Make container-build-controller/-provisioner depend on `proto` so the generated
code is always present (locally, in CI, and in e2e), and install protobuf-compiler
in the e2e job so that generation can run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d21c5-a0559d
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d21c5-a0559d — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d21c5-a0559d`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d21c5-a0559d` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci: quiet curl and print versions in e2e install steps
Some checks failed
E2E smoke test / e2e (pull_request) Has been cancelled
CI / ci (pull_request) Has been cancelled
95ff475aa0
curl -Lo dumped a progress meter (noise in CI) and would not fail on HTTP
errors, so a 404 could write an error page into the binary and "succeed". Use
curl -fsSL (fail on error, no progress meter, show real errors, follow
redirects) and print 'kind version' / 'kubectl version --client' as the
step's useful output.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d237e-c695fe
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d237e-c695fe — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d237e-c695fe`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d237e-c695fe` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
fix: container build also generates deepcopy code
Some checks failed
CI / ci (pull_request) Successful in 4m45s
E2E smoke test / e2e (pull_request) Failing after 3m5s
48935d2268
The previous fix made container-build depend on `proto`, but the image build
also needs the gitignored deepcopy code (zz_generated.deepcopy.go), so the e2e
build failed with "missing method DeepCopyObject".

Add a `generate-code` target (deepcopy + protobuf — the Go code required to
compile, as opposed to CRD/RBAC manifests) and depend on it from the controller
and provisioner image builds. `generate` now reuses it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d244f-6f7356
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d244f-6f7356 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d244f-6f7356`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d244f-6f7356` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
fix(e2e): make kind reachable from the job and apply CRDs via kustomize
Some checks failed
CI / ci (pull_request) Successful in 4m43s
E2E smoke test / e2e (pull_request) Failing after 3m17s
3e85daa83c
The smoke test ran kind inside the remote dind daemon, so the generated
kubeconfig pointed at 127.0.0.1:<port> — unreachable from the job container,
giving "connection refused" on kubectl. When DOCKER_HOST is a remote dind, create
the cluster with apiServerAddress 0.0.0.0 on a fixed port and repoint kubeconfig
at the daemon host (TLS verify off; client-cert auth still applies). Local runs
with no remote DOCKER_HOST are unchanged.

Also apply CRDs with `kubectl apply -k` so kustomization.yaml isn't applied as a
resource.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d27c3-6cac34
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d27c3-6cac34 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d27c3-6cac34`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d27c3-6cac34` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
feat(controller): add --enable-webhooks toggle; disable in e2e
Some checks failed
CI / ci (pull_request) Successful in 4m40s
E2E smoke test / e2e (pull_request) Failing after 3m21s
6f5241518e
The controller always registered admission webhooks, whose serving certs are
normally supplied by cert-manager. The e2e smoke test has none, so the manager
failed with "open .../serving-certs/tls.crt: no such file or directory" and shut
down before reconciling.

Add --enable-webhooks (default true, production unchanged); when false, the
webhook setup is skipped so the manager never requires certs. The e2e deployment
sets --enable-webhooks=false.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d2ae4-b0f3f2
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d2ae4-b0f3f2 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d2ae4-b0f3f2`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d2ae4-b0f3f2` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
fix(controller): reconcile ConfigMap before fetching registration token
All checks were successful
CI / ci (pull_request) Successful in 4m49s
E2E smoke test / e2e (pull_request) Successful in 4m34s
d0c39d2408
The runner config ConfigMap is derived purely from the spec and does not depend
on Forgejo, but it was created only after a successful token fetch — so a Forgejo
outage (or a missing/invalid token) left no ConfigMap at all. Reconcile the
ConfigMap first; only the registration Secret and Deployment depend on the token.

This also makes the e2e smoke test's ConfigMap assertion valid without a live
token, matching its documented expectation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d3102-1c8c63
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d3102-1c8c63 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d3102-1c8c63`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d3102-1c8c63` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
Merge origin/master into fix/non-dind-runner-docker-host
Some checks failed
CI / ci (pull_request) Has been cancelled
E2E smoke test / e2e (pull_request) Has been cancelled
CI (next Go) / next-go (tip) (pull_request) Has been cancelled
c55202c2fa
master independently re-solved the CI/e2e work this branch did, with a different
(superior) architecture: containerized jobs on the runner-operator runner,
host-gateway Docker, GOPROXY, and an ephemeral in-cluster Forgejo for e2e.

Resolution:
- Took master's side for all four .forgejo workflows, hack/e2e-smoke.sh, and
  cmd/admin-registrar (master's versions supersede this branch's CI plumbing).
- Kept the cleanly-merged Makefile (tool-version pinning + generate-code target)
  and CLAUDE.md CI conventions.
- cmd/controller/main.go: combined master's Sentry + shared-Forgejo-client flags
  with this branch's --enable-webhooks toggle.
- internal/controller/runnerpool_controller.go: kept master's reconcile but
  re-applied the reorder so the spec-derived ConfigMap is materialized before any
  Forgejo interaction (token/EnableRepoActions).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d363b-5a558a
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d363b-5a558a — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d363b-5a558a`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d363b-5a558a` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
ci(next-go): use a static step name; echo the Go version in the body
All checks were successful
CI (next Go) / next-go (tip) (pull_request) Successful in 17m22s
CI / ci (pull_request) Successful in 2m1s
E2E smoke test / e2e (pull_request) Successful in 4m38s
4261159574
This runner doesn't interpolate ${{ matrix.go-version }} in step names, so the
title showed the literal expression. Use a static name and echo the resolved
version into the step log instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3d36c3-656372
This is an AI-generated review and may contain mistakes.

Status: Failed


Review failed. Tracking id r-3d36c3-656372 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3d36c3-656372`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3d36c3-656372` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.
rcsheets merged commit 397d1cf4c4 into master 2026-06-25 14:48:25 +00:00
rcsheets deleted branch fix/non-dind-runner-docker-host 2026-06-25 14:48:25 +00:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
brooktrails/forgejo-runner-operator!31
No description provided.