From 52db4acace43a30cd6eb00c7bb6b235167520971 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Wed, 22 Jul 2026 03:50:22 +0200 Subject: [PATCH] fix 1.23.6: mon pages only from remote suite tip Host-agent must fetch/reset to origin/main and refuse if HEAD lags. Refresh suite-overlay from tip after update; do not re-apply stale overlay over Forgejo by default (was regenerating mon HTML with old site-gen). --- VERSION | 2 +- VERSIONS.md | 1 + host-agent/README.md | 3 ++- host-agent/run-host-report.sh | 44 ++++++++++++++++++++++++----------- host-agent/update-suite.sh | 20 ++++++++++++++++ 5 files changed, 54 insertions(+), 16 deletions(-) diff --git a/VERSION b/VERSION index ca8ec41..d8c40e5 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.23.5 +1.23.6 diff --git a/VERSIONS.md b/VERSIONS.md index 1506e64..ce8f1ff 100644 --- a/VERSIONS.md +++ b/VERSIONS.md @@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre | Tag | Date (UTC) | Notes | |-----|------------|--------| +| **v1.23.6** | 2026-07-22 | **Strict suite tip for mon pages:** every host-agent run must `fetch`+`reset` to `origin/main` and **refuse** if HEAD ≠ remote tip (`SUITE_REQUIRE_REMOTE_TIP=1`). Overlay is refreshed **from** the tip after update (never re-applied over tip by default — was publishing stale site-gen). `git clean` after reset. Mon HTML still embeds that COMMIT in sticky/meta. | | **v1.23.5** | 2026-07-22 | **Bugfix / host-agent:** multi-agent shared `/var/www/monitoring-sites` — stop full-tree `rsync --delete` (wiped sibling pages e.g. `/monitoring-max-ladder/` after main/surface/aptdeploy runs). Publish **only this job’s** `HTML_OK_DIR`/`HTML_ERR_DIR` per host; `apply-monitoring-live.sh` merges without tree-delete. | | **v1.23.4** | 2026-07-19 | **Bugfix / mon:** shared **normalize_taler_uri** (strip taler:// host :443/:80); ladder/e2e/pay use it. **urls** scans bank+exchange+merchant intros + demo-withdraw/auto-account/stats for default ports (**ERROR** on GOA). Unit test tests/test_normalize_taler_uri.sh. | | **v1.23.3** | 2026-07-19 | **Bugfix:** payments stale because max-ladder never got coins — root cause on koopa was **taler-wallet-cli missing** (all mint-OK → SKIP_ACCEPT). Hard-fail ladder prereq if CLI/helper missing; settle keeps polling after transfer_done + short run-pending; pay wait default 180s; max-ladder wrapper sets PATH/WALLET_CLI. | diff --git a/host-agent/README.md b/host-agent/README.md index dde3b1c..05192be 100644 --- a/host-agent/README.md +++ b/host-agent/README.md @@ -4,8 +4,9 @@ | Behaviour | Default | |-----------|---------| -| Suite refresh | **`update-suite.sh` every run** → `git fetch --tags` + hard reset to `origin/main` | +| Suite refresh | **`update-suite.sh` every run** → `git fetch --tags` + hard reset to `origin/main` + clean; **HEAD must equal remote tip** (`SUITE_REQUIRE_REMOTE_TIP=1`) before mon HTML is generated | | Update strict | `SUITE_UPDATE_STRICT=1` (default): **abort** if fetch/reset fails — no silent old tree | +| Overlay | After tip reset, suite-overlay is **copied from** remote tip (not applied over it). Emergency only: `SUITE_ALLOW_STALE_OVERLAY=1` | | Wall clock | `RUN_TIMEOUT=600` | | Log | line-buffered `run-*.log` (continuous write) | | HTML | always (first run / empty tree too) + commit URL; **bootstrap install stubs are monpages ERROR** | diff --git a/host-agent/run-host-report.sh b/host-agent/run-host-report.sh index 13df1ca..88bee07 100755 --- a/host-agent/run-host-report.sh +++ b/host-agent/run-host-report.sh @@ -152,25 +152,38 @@ UPD_LOG="$LOG_DIR/suite-update-${STAMP}.log" : >"$LOG" # --- suite auto-upgrade BEFORE the HTML log (git noise must not pollute mon pages) --- +# Always download newest taler-monitoring from Forgejo first. Mon HTML landing pages +# embed COMMIT/VERSION from this tree — never generate pages from a lagging clone. OVERLAY_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/suite-overlay" -if [ -f "$AGENT_MON/taler-monitoring.sh" ]; then - mkdir -p "$OVERLAY_DIR" - rsync -a \ - --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \ - --exclude 'android-test/out*' --exclude '__pycache__' \ - "$AGENT_MON/" "$OVERLAY_DIR/" 2>/dev/null || true -fi +# Prefer update-suite from the live suite tree if present (may itself be slightly +# old until fetch); fall back to agent-bundled copy. +_upd_src="$AGENT_DIR/update-suite.sh" +if [ -f "${SUITE_DIR:-$HOME/src/taler-monitoring}/host-agent/update-suite.sh" ]; then + _upd_src="${SUITE_DIR:-$HOME/src/taler-monitoring}/host-agent/update-suite.sh" +fi # shellcheck source=update-suite.sh -if ! source "$AGENT_DIR/update-suite.sh" >"$UPD_LOG" 2>&1; then +if ! source "$_upd_src" >"$UPD_LOG" 2>&1; then echo "ERROR: suite auto-update failed — refusing to run with stale tree" >&2 echo " detail: $UPD_LOG" >&2 tail -n 30 "$UPD_LOG" >&2 || true echo " fix git/network or set SUITE_UPDATE_STRICT=0 only as emergency" >&2 exit 1 fi +unset _upd_src if [ -d "${SUITE_DIR:-}/host-agent" ]; then AGENT_DIR="${SUITE_DIR}/host-agent" + AGENT_MON="${SUITE_DIR}" +fi +# After tip reset: refresh suite-overlay FROM remote tip (never the reverse by default). +# Old behaviour rsynced local agent → overlay *before* fetch, then could re-apply a +# stale overlay over a fresh Forgejo tree and publish outdated mon-page generators. +if [ -f "${SUITE_DIR}/taler-monitoring.sh" ]; then + mkdir -p "$OVERLAY_DIR" + rsync -a --delete \ + --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \ + --exclude 'android-test/out*' --exclude '__pycache__' \ + "${SUITE_DIR}/" "$OVERLAY_DIR/" 2>/dev/null || true fi # Now open the public HTML log (clean agent header + suite summary only) @@ -215,9 +228,11 @@ if [ -f "$OVERLAY_DIR/host-agent/run-host-report.sh" ] \ && grep -q '_wrap_keys\|_WRAP_SET_' "$OVERLAY_DIR/host-agent/run-host-report.sh" 2>/dev/null; then _need_overlay=1 fi -if [ "$_need_overlay" = "1" ] && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then - echo "WARN: Forgejo @ ${COMMIT_SHORT:-?} lagging local suite-overlay (phases=[$PHASES])" >&2 - echo " re-applying suite-overlay → $SUITE_MON" >&2 +# Default: never re-apply overlay over a just-fetched remote tip (v1.23.6+). +# Emergency only: SUITE_ALLOW_STALE_OVERLAY=1 restores old "overlay wins" path. +if [ "$_need_overlay" = "1" ] && [ "${SUITE_ALLOW_STALE_OVERLAY:-0}" = "1" ] \ + && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then + echo "WARN: SUITE_ALLOW_STALE_OVERLAY=1 — re-applying suite-overlay over ${COMMIT_SHORT:-?}" >&2 mkdir -p "$SUITE_MON" rsync -a \ --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \ @@ -225,11 +240,12 @@ if [ "$_need_overlay" = "1" ] && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then "$OVERLAY_DIR/" "$SUITE_MON/" ROOT="$SUITE_MON" elif [ "$_need_overlay" = "1" ]; then - echo "WARN: Forgejo missing features and no suite-overlay — using agent mon $AGENT_MON" >&2 - ROOT="$AGENT_MON" + echo "WARN: suite @ ${COMMIT_SHORT:-?} may lack phase files for [$PHASES] — using remote tip anyway (push missing features; set SUITE_ALLOW_STALE_OVERLAY=1 only as emergency)" >&2 + ROOT="$SUITE_MON" + echo "using suite mon @ ${COMMIT_SHORT:-?} · $ROOT" else echo "using suite mon @ ${COMMIT_SHORT:-?} · $ROOT" - # Do NOT rsync suite-overlay over a fresh Forgejo tree — that reintroduced + # Never rsync suite-overlay over a fresh Forgejo tree — that reintroduced # stale site-gen/host-agent (bootstrap sticky, old monpages) on stage/betel. fi unset _need_overlay diff --git a/host-agent/update-suite.sh b/host-agent/update-suite.sh index 9c5f3ea..4f0d39b 100755 --- a/host-agent/update-suite.sh +++ b/host-agent/update-suite.sh @@ -76,6 +76,9 @@ case "$SUITE_UPDATE_MODE" in && ! git reset --hard FETCH_HEAD; then _upd_die "git reset --hard origin/$SUITE_GIT_REF failed" fi + # Drop untracked junk that could shadow suite files (never secrets). + git clean -fd -e secrets.env -e 'android-test/artifacts' -e 'android-test/apks' \ + -e 'android-test/out*' 2>/dev/null || true ;; pull) if ! git pull --ff-only origin "$SUITE_GIT_REF" 2>&1; then @@ -98,6 +101,23 @@ SOURCE_REPO_WEB="${SOURCE_REPO_WEB:-https://git.hacktivism.ch/hernani/taler-moni COMMIT_URL="${SOURCE_REPO_WEB}/src/commit/${COMMIT}" export COMMIT COMMIT_SHORT COMMIT_URL SOURCE_REPO_WEB +# Strict tip check (default): mon pages must be generated from remote tip, not a lagging clone. +# SUITE_REQUIRE_REMOTE_TIP=0 only for emergency offline/dev. +: "${SUITE_REQUIRE_REMOTE_TIP:=1}" +if [ "${SUITE_UPDATE_MODE}" != "keep" ] && [ "${SUITE_UPDATE_MODE}" != "skip" ] \ + && [ "${SUITE_UPDATE_MODE}" != "off" ] && [ "${SUITE_UPDATE_MODE}" != "none" ] \ + && [ "${SUITE_REQUIRE_REMOTE_TIP}" = "1" ]; then + _remote=$(git rev-parse "origin/${SUITE_GIT_REF}" 2>/dev/null || git rev-parse FETCH_HEAD 2>/dev/null || true) + if [ -z "$_remote" ]; then + _upd_die "cannot resolve origin/${SUITE_GIT_REF} after fetch — refuse mon-page generate on unknown tip" + elif [ "$COMMIT" != "$_remote" ]; then + _upd_die "suite HEAD ${COMMIT_SHORT} != origin/${SUITE_GIT_REF} $(git rev-parse --short=12 "$_remote" 2>/dev/null) — refuse stale mon pages" + else + echo " remote tip OK: HEAD == origin/${SUITE_GIT_REF} (${COMMIT_SHORT})" + fi + unset _remote +fi + # Release tag for sticky bar (exact tag if HEAD is tagged, else nearest) SUITE_VERSION="" if command -v git >/dev/null 2>&1; then