eho/register-referentie
1
0
Fork 0
Code Issues 16 Pull Requests 1 Actions 1 Packages Projects Releases 1 Wiki Activity

ci(acl): keep the integration lane local-only; document the runner gap (refs #46)
All checks were successful
CI / lint (pull_request) Successful in 49s
Details
CI / build (pull_request) Successful in 42s
Details
CI / unit (pull_request) Successful in 50s
Details
CI / mutation (pull_request) Successful in 1m31s
Details
CI / compose-smoke (pull_request) Successful in 3m54s
Details

Browse Source 
The hosted Gitea runner starts the OpenZaak stack as sibling containers via the
host daemon, so a process on the runner can't reach the published ports — the seed
and dotnet test get Connection refused on localhost:8000. Drop the (non-working)
integration CI job; make integration stays the local / host-runner gate. Document
the limitation in gitea-actions-gotchas.md §5 and the CI runbook, and track running
it inside the compose network in #55. ADR-0006 updated accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Niek Otten
2026-06-29 12:04:44 +02:00
parent 855a5565fe
commit 3829cb0b68
4 changed files with 51 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
docs/runbooks/gitea-actions-gotchas.md
View File

@@ -124,3 +124,34 @@ needed). v3 uses the older artifact protocol that Gitea implements, and has no G
guard. Inputs are the same (`name`, `path`, `if-no-files-found`), so it is a drop-in
swap. Do **not** bump to `@v4` until act_runner advertises github.com-compatible
artifact support.
---
## 5. A runner process can't reach a service container's published port
**Symptom** — green locally, but a CI step that runs *on the runner* and talks to a
compose service over `localhost` fails. The ACL integration test's seed died with:
```
OpenZaak ready (000)
urllib.error.URLError: <urlopen error [Errno 111] Connection refused>
make: *** [Makefile:114: integration] Error 1
```
OpenZaak was demonstrably up — uwsgi had been serving for ~2 minutes — yet
`curl`/`urllib` to `localhost:8000` from the runner were refused the whole time.
**Why** — the same sibling-container split as §1. Compose starts the stack via the
host daemon, so `ports: ["8000:8000"]` publishes to the *daemon host*, not to the job
container. From the runner, `localhost:8000` has nothing listening. (`make smoke`
sidesteps this by polling readiness via `docker inspect` (§2), never a service port.)
**Fix** — don't talk to service ports from the runner. Either check state via `docker
inspect` (health), or run the client **inside the compose network** so it reaches the
service by name (`http://openzaak:8000`). For a test/seed that needs the repo's own
code, deliver it via a **built image** (not a bind mount — §1), then
`docker run --network <stack>_cg …`.
**Status** — `make integration` (the ACL ↔ real-OpenZaak test, ADR-0006) therefore
runs locally / on a host-executing runner only. Gating it on the hosted runner via
the compose network is tracked in **#55**.