Route the pre-commit path through the egress proxy, and drop the cache blocks the image bake retired #1031

New issue

Closed

opened 2026-08-12 21:06:19 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-12 21:06:19 +00:00

Member

This repo has no FORGEJO_EGRESS_PROXY handling anywhere, and its
.pre-commit-config.yaml sources seven hook repositories from github.com.
Runner egress has no direct route out, so a cold hook install reaches
github.com unproxied and resets. The trace and the fix pattern are in
coilyco-bridge/deploy#402.

That failure has been masked here rather than absent. The actions/cache block
kept ~/.cache/pre-commit warm often enough that the reset only surfaced on a
cold cache, which is why it reads as intermittent rather than broken.

Two changes, same four files

Add the wrapper. Copy scripts/ci-command.sh from
coilyco-bridge/deploy or coilyco-flight-deck/infrastructure and route the
gate through it. It is a no-op when FORGEJO_EGRESS_PROXY is unset, so local
runs are unaffected. The invocation to wrap is
scripts/ci/repo-test-gate.sh, which every one of these workflows reaches.

Drop the dead cache. agentic-os:release v0.270.0 sets
PRE_COMMIT_HOME=/opt/pre-commit and ships the fleet hook environments baked
in, verified in the published image config. Nothing writes
~/.cache/pre-commit any more, so these four blocks save and restore an empty
directory:

.forgejo/workflows/ci.yml
.forgejo/workflows/promote.yml
.forgejo/workflows/mirror-to-github.yml
.forgejo/workflows/aos-cli-release.yml

They are harmless but misleading, and a cache block that looks like protection
while providing none is what hid the egress problem in the first place.

Acceptance

No gate verb reaches github.com without the proxy exported.
No workflow references ~/.cache/pre-commit.
A gate run still passes, and its pre-commit step no longer installs hook
environments, because it reads the baked ones.

This repo has no `FORGEJO_EGRESS_PROXY` handling anywhere, and its `.pre-commit-config.yaml` sources seven hook repositories from github.com. Runner egress has no direct route out, so a cold hook install reaches github.com unproxied and resets. The trace and the fix pattern are in https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/402. That failure has been masked here rather than absent. The `actions/cache` block kept `~/.cache/pre-commit` warm often enough that the reset only surfaced on a cold cache, which is why it reads as intermittent rather than broken. ## Two changes, same four files **Add the wrapper.** Copy `scripts/ci-command.sh` from `coilyco-bridge/deploy` or `coilyco-flight-deck/infrastructure` and route the gate through it. It is a no-op when `FORGEJO_EGRESS_PROXY` is unset, so local runs are unaffected. The invocation to wrap is `scripts/ci/repo-test-gate.sh`, which every one of these workflows reaches. **Drop the dead cache.** `agentic-os:release` v0.270.0 sets `PRE_COMMIT_HOME=/opt/pre-commit` and ships the fleet hook environments baked in, verified in the published image config. Nothing writes `~/.cache/pre-commit` any more, so these four blocks save and restore an empty directory: * `.forgejo/workflows/ci.yml` * `.forgejo/workflows/promote.yml` * `.forgejo/workflows/mirror-to-github.yml` * `.forgejo/workflows/aos-cli-release.yml` They are harmless but misleading, and a cache block that looks like protection while providing none is what hid the egress problem in the first place. ## Acceptance * No gate verb reaches github.com without the proxy exported. * No workflow references `~/.cache/pre-commit`. * A gate run still passes, and its pre-commit step no longer installs hook environments, because it reads the baked ones.

coilyco-ops added the

labels

2026-08-17 02:35:54 +00:00

coilyco-ops referenced this issue

2026-08-22 20:54:50 +00:00

Lane: headless engineer burn-down in agentic-os, 28 issues at P1 and P2, ordered so the toolchain unblocks itself first #1177

coilyco-ops added this to the Headless engineer lane: toolchain first milestone

2026-08-22 20:58:36 +00:00