From e2b81e7ee6eb1b1d03d9a1252e858e8e80fb7c97 Mon Sep 17 00:00:00 2001 From: zcode_mulm Date: Mon, 31 Aug 2026 20:52:23 +0800 Subject: [PATCH] =?UTF-8?q?fix(cleanup):=20per-run=20=E7=BC=93=E5=AD=98?= =?UTF-8?q?=E6=B8=85=E7=90=86=E6=94=B9=E5=AE=B9=E5=99=A8=20root=20?= =?UTF-8?q?=E6=89=A7=E8=A1=8C=EF=BC=88PLAT-014=EF=BC=8C=E5=9D=91=20#18=20?= =?UTF-8?q?=E5=90=8C=E6=97=8F=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 宿主 08-30 治理后为非 root gitea-runner，rm 容器 root 属主缓存文件必 EACCES （Seabed run 917 两 attempt 测试全绿、清理步必死）。复用 job 已拉的 node-image find -mindepth 1 -delete + 宿主 rmdir 自建目录。v3 不动；合并后打 v4， per-run 调用方（Seabed）升 @v4，fixed 调用方（Reef）可留 @v3。 --- .gitea/workflows/reusable/node-quality.yml | 17 +++++++++++++++-- .../reusable/oci-build-push-verify.yml | 13 +++++++++++-- README.md | 1 + 3 files changed, 27 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/reusable/node-quality.yml b/.gitea/workflows/reusable/node-quality.yml index 328a385..cd0daee 100644 --- a/.gitea/workflows/reusable/node-quality.yml +++ b/.gitea/workflows/reusable/node-quality.yml @@ -143,6 +143,19 @@ jobs: $env_args \ "${{ inputs.node-image }}" sh -euxc '${{ inputs.install-command }} && ${{ inputs.quality-command }}' - - name: cleanup per-run cache dir + # PLAT-014: the helper container writes root-owned files (tsx workers, + # playwright, compile caches) into the per-run cache mount; the host job + # runs as non-root gitea-runner since the 2026-08-30 runner governance, + # so a host-side rm -rf fails with EACCES and reds the job (playbook #18 + # family). Clean as container root using the image this job already + # pulled, then rmdir the host-created directory itself. + - name: cleanup per-run cache dir (container root) if: always() && inputs.cache-mode == 'per-run' - run: rm -rf -- "${TOOL_CACHE_DIR:-}" + run: | + set -eu + [ -n "${TOOL_CACHE_DIR:-}" ] || exit 0 + docker run --rm \ + -v "${TOOL_CACHE_DIR}":/cleanup-root \ + "${{ inputs.node-image }}" \ + find /cleanup-root -mindepth 1 -delete + rmdir "${TOOL_CACHE_DIR}" diff --git a/.gitea/workflows/reusable/oci-build-push-verify.yml b/.gitea/workflows/reusable/oci-build-push-verify.yml index eccb6c2..990c7ae 100644 --- a/.gitea/workflows/reusable/oci-build-push-verify.yml +++ b/.gitea/workflows/reusable/oci-build-push-verify.yml @@ -305,6 +305,15 @@ jobs: } >>"${GITHUB_STEP_SUMMARY:-/dev/stdout}" cat "$digest_file" - - name: cleanup per-run cache dir + # PLAT-014: same ownership fix as node-quality — see the comment there + # (host non-root runner cannot rm container-root-owned cache files). + - name: cleanup per-run cache dir (container root) if: always() && inputs.build-command != '' && inputs.cache-mode == 'per-run' - run: rm -rf -- "${TOOL_CACHE_DIR:-}" + run: | + set -eu + [ -n "${TOOL_CACHE_DIR:-}" ] || exit 0 + docker run --rm \ + -v "${TOOL_CACHE_DIR}":/cleanup-root \ + "${{ inputs.node-image }}" \ + find /cleanup-root -mindepth 1 -delete + rmdir "${TOOL_CACHE_DIR}" diff --git a/README.md b/README.md index e3926c6..fad7676 100644 --- a/README.md +++ b/README.md @@ -33,6 +33,7 @@ jobs: ## 迁移与同步 - 2026-08-27 定稿：曾按初版决策试建 est/ci-workflows，因 est org 私有闸门不可跨仓调用而删除（用户改批 mu-ref 宿主）；同日自 est/Est-Infra 上移 tools/ci。 +- 2026-08-31 v4（PLAT-014，Issue #75）：per-run 缓存清理步改容器 root 执行（node-image `find /cleanup-root -mindepth 1 -delete` + 宿主 `rmdir`）——08-30 非 root runner 治理后宿主 rm 撞容器 root 属主文件必 EACCES（坑 #18 同族，Seabed run 917 两次复现）；v3 保持不动，per-run 调用方（est/Seabed）应升 @v4，fixed 模式调用方（est/Reef）无清理步可留 @v3。 - 2026-08-29 v3：模板 checkout 恢复 mu-ref/actions-checkout@v4（JS action）+ HEAD==SHA postcondition——P1-10 的 JS 迁移（est/Est-Infra@57cc9f7，08-27 09:39）在 08-27 12:07 上移建仓时被回退为 P1-7 host-clone fallback 血统，v3 恢复并经 Seabed 私仓探针验证；无调用方的孤儿模板 `reusable/checkout.yml` 删除（reusable 不可嵌套调用，其守卫已内联进两个模板）。 - helper Dockerfile 的可复现 bake 与 ops 巡检脚本仍属项目级（Est-Infra / gitea-host-setup）。