build(devenv)+ci: devenv.sh dev shell + self-hosted CI (CLI-129)#470
Merged
fhacloid merged 5 commits intoJul 1, 2026
Merged
Conversation
fhacloid
force-pushed
the
fhacloid-cli-129-cycloid-cli-devenvsh-dev-shell-self-hosted-ci
branch
from
c733df6 to
ee4744f
Compare
fhacloid
commented
Jul 1, 2026
| # --------------------------------------------------------------------------- | ||
| preflight: | ||
| name: Preflight (secrets) | ||
| runs-on: ubuntu-latest |
Contributor
Author
There was a problem hiding this comment.
[NOTE] use our selfhosted runner for ALL workflow, no more github on deman usage
| shfmt # format-sh | ||
|
|
||
| # Dev tooling. | ||
| pre-commit # `make install` wires .git/hooks/pre-commit |
Contributor
Author
There was a problem hiding this comment.
[NOTE] We should port it to the devenv integration of pre-commit hooks
Comment on lines
+183
to
+191
| // On a freshly created catalog the version-presence rows are filled by a | ||
| // background cron (~10 min); the plain catalog scan (RefreshCatalogRepository) | ||
| // does NOT populate them, so ListStackVersions finds the stack but no branch | ||
| // version and we fail with "failed to find latest catalog repo version" | ||
| // (BE-1344 / CLI-127). This bites on a cold backend (e.g. CI bringing up the | ||
| // compose stack). RefreshCatalogRepositoryVersions hits versions/refresh with | ||
| // sync_presence=true, which re-indexes branches+tags synchronously — the same | ||
| // call `cy catalog-repository create/update` makes for this exact race, which | ||
| // testcfg bypasses by talking to the middleware directly. |
Contributor
Author
There was a problem hiding this comment.
[NOTE] shorten comment
fhacloid
force-pushed
the
fhacloid-cli-129-cycloid-cli-devenvsh-dev-shell-self-hosted-ci
branch
from
ee4744f to
50174f6
Compare
The old flake.nix mkShell declared golangci-lint/gci commented out and omitted goimports/shfmt/shellcheck entirely, so `make format lint` (the pre-commit hook target) could not run from inside the declared shell. Add devenv.nix/devenv.yaml/devenv.lock pinning go_1_25 (matches go.mod) plus the full Makefile toolchain (go-swagger, golangci-lint, gci, goimports, shfmt, shellcheck, awscli, docker client). Use a plain go package rather than the languages.go module, which injects gopls (now requiring go >= 1.26 on unstable, ahead of go.mod). Switch .envrc to `use devenv`, gitignore .devenv/, and remove flake.nix + flake.lock so the toolchain has a single source of truth. Pre-commit hooks move to devenv's git-hooks integration (CLI-130): declared in devenv.nix and auto-installed on shell entry, replacing the hand-written .pre-commit-config.yaml and `make install`'s hook wiring. Hooks: format-and-lint (`make format lint`, the repo's canonical gate) and no-commit-to-branch (develop/master). No secret-scanner: the old detect-private-key hook was never enforced (the repo commits many intentional test/example keys) and it flags all of them for no benefit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019XPwTdhsXxERJUxG2tZpP2
Clears the only `make lint` failures on develop so the new CI lint-build job is green: gci/goimports formatting drift, and an ST1005 (error string ends with punctuation) on the multi-line guidance message in environments/delete.go — drop the trailing period, message otherwise intact. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019XPwTdhsXxERJUxG2tZpP2
Adapted from terraform-provider-cycloid's workflow. ALL jobs run on the dedicated [self-hosted, cycloid] runner (no GitHub-hosted usage); every step executes inside the devenv shell via defaults.run.shell. - authorize: fork-gate by head-repo == base-repo, not author_association (which mislabels private-org members as CONTRIBUTOR). No checkout, so safe on the self-hosted runner. - preflight: skips the backend job cleanly when CY_API_KEY is unset. - lint-build: make lint (golangci-lint + shellcheck) + go vet + go build. - test: cy uri interpolate -> Scaleway docker login -> compose pull -> make be-start -> wait youdeploy-api healthy (:3001) -> go test ./... -p 1 -failfast -> teardown; egress/catalog diagnostic on failure. Needs CY_API_KEY. push CI limited to develop/master so a branch push + its PR don't run the heavy e2e twice on one runner. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019XPwTdhsXxERJUxG2tZpP2
On a freshly created catalog the version-presence rows are filled by a background cron (~10 min); RefreshCatalogRepository (the catalog scan) does NOT fill them, so on a cold backend (CI bringing up the compose stack) ListStackVersions found stack-e2e-stackforms but no "stacks" branch version and testcfg failed with "failed to find latest catalog repo version". `cy catalog-repository create/update` already calls RefreshCatalogRepositoryVersions (versions/refresh?sync_presence=true) for exactly this race (CLI-127, 6607bd58), but testcfg created the catalog through the middleware directly and bypassed it. Call it before listing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019XPwTdhsXxERJUxG2tZpP2
TestOIDC ran a bare `oidc settings get` before any `set`. Settings are created on first set, so on a freshly provisioned org (CI cold backend) the get 404s. Reorder so `set` establishes the settings first, then `get` reads them back — no assertion change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019XPwTdhsXxERJUxG2tZpP2
fhacloid
force-pushed
the
fhacloid-cli-129-cycloid-cli-devenvsh-dev-shell-self-hosted-ci
branch
from
50174f6 to
48da1ca
Compare
fhacloid
deleted the
fhacloid-cli-129-cycloid-cli-devenvsh-dev-shell-self-hosted-ci
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes CLI-129.
Brings cycloid-cli onto the same reproducible-toolchain + self-hosted CI pattern as
terraform-provider-cycloidand reborn.Why
The old
flake.nixmkShell declaredgolangci-lint/gcicommented out and omittedgoimports/shfmt/shellcheck— somake format lint(the pre-commit hook target, Hard Rule 8) couldn't actually run from the declared shell. And there was no GitHub Actions CI at all.What
build(devenv)— replaceflake.nix+flake.lockwithdevenv.nix/devenv.yaml/devenv.lock:go_1_25(matchesgo.mod) + the full Makefile toolchain: go-swagger, golangci-lint, gci, goimports, shfmt, shellcheck, pre-commit, awscli, docker client.gopackage, not thelanguages.gomodule (it injects gopls, which now needs go ≥1.26 on unstable — ahead of go.mod)..envrc:use flake→use devenv; gitignore.devenv/.ci—.github/workflows/ci.ymlon[self-hosted, cycloid], every step inside the devenv shell:authorize(ubuntu): fork-gate by head-repo, not author_association.preflight(ubuntu): skips the backend job cleanly whenCY_API_KEYis unset (no red).lint-build:make lint+go vet+go build.test:cy uri interpolate→ Scaleway docker login → compose pull →make be-start→ waityoudeploy-apihealthy (:3001) →go test ./... -p 1 -failfast→ teardown.style— cleared the only pre-existingmake lintfailures on develop (goimports drift on 4 files + one ST1005 inenvironments/delete.go) solint-buildis green.The
testjob needs aCY_API_KEYrepo secret (cycloid SaaS key) to resolve the licence + Scaleway registry creds and pull the backend image — same secret tfpro uses. Until it's set,testskips and onlylint-buildruns.🤖 Generated with Claude Code