Claude Fable 5
a35f7135bf
All checks were successful
CD / Build and push images (push) Successful in 1m7s
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m17s
CD / Promote to Int (push) Successful in 11s
CI / Lint, typecheck, test (push) Successful in 4m9s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 5m38s
CI / Import/export fidelity gate (push) Successful in 48s
Restore drill / Restore the latest backup into a scratch stack (push) Successful in 21s
The runner on ONE holds dorfteich-prod_backups; since go-live the drill that proves a backup restores should target the live instance, not Test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
67 lines
2.8 KiB
YAML
67 lines
2.8 KiB
YAML
# Monthly restore drill (ADR 0015, issue #87): restores the latest backup
|
|
# set of the drilled stage into a scratch environment on the runner's Docker
|
|
# daemon (the stage host), verifies it, and logs the outcome as a comment on
|
|
# the pinned "Restore drills" issue. Since go-live (2026-07-12, #89) the
|
|
# drilled stage is Prod; the runner on ONE holds the dorfteich-prod_backups
|
|
# volume. TAG stays `test` on purpose: it only selects the drill-harness
|
|
# images (backup + api) that perform and verify the restore, and a forward
|
|
# schema restores a Prod set fine — it is not a claim about the Prod release.
|
|
|
|
name: Restore drill
|
|
|
|
on:
|
|
schedule:
|
|
# 04:17 UTC on the 1st — after the 03:00 stage-local nightly backups.
|
|
- cron: '17 4 1 * *'
|
|
# On demand: push a `drill-<anything>` tag (`git tag drill-$(date +%s) &&
|
|
# git push origin --tags`). Gitea 1.22 cannot dispatch workflows via API
|
|
# or UI (that arrives in 1.23 — then add workflow_dispatch here).
|
|
push:
|
|
tags: ['drill-*']
|
|
|
|
env:
|
|
IMAGE_BASE: gitea.101010.cloud/stwaidele/dorfteich
|
|
DRILL_SOURCE_VOLUME: dorfteich-prod_backups
|
|
DRILL_LOG_ISSUE: '98'
|
|
|
|
jobs:
|
|
drill:
|
|
name: Restore the latest backup into a scratch stack
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Log in to the Gitea registry
|
|
run: printf '%s' "${{ secrets.REGISTRY_TOKEN }}" | tr -d '[:space:]' | docker login gitea.101010.cloud -u fable-5 --password-stdin
|
|
|
|
- name: Run the drill
|
|
id: drill
|
|
run: |
|
|
set -o pipefail
|
|
SOURCE_VOLUME=$DRILL_SOURCE_VOLUME IMAGE_BASE=$IMAGE_BASE TAG=test \
|
|
sh deploy/backup/drill.sh 2>&1 | tee drill.log
|
|
|
|
- name: Report the outcome on the drill log issue
|
|
if: always()
|
|
run: |
|
|
OUTCOME="${{ steps.drill.outcome }}"
|
|
{
|
|
printf '**Restore drill %s** — source `%s`, run %s\n\n```\n' \
|
|
"$OUTCOME" "$DRILL_SOURCE_VOLUME" "${{ github.run_number }}"
|
|
tail -c 3000 drill.log 2>/dev/null || echo 'drill produced no log output'
|
|
printf '```\n'
|
|
} > comment.md
|
|
# JSON-encode via a node container — the runner image guarantees
|
|
# only git/curl/docker, not python or node.
|
|
docker run --rm -i node:22.15-alpine node -e \
|
|
'const fs=require("fs");process.stdout.write(JSON.stringify({body:fs.readFileSync(0,"utf8")}))' \
|
|
< comment.md > comment.json
|
|
curl -sf -X POST \
|
|
-H "Authorization: token ${{ github.token }}" \
|
|
-H 'Content-Type: application/json' \
|
|
--data @comment.json \
|
|
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/issues/$DRILL_LOG_ISSUE/comments" \
|
|
> /dev/null && echo "reported to issue #$DRILL_LOG_ISSUE"
|