From 338d132fc41a9636fe3bb911a812df9fa87aa8b7 Mon Sep 17 00:00:00 2001 From: tianyao Date: Wed, 2 Sep 2026 09:11:17 +0000 Subject: [PATCH 1/5] ci: add concurrency control to shared Obsidian CI template, add self-CI validation Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_011zVvyzHgtk7C51dpi8CGrp --- .github/workflows/obsidian-plugin-ci.yml | 9 +++++++ .github/workflows/self-ci.yml | 30 ++++++++++++++++++++++++ 2 files changed, 39 insertions(+) create mode 100644 .github/workflows/self-ci.yml diff --git a/.github/workflows/obsidian-plugin-ci.yml b/.github/workflows/obsidian-plugin-ci.yml index 221b0b8..081c162 100644 --- a/.github/workflows/obsidian-plugin-ci.yml +++ b/.github/workflows/obsidian-plugin-ci.yml @@ -14,6 +14,15 @@ on: RELEASE_TOKEN: required: false +# No consumer of this shared template previously had any concurrency dedup, +# so rapid pushes to the same branch queued/ran independently with no +# cancellation. Scoped per calling repo (multiple repos share this template) +# and per event type so push and PR runs don't collide. +concurrency: + group: >- + ${{ github.repository }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }} + cancel-in-progress: true + jobs: filter: name: Check for Code Changes diff --git a/.github/workflows/self-ci.yml b/.github/workflows/self-ci.yml new file mode 100644 index 0000000..ab565fa --- /dev/null +++ b/.github/workflows/self-ci.yml @@ -0,0 +1,30 @@ +name: Self CI + +# --------------------------------------------------------------------------- +# Validates this repo's own reusable workflows (.github/workflows/*.yml) +# before they reach consumers: catches YAML/syntax/expression errors via +# actionlint. Not a full test harness — just a fast lint pass. +# --------------------------------------------------------------------------- + +on: + push: + paths: + - '.github/workflows/**' + pull_request: + paths: + - '.github/workflows/**' + +concurrency: + group: >- + self-ci-${{ github.repository }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }} + cancel-in-progress: true + +jobs: + actionlint: + name: actionlint + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: reviewdog/action-actionlint@v1 + with: + fail_level: error From 1ab684a1b187d4ac51488a035d29f76511ac5528 Mon Sep 17 00:00:00 2001 From: tianyao Date: Fri, 4 Sep 2026 04:58:17 +0000 Subject: [PATCH 2/5] fix(ci): use assigned Postgres service port --- .github/workflows/_pg-migration-test.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/_pg-migration-test.yml b/.github/workflows/_pg-migration-test.yml index 0f1bef8..f72926c 100644 --- a/.github/workflows/_pg-migration-test.yml +++ b/.github/workflows/_pg-migration-test.yml @@ -38,15 +38,20 @@ jobs: POSTGRES_PASSWORD: test POSTGRES_DB: test ports: - - 5432:5432 + # Let Actions allocate an available host port. Self-hosted runners + # commonly already have (or reserve) 5432, so a fixed mapping is + # not a reliable way for the job process to reach this service. + - 5432/tcp options: >- - --health-cmd pg_isready + --health-cmd "pg_isready -U postgres -d test" --health-interval 10s --health-timeout 5s --health-retries 5 env: ATLAS_VERSION: v1.3.0 - DATABASE_URL: postgres://postgres:test@localhost:5432/test?sslmode=disable + # Use the Actions-assigned service port and IPv4 loopback explicitly: + # localhost may resolve to ::1 while Docker only exposes the IPv4 map. + DATABASE_URL: postgres://postgres:test@127.0.0.1:${{ job.services.postgres.ports[5432] }}/test?sslmode=disable steps: - uses: actions/checkout@v6 From 43daacb36017ed06de55bc09846bb2fe231b191b Mon Sep 17 00:00:00 2001 From: tianyao Date: Fri, 4 Sep 2026 05:04:09 +0000 Subject: [PATCH 3/5] fix(ci): export service DSN from workflow step --- .github/workflows/_pg-migration-test.