fix(ci): pre-clone manifest deps in harness-replays workflow (#173 followup) #50
Ghost
Loading…
Reference in New Issue
Block a user
No description provided.
Delete Branch "fix/harness-replays-pre-clone-manifest"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
tests/harness/compose.ymlusingworkspace-server/Dockerfile.tenant. Post-#173, that Dockerfile expects.tenant-bundle-deps/{workspace-configs-templates,org-templates,plugins}pre-cloned at build-context root.publish-workspace-server-image.ymlbut missedharness-replays.yml.AUTO_SYNC_TOKEN) toharness-replays.yml.Evidence of failures (without this fix)
COPY .tenant-bundle-deps/plugins -> failed to calculate checksum ... not foundfatal: could not read Username for https://git.moleculesai.app(staging is still pre-#173 because auto-sync main→staging is currently conflicted)Coordination
A sister agent is fixing the auto-sync main→staging conflict in parallel. Once that lands, staging inherits both this workflow fix and the Dockerfile.tenant refactor atomically.
Test plan
python3 -c "import yaml; yaml.safe_load(...)")Refs: #168, #173
Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
harness-replays.yml builds tenant-alpha + tenant-beta via tests/harness/ compose.yml using workspace-server/Dockerfile.tenant. Post-#173, that Dockerfile expects .tenant-bundle-deps/{workspace-configs-templates, org-templates,plugins} pre-cloned at the build context root. Sister PR #38 added the pre-clone step to publish-workspace-server-image.yml but missed harness-replays.yml. Symptoms: - main run #892 (2026-05-07T20:28:53Z): COPY .tenant-bundle-deps/plugins -> failed to calculate checksum ... not found. - staging run #964 (2026-05-07T20:41:52Z): hits the OLD in-image clone path (staging hasn't picked up the Dockerfile.tenant refactor yet via auto-sync) and fails on 'fatal: could not read Username for https://git.moleculesai.app' when cloning the first private workspace-template-* repo. Fix: add the same Pre-clone step to harness-replays.yml, mirroring publish-workspace-server-image.yml. Uses AUTO_SYNC_TOKEN (devops-engineer persona PAT) per feedback_per_agent_gitea_identity_default. Once auto-sync main->staging unblocks (sister agent fixing the 7-file conflict in flight), staging will inherit both this workflow fix AND the Dockerfile.tenant refactor atomically. Refs: #168, #173Phase 4 — Verification on PR run #1071
Run: https://git.moleculesai.app/molecule-ai/molecule-core/actions/runs/1071
What this PR fixes (confirmed)
✅
Pre-clone manifest depsstep ran successfully — auth works:All 9 workspace-template, 7 org-template, and 21 plugin repos cloned via
oauth2:***@git.moleculesai.app(basic-auth withAUTO_SYNC_TOKEN).✅
tenant-alpha,tenant-beta,cp-stubDocker images built (the COPY.tenant-bundle-deps/*step that failed in main run #892 now succeeds).✅ All postgres + redis + tenant containers healthy (
Container harness-tenant-alpha-1 Healthy,tenant-beta-1 Healthy).What this PR does NOT fix (separate issue)
The pipeline now fails at a different point:
cf-proxycontainer fails to start because the bind-mount oftests/harness/cf-proxy/nginx.conferrors with:Root cause is separate from #168/#173: this is an act-runner / docker-in-docker path-translation issue. The act runner exposes the workspace as
/workspace/...inside the runner container, butdocker composeinvokes the host docker daemon, which cannot resolve that path on the host kernel.This is a structural Gitea Actions runner config issue. Inspecting historical harness-replays runs (run #683, the only Success in 30 runs) confirms it was a no-op pass (paths-filter excluded the commit) — the harness has never actually executed end-to-end on this Gitea Actions setup. Filing a separate task for it.
Evidence: pre-fix vs post-fix on main
failed to calculate checksum ... not foundnot a directory(separate issue)Single-file CI workflow fix mirrors PR #66 pattern. Ships harness-replays pre-clone-manifest step (#173 followup). All real CI checks green; only reds are informational (Harness Replays #192 cf-proxy DinD blocker, pre-existing) and intentional (pr-guards/disable-auto-merge-on-push, by-design per feedback_pr_merge_safety_guards). Ready to merge.