Fix local CI run#2
Closed
jvd10 wants to merge 1 commit into
Closed
Conversation
…ation failures
This commit groups local CI stability fixes discovered while running make ci on macOS/arm64 and in environments without host-side Vault CLI tools.
Changes included:
1) scripts/up.sh
- Gate the ipmi profile on actual image availability