Route the pre-commit path through the egress proxy, and drop the cache block the image bake retired #276

New issue

Open

opened 2026-08-12 21:06:48 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-12 21:06:48 +00:00

Member

.forgejo/workflows/release.yml reaches pre-commit run --all-files through
scripts/test.sh, and this repo has no FORGEJO_EGRESS_PROXY handling. Its
.pre-commit-config.yaml sources five hook repositories from github.com.

Runner egress has no direct route out, so a cold hook install reaches
github.com unproxied and resets. The trace and the fix pattern are in
coilyco-bridge/deploy#402. The
actions/cache block in that workflow has been masking it, which is why it
looks intermittent rather than broken.

Two changes

Add the wrapper. Copy scripts/ci-command.sh from
coilyco-bridge/deploy or coilyco-flight-deck/infrastructure and route
scripts/test.sh through it. It is a no-op when FORGEJO_EGRESS_PROXY is
unset, so local runs are unaffected.

Drop the dead cache. agentic-os:release v0.270.0 sets
PRE_COMMIT_HOME=/opt/pre-commit and ships the fleet hook environments baked
in, verified in the published image config. The actions/cache block in
release.yml points at ~/.cache/pre-commit, which nothing writes any more,
so it saves and restores an empty directory.

Acceptance

The release gate does not reach github.com without the proxy exported.
No workflow references ~/.cache/pre-commit.

`.forgejo/workflows/release.yml` reaches `pre-commit run --all-files` through `scripts/test.sh`, and this repo has no `FORGEJO_EGRESS_PROXY` handling. Its `.pre-commit-config.yaml` sources five hook repositories from github.com. Runner egress has no direct route out, so a cold hook install reaches github.com unproxied and resets. The trace and the fix pattern are in https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/402. The `actions/cache` block in that workflow has been masking it, which is why it looks intermittent rather than broken. ## Two changes **Add the wrapper.** Copy `scripts/ci-command.sh` from `coilyco-bridge/deploy` or `coilyco-flight-deck/infrastructure` and route `scripts/test.sh` through it. It is a no-op when `FORGEJO_EGRESS_PROXY` is unset, so local runs are unaffected. **Drop the dead cache.** `agentic-os:release` v0.270.0 sets `PRE_COMMIT_HOME=/opt/pre-commit` and ships the fleet hook environments baked in, verified in the published image config. The `actions/cache` block in `release.yml` points at `~/.cache/pre-commit`, which nothing writes any more, so it saves and restores an empty directory. ## Acceptance * The release gate does not reach github.com without the proxy exported. * No workflow references `~/.cache/pre-commit`.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agent-compose#276

No description provided.

Rows
Columns