Files
易良andQwen-Coder aeacedc4c4 fix(ci): only delete label-recovered registrations GitHub reports offline (#16713)
* fix(ci): only delete label-recovered registrations GitHub reports offline

A label-recovered identity is not anchored by recorded state, so an
online match may belong to a live runner outside this host's view and a
status-less record must fail closed. Block the deletion (keeping state
for the next cycle) unless GitHub explicitly reports the registration
offline. State-recorded identities keep the exact previous behavior.

Co-authored-by: Qwen-Coder <[email protected]>

* fix(ci): reconcile label-recovered registrations before removing resources

The offline gate for a label-recovered identity sat after the container and
network removal. Nothing about that identity is persisted, so a refusal left
no state file and no leftover resources: the next cycle skipped cleanup()
entirely and just replenished the slot, leaking the registration, and the same
held for a rejected DELETE. Keep the check where the resources are still
reachable by reconciling a resource-anchored identity before the removal, while
a state-anchored identity keeps deleting after the container stops (deleting a
live runner's registration is rejected as busy). The gate, the naming scheme
and the state-anchored behaviour are unchanged.

The test no longer rebuilds the pile by hand to reach the second cycle: it
asserts the retained container alone carries the retry, for online, absent,
null and unknown statuses, and adds a rejected-DELETE retry case.

* fix(ci): make label-recovery refusals self-clearing and keep diagnostics

Remove the leftover container even when the early reconciliation
refuses, keeping the labelled network as the retry anchor, so an online
registration backed by the slot's own container can actually reach
offline instead of sustaining the same refusal every cycle (R1-1). A
permanent identity refusal no longer pins the container either (R2-1).
Capture docker logs and the _diag archive before the early gate so a
wedged slot still exports its diagnostics (R2-2). Pin the call-site
split: label-recovered identities reconcile exactly once before
removal, state-anchored ones only after (R2-3).

Co-authored-by: Qwen-Coder <[email protected]>

* fix(ci): secure the refusal retry anchor before removing containers

A container-only orphan pile needs a labelled network created as the
retry anchor when reconciliation refuses. Creating it after the
container removal meant a failed creation left the slot with neither
state nor resources: the next cycle replenished and leaked the
registration the gate had just protected. Create the anchor first so a
failed creation still leaves the containers to bring the next cycle
back, and share one createNetwork helper between provisioning and the
refusal path so the identity labels cannot drift apart. Align the
README with the container-removal refusal semantics and drop review
round references from comments.

Co-authored-by: Qwen-Coder <[email protected]>

* docs(ci): point operators at the exported diagnostics for a wedged slot

The refusal path reclaims the containers, so the README now says the
.log and .tar exports written before the refusal are what to inspect.

Co-authored-by: Qwen-Coder <[email protected]>

---------

Co-authored-by: Qwen-Coder <[email protected]>
2026-11-09 17:43:15 +08:00
..
2025-08-27 15:23:21 +08:00