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/_pg-migration-test.yml b/.github/workflows/_pg-migration-test.yml index f72926c..07eb712 100644 --- a/.github/workflows/_pg-migration-test.yml +++ b/.github/workflows/_pg-migration-test.yml @@ -49,12 +49,16 @@ jobs: --health-retries 5 env: ATLAS_VERSION: v1.3.0 - # Use the Actions-assigned service port and IPv4 loopback explicitly: - # localhost may resolve to ::1 while Docker only exposes the IPv4 map. - DATABASE_URL: postgres://postgres:test@127.0.0.1:${{ job.services.postgres.ports[5432] }}/test?sslmode=disable steps: - uses: actions/checkout@v6 + # The job.services context is only available inside steps, not in the + # job-level env block. Export it here for the later Atlas commands. + - name: Configure ephemeral Postgres URL + run: >- + echo "DATABASE_URL=postgres://postgres:test@127.0.0.1:${{ job.services.postgres.ports[5432] }}/test?sslmode=disable" + >> "$GITHUB_ENV" + - name: Install Atlas CLI run: | curl -sSf https://atlasgo.sh | sh -s -- --community --yes --version "$ATLAS_VERSION" From 7b4444fde58de139f741f1f64bd88041a1733b0d Mon Sep 17 00:00:00 2001 From: tianyao Date: Fri, 4 Sep 2026 05:06:51 +0000 Subject: [PATCH 4/5] fix(ci): run all path categories on manual dispatch --- .github/workflows/_detect-changes.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/_detect-changes.yml b/.github/workflows/_detect-changes.yml index 55712e6..7d34859 100644 --- a/.github/workflows/_detect-changes.yml +++ b/.github/workflows/_detect-changes.yml @@ -70,6 +70,17 @@ jobs: run: | set -euo pipefail + # workflow_dispatch has no before SHA. Callers deliberately pass an + # empty base for that event, which means "run every category" rather + # than attempting an invalid/empty git diff. + if [ -z "$BASE_SHA" ]; then + echo "No base SHA supplied; treating manual dispatch as all paths changed." + echo "db_changed=true" >> "$GITHUB_OUTPUT" + echo "app_changed=true" >> "$GITHUB_OUTPUT" + echo "config_changed=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + # Diff includes added/modified/deleted files. mapfile -t CHANGED_FILES < <(git diff --name-only "$BASE_SHA" "$HEAD_SHA") From fffe2f8cb75fb393209e003b62f577a396da4273 Mon Sep 17 00:00:00 2001 From: tianyao Date: Fri, 4 Sep 2026 05:09:59 +0000 Subject: [PATCH 5/5] fix(ci): reach services through Docker host gateway --- .github/workflows/_pg-migration-test.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/_pg-migration-test.yml b/.github/workflows/_pg-migration-test.yml index 07eb712..362642f 100644 --- a/.github/workflows/_pg-migration-test.yml +++ b/.github/workflows/_pg-migration-test.yml @@ -53,11 +53,16 @@ jobs: - uses: actions/checkout@v6 # The job.services context is only available inside steps, not in the - # job-level env block. Export it here for the later Atlas commands. + # job-level env block. On the self-hosted fleet, this job executes in a + # runner container while service ports are published on the Docker host; + # the bridge gateway reaches that host (127.0.0.1 would be the runner). - name: Configure ephemeral Postgres URL - run: >- - echo "DATABASE_URL=postgres://postgres:test@127.0.0.1:${{ job.services.postgres.ports[5432] }}/test?sslmode=disable" - >> "$GITHUB_ENV" + env: + POSTGRES_PORT: ${{ job.services.postgres.ports[5432] }} + run: | + set -euo pipefail + DOCKER_HOST_GATEWAY=$(docker network inspect bridge --format '{{(index .IPAM.Config 0).Gateway}}') + echo "DATABASE_URL=postgres://postgres:test@${DOCKER_HOST_GATEWAY}:${POSTGRES_PORT}/test?sslmode=disable" >> "$GITHUB_ENV" - name: Install Atlas CLI run: |