feat/resilience-metrics #44

Merged

finkregh merged 21 commits from feat/resilience-metrics into main 2026-08-19 10:37:04 +00:00

Conversation 0 Commits 21 Files changed 21 +3676 -130

finkregh commented 2026-08-01 21:40:27 +00:00

Owner

Copy link

No description provided.

finkregh added 13 commits 2026-08-01 21:40:28 +00:00

T1: resilience package skeleton 06d3c9a3ab

T5: metrics package with tunable project-label cardinality 6662fab9e8

T2: per-project backoff 9c63375f32

T3: rapid-fail breaker d4986cad2a

T4: manual bypass + replay queue + snapshot 6c1bb46747

T7: scheduler gates dispatch via resilience.AllowDispatch 3b69e966c1

T6: executor reports outcome/duration to resilience + metrics 020809be90

T8a: config env vars for resilience + metrics f4cc49a3a4

T8b: /api/v1/breaker/{state,reset,bypass} + /metrics endpoint 86291e8dbf

T8c: webhook gates on breaker, replays on reset; wire cmd/main.go 6fc5718f38

T9: UI breaker banner + reset button 50e013ba98

T10: README + runbook + smoke script + mark spec/plan implemented b641a617d6

chore: pi-lens autoformat + backfill T9 SHA in plan dc5869d4ab

finkregh added 1 commit 2026-08-01 22:25:57 +00:00

fix: resolve golangci-lint issues in tests and metrics ... 684e3aecaa

- errcheck: check w.Write return in metrics_test
- errorlint: use errors.Is for ErrReplayQueueFull comparison
- noctx: use httptest.NewRequestWithContext across tests
- revive: fix exported const comments and unused param
- staticcheck: use collectors.NewGoCollector/NewProcessCollector
- unparam: makePushPayload no longer takes unused repo arg

finkregh added 7 commits 2026-08-04 12:11:43 +00:00

cleanup d540ae4d6d

fix(executor): run renovate containers as 12021:0 for GID-0 cache access ... 15d9411114

The renovate/renovate image (Containerbase) pre-populates
/tmp/containerbase/cache and /home/ubuntu/.cache (a symlink into it)
as root:root drwxrwxr-x — group-writable to GID 0 only. Running with
primary GID 12021 strips group-write access, causing EACCES for uv,
nix, pip, poetry, cargo, gradle, m2, gem, nuget, sbt, cocoapods,
conan, dart, flutter and other Containerbase-managed tool caches.

Extract the required uid:gid into `renovateContainerUser` so it cannot
drift across the three container creation sites.

Empirically verified on saturn.local against renovate/renovate:full.
See .unipi/docs/generated/2026-08-04-permission-issues-uv-nix.md and
.unipi/docs/plans/2026-08-04-containerbase-cache-and-gid-fix-plan.md.

Refs: TODO.md items 1 & 2

Co-Authored-By: pi-agent <noreply@earendil.works>
Signed-off-by: Oluf Lorenzen <finkregh@mafia-server.net>

feat(executor): mount containerbase cache as a second persistent volume ... 9f79443bd9

Adds a second named Docker volume (default: renovate-containerbase-cache,
override via ROP_CONTAINERBASE_CACHE_VOLUME) bound at
/tmp/containerbase/cache inside child renovate containers. Persists every
Containerbase-managed tool cache across runs: uv, pip, poetry, nix (via
the baked NIX_STORE_DIR, so the public substituter stays valid), cargo,
gradle, m2, gem, nuget, sbt, cocoapods, conan, dart, flutter, hex, mix.

Podman/Docker auto-seeds the empty volume from the image on first mount,
preserving the root:root drwxrwxr-x permissions required by the 12021:0
container user (fixed in the previous commit).

Applies to executor, discovery and apply container creation sites.

Refs: TODO.md items 1 & 2

Co-Authored-By: pi <noreply@earendil.works>
Signed-off-by: Oluf Lorenzen <finkregh@mafia-server.net>

docs: document ROP_CONTAINERBASE_CACHE_VOLUME env var ... 07158dab60

Add the new env var (introduced in the previous commit) to .env.example
and the README configuration table.

Co-Authored-By: pi <noreply@earendil.works>
Signed-off-by: Oluf Lorenzen <finkregh@mafia-server.net>

test(executor): cover ContainerbaseCacheVolume default and override ... 998b116c5d

Mirror the existing CacheVolume assertions so the new second-volume
wiring cannot regress silently.

Co-Authored-By: pi <noreply@earendil.works>
Signed-off-by: Oluf Lorenzen <finkregh@mafia-server.net>

refactor(executor): extract hostBinds() helper for container bind mounts ... 108ba0f0e8

DRY the three container-creation sites (executor, discovery, apply) to
a single hostBinds() method on *DockerExecutor. Locks in the invariant
that both cache volumes must be mounted together: dropping either
would silently break caching for one class of tools. New unit test
guards the invariant.

Co-Authored-By: pi <noreply@earendil.works>
Signed-off-by: Oluf Lorenzen <finkregh@mafia-server.net>

docs(readme): add cache-volumes runbook subsection ... 8701e87579

Explain the two persistent Docker volumes (renovate-cache and
renovate-containerbase-cache), the GID 0 requirement for child
containers, and how to reclaim disk. Cross-references the underlying
finding in .unipi/docs/generated/2026-08-04-permission-issues-uv-nix.md.

Co-Authored-By: pi <noreply@earendil.works>
Signed-off-by: Oluf Lorenzen <finkregh@mafia-server.net>

finkregh force-pushed feat/resilience-metrics from 8701e87579 to ec43a4d6cb 2026-08-04 12:13:53 +00:00 Compare

finkregh force-pushed feat/resilience-metrics from ec43a4d6cb to 618afbf4a0 2026-08-04 12:37:59 +00:00 Compare

finkregh merged commit 633d32ee48 into main 2026-08-19 10:37:04 +00:00

finkregh deleted branch feat/resilience-metrics 2026-08-19 10:37:04 +00:00

finkregh referenced this pull request from a commit 2026-08-19 10:37:05 +00:00

Merge pull request 'feat/resilience-metrics' (#44) from feat/resilience-metrics into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

finkregh/renovate-docker-operator!44

No description provided.