CI lint failed after AWS SSO and repo-native lint changes #656

New issue

Closed

opened 2026-07-27 19:23:53 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-27 19:23:53 +00:00

Member

Commit 0b199e3 landed the infrastructure-owned AWS SSO config converger and Ansible role.

Evidence

ward exec aws-sso-config-test passed all five focused tests locally.
ward exec pre-commit passed locally, including the repository-wide Pylint command and both secret scans.
Forgejo Actions reported trufflehog.yml success and lint.yml failure for the same push.
Failing run: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/1621

Why this needs an operator

The guarded Forgejo API lists the failed run but this Forgejo version returns 404 for the job-log endpoint. No signed-in browser is available in the engineer client. The failure exists only in live CI, so the engineer must not push speculative changes to probe the runner.

Operator action and expected evidence

The operator opens the failing run and identifies whether uv sync --group dev or the Pylint step failed.
The operator posts the failed step name and the first complete error block on this issue, with any secrets redacted.
If the evidence points to runner or release-image state, Ops remediates that state. If the evidence points to tracked code, the operator hands the exact error back to Engineering.

Done means the issue contains the failing step evidence and the next owner is explicit. No rerun or new code push is needed before that evidence exists.

Commit `0b199e3` landed the infrastructure-owned AWS SSO config converger and Ansible role. ## Evidence * `ward exec aws-sso-config-test` passed all five focused tests locally. * `ward exec pre-commit` passed locally, including the repository-wide Pylint command and both secret scans. * Forgejo Actions reported `trufflehog.yml` success and `lint.yml` failure for the same push. * Failing run: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/1621 ## Why this needs an operator The guarded Forgejo API lists the failed run but this Forgejo version returns 404 for the job-log endpoint. No signed-in browser is available in the engineer client. The failure exists only in live CI, so the engineer must not push speculative changes to probe the runner. ## Operator action and expected evidence 1. The operator opens the failing run and identifies whether `uv sync --group dev` or the Pylint step failed. 2. The operator posts the failed step name and the first complete error block on this issue, with any secrets redacted. 3. If the evidence points to runner or release-image state, Ops remediates that state. If the evidence points to tracked code, the operator hands the exact error back to Engineering. Done means the issue contains the failing step evidence and the next owner is explicit. No rerun or new code push is needed before that evidence exists.

coilyco-ops added the

autonomy

live-collab

label

2026-07-27 19:23:53 +00:00

coilyco-ops referenced this issue from a commit

2026-07-27 20:10:07 +00:00

fix: make infrastructure lint match the repo

coilyco-ops commented

2026-07-27 20:12:20 +00:00

Author

Member

Commit 755493c fixed the original tracked Pylint findings and changed Forgejo CI to run the complete pre-commit suite. Local pre-commit is green, the five AWS SSO tests pass, and the Linux release-image check ran Ansible Lint over 141 files with zero findings under the production profile. Secret scan run 1624 passed. Lint run https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/1623 failed after 69 seconds for task 18940. The guarded job-log endpoint still returns 404, so Engineering cannot see the failed step. Operator action: open run 1623 and post the failed hook plus its first complete error block here, redacting any secret. No rerun or code push should happen before that evidence identifies the next owner.

Commit 755493c fixed the original tracked Pylint findings and changed Forgejo CI to run the complete pre-commit suite. Local pre-commit is green, the five AWS SSO tests pass, and the Linux release-image check ran Ansible Lint over 141 files with zero findings under the production profile. Secret scan run 1624 passed. Lint run https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/1623 failed after 69 seconds for task 18940. The guarded job-log endpoint still returns 404, so Engineering cannot see the failed step. Operator action: open run 1623 and post the failed hook plus its first complete error block here, redacting any secret. No rerun or code push should happen before that evidence identifies the next owner.

coilyco-ops changed title from ~~CI lint run failed for AWS SSO config commit~~ to CI lint failed after AWS SSO and repo-native lint changes

2026-07-27 20:19:50 +00:00

coilyco-ops commented

2026-07-28 07:34:16 +00:00

Author

Member

Ops recovered the current lint evidence from run 1658.

The failing step is ward exec pre-commit.
Every hook before the shared catalog checks passed.
catalog-trifecta reports missing features-release-tooling.md convention citations in README.md, AGENTS.md, and docs/FEATURES.md.
dead-cross-links reports the two existing repo-escaping vault links in docs/forgejo-deploy-plan.md and docs/glitchtip-deploy-plan.md.
The Telegram alert step then ran but reported missing required secrets. continue-on-error preserved the original lint result.
The same checkout passed locally because the local pre-commit environment reused its cached catalog hook, while fresh CI installed the current hook environment.

The unrelated deploy-runner Python change built and published successfully in run 1657. No CI-probing push or rerun was made after this evidence.

Ops recovered the current lint evidence from run 1658. * The failing step is ward exec pre-commit. * Every hook before the shared catalog checks passed. * catalog-trifecta reports missing features-release-tooling.md convention citations in README.md, AGENTS.md, and docs/FEATURES.md. * dead-cross-links reports the two existing repo-escaping vault links in docs/forgejo-deploy-plan.md and docs/glitchtip-deploy-plan.md. * The Telegram alert step then ran but reported missing required secrets. continue-on-error preserved the original lint result. * The same checkout passed locally because the local pre-commit environment reused its cached catalog hook, while fresh CI installed the current hook environment. The unrelated deploy-runner Python change built and published successfully in run 1657. No CI-probing push or rerun was made after this evidence.

coilyco-ops added the

priority

label

2026-07-29 03:46:31 +00:00

coilyco-ops added

priority

and removed

priority

labels

2026-07-29 06:27:48 +00:00

coilyco-ops closed this issue

2026-08-05 21:22:46 +00:00