From 052fa31d87e27dfe81fca722ba433de5642aa8fa Mon Sep 17 00:00:00 2001 From: Kevin Date: Fri, 4 Sep 2026 02:09:46 -0400 Subject: [PATCH] Avoid unreachable Gitea runner cache --- .gitea/workflows/cms-content-validation.yml | 2 -- .gitea/workflows/deploy-blog.yml | 2 -- .gitea/workflows/deploy.yml | 2 -- .gitea/workflows/production-blog.yml | 2 -- .gitea/workflows/production-candidate.yml | 2 -- docs/decap-cms-pilot.md | 11 ++++++++--- scripts/verify-decap.mjs | 3 +-- 7 files changed, 9 insertions(+), 15 deletions(-) diff --git a/.gitea/workflows/cms-content-validation.yml b/.gitea/workflows/cms-content-validation.yml index d05f34f..2494d61 100644 --- a/.gitea/workflows/cms-content-validation.yml +++ b/.gitea/workflows/cms-content-validation.yml @@ -20,8 +20,6 @@ jobs: uses: https://github.com/actions/setup-node@v4 with: node-version: 22 - cache: npm - cache-dependency-path: package-lock.json - name: Install locked dependencies run: npm ci --prefer-offline --no-audit --no-fund - name: Verify Decap configuration and content boundaries diff --git a/.gitea/workflows/deploy-blog.yml b/.gitea/workflows/deploy-blog.yml index 51c11de..cdfc57a 100644 --- a/.gitea/workflows/deploy-blog.yml +++ b/.gitea/workflows/deploy-blog.yml @@ -33,8 +33,6 @@ jobs: uses: https://github.com/actions/setup-node@v4 with: node-version: 22 - cache: npm - cache-dependency-path: package-lock.json - name: Install locked dependencies run: npm ci --prefer-offline --no-audit --no-fund - name: Validate and build selected site diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 91cc1b9..41001ae 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -33,8 +33,6 @@ jobs: uses: https://github.com/actions/setup-node@v4 with: node-version: 22 - cache: npm - cache-dependency-path: package-lock.json - name: Install locked dependencies run: npm ci --prefer-offline --no-audit --no-fund - name: Validate and build selected site diff --git a/.gitea/workflows/production-blog.yml b/.gitea/workflows/production-blog.yml index d015bf0..2224ba8 100644 --- a/.gitea/workflows/production-blog.yml +++ b/.gitea/workflows/production-blog.yml @@ -34,8 +34,6 @@ jobs: uses: https://github.com/actions/setup-node@v4 with: node-version: 22 - cache: npm - cache-dependency-path: package-lock.json - name: Install locked dependencies run: npm ci --prefer-offline --no-audit --no-fund - name: Validate and build production blog diff --git a/.gitea/workflows/production-candidate.yml b/.gitea/workflows/production-candidate.yml index 2a773d8..7334870 100644 --- a/.gitea/workflows/production-candidate.yml +++ b/.gitea/workflows/production-candidate.yml @@ -34,8 +34,6 @@ jobs: uses: https://github.com/actions/setup-node@v4 with: node-version: 22 - cache: npm - cache-dependency-path: package-lock.json - name: Install locked dependencies run: npm ci --prefer-offline --no-audit --no-fund - name: Validate and build production site diff --git a/docs/decap-cms-pilot.md b/docs/decap-cms-pilot.md index 2c86a90..c75d9c6 100644 --- a/docs/decap-cms-pilot.md +++ b/docs/decap-cms-pilot.md @@ -81,9 +81,14 @@ the pilot: - The existing branch preview workflows remain in place. Local output checks now prove preview robots rules and page metadata stay no-index and that the admin response has a no-index header rule. -- Validation, preview, and production workflows cache npm's download store by - `package-lock.json` while retaining clean `npm ci` installs. Warm runner jobs - avoid repeatedly downloading the same dependency tarballs. +- Validation, preview, and production workflows use clean `npm ci` installs with + `--prefer-offline --no-audit --no-fund`. Do not enable `setup-node`'s npm cache + until the Actions runner cache service is reachable from job containers. The + September 4 pilot test timed out against the runner's auto-detected private + address during both cache restore and cleanup. Give `act_runner` a fixed + `cache.host` and `cache.port` reachable from its job containers, publish that + port (or attach runner and jobs to a shared network), restart the runner, and + then restore the lockfile-keyed `cache: npm` configuration. The pilot dependencies are active: the public client ID, exact-origin CORS policy, `cms-pilot` branch, and both protection rules have been verified. diff --git a/scripts/verify-decap.mjs b/scripts/verify-decap.mjs index d50b167..349b9e6 100644 --- a/scripts/verify-decap.mjs +++ b/scripts/verify-decap.mjs @@ -227,8 +227,7 @@ for (const path of [ '.gitea/workflows/production-blog.yml', ]) { const text = await readFile(path, 'utf8'); - assert(/cache:\s*npm/.test(text) && /cache-dependency-path:\s*package-lock\.json/.test(text), `${path} must cache npm downloads by package-lock.json.`); - assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install while preferring the cache.`); + assert(text.includes('npm ci --prefer-offline --no-audit --no-fund'), `${path} must retain a clean lockfile install with quiet, cache-friendly npm options.`); } console.log('Verified Decap backend, four content contracts, fixed page images, bounded media, admin pin, and stable PR status context.');