ci: fail closed before executing on unverified hosted runner

2026-10-24 08:55:02 +02:00
parent 549b2cba5a
commit 75cd04cfc2
5 changed files with 159 additions and 1 deletions
@@ -0,0 +1,38 @@
+# P9-REQUAL-01 hosted CI findings
+
+Observed 2026-10-24 06:49 UTC. Verdict: **BLOCKED (runner isolation and hosted database execution)**. This is an infrastructure prerequisite, not evidence of a MariaDB product regression or a production qualification.
+
+## Current evidence
+
+| Evidence | Verified result | Limit |
+| --- | --- | --- |
+| Gitea `/api/v1/version` | 1.26.0 | Server version does not identify the runner binary. |
+| Repository metadata | Existing Git credential can read Actions and reports repository admin/push/pull permissions. | `/user` and `/admin/actions/runners` return 403. Repository permission does not establish instance administration. |
+| Repository runner listing | Runner 3 `pi-runner-1`, offline; `ubuntu-latest`, `ubuntu-22.04`; no version returned. | This is not the runner that ran the database lane. |
+| Baseline [run 844](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/844), job 1734 | SHA `549b2cba5a791862ba3f854312ea819a86dc42a0`; job API identifies runner 5 `Live-Runner`, label `ubuntu-latest`; failure. | Instance-wide identity/configuration unavailable through the permitted API. |
+| Run 844 raw log, lines 1, 12, 17 | Runner reports v0.4.1; `node:20-bookworm`; **merged** job HostConfig has `NetworkMode:host`, `/var/run/docker.sock:/var/run/docker.sock`, `Privileged:false`, no published ports. | An earlier reading of **custom** HostConfig `Binds:[]` was incomplete. Effective merged configuration includes the host socket. Socket daemon ownership and production separation are unverified. |
+| Run 844 raw log, lines 130-151 | SDK 9.0.317 installed; five Python guard tests pass; `docker: command not found`, exit 127. | These are guard/unit tests, not the 32 MariaDB integration tests. Printed cleanup-failure/exit17/exit1 samples are mocked test cases; they do not show real database cleanup. |
+| Run 844 raw log, line 152 | No integration artifact files available for upload. | Hosted MariaDB tests did not run. Job API marks all steps failure despite the raw five-test `OK`; use the raw log for step outcomes. |
+
+Run 843 is historical corroboration of the same merged socket/host-network configuration. Run 844 is the baseline-SHA observation. No new hosted job, Docker command, database, or service was started in this investigation.
+
+## Version-specific native service research
+
+The official `act_runner` source URL redirects to `gitea/runner`. The official [v0.4.1 tag API](https://gitea.com/api/v1/repos/gitea/runner/git/refs/tags/v0.4.1) resolves to `9aafec169b7ebf3d71df2b06780868fb552b435e`. Read these pinned sources, not runner 2.x documentation:
+
+- [Configuration example](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml): an empty container network delegates network creation; `docker_host: "-"` prevents the Docker host mount in job and service containers. These are operator configuration choices, not settings changed here.
+- [Runner implementation](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go): passes network/socket/privilege configuration to its execution engine, sets `ReuseContainers:false`, `AutoRemove:true`.
+- [go.mod](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/go.mod): selects `gitea.com/gitea/act v0.261.10`.
+- [Execution engine](https://gitea.com/gitea/act/src/tag/v0.261.10/pkg/runner/run_context.go): `networkNameForGitea` reuses configured networks (including `host`); only an empty configured network generates a job network. Native service containers share that network, receive service aliases, and have explicit port bindings only from declared service ports. Normal cleanup attempts service and generated-network removal, logging cleanup errors. Services start before job steps, so a step preflight cannot make an unsafe `services:` declaration safe.
+
+This establishes source capability only. The installed binary has not been matched to these source bytes, and normal-cleanup code does not prove cleanup after cancellation, runner crash or daemon loss. Nothing proves the effective Live-Runner uses an empty network or socket suppression; the observed job does the opposite. Private native services therefore remain **NOT ENABLED**.
+
+## Bounded workflow change
+
+Retain the existing push branch and add `fix/p9-ci-and-requalification`. Add an unconditional failing isolation preflight before all workflow Docker/Compose/database commands. It reports this handoff and requires a later reviewed workflow change after operator evidence; no self-attested repository variable bypass exists. Existing checkout, SDK, five guard tests, integration command and artifact action remain. No services, socket mount, privileges, Docker CLI installation, deployment workflow or runner configuration was added.
+
+Do not remove the blocker merely because Docker becomes available. Under the observed configuration that could grant the job control of an unidentified host daemon. The desired future native service must use `mariadb:12.2.2@sha256:42a27baaba3e8f3f0159d16381d5a7156661aa91dcc65f663cabb6a6f9503c00` on the already documented linux/amd64 platform, no published service ports, private job networking and verified disposable storage. No version upgrade is proposed.
+
+The current fixture and `--existing-server` runner deliberately allow only explicit loopback TCP. A later private service transport must preserve those defaults and receive separately reviewed narrow endpoint validation; no fixture bypass is included here.
+
+Sanitized API metadata, source/log hashes, precise blockers and next actions are in [ci-findings.json](ci-findings.json) and [CI_OPERATOR_HANDOFF.md](CI_OPERATOR_HANDOFF.md). Ignored raw files remain local; no credentials or full environment/configuration are copied into these tracked reports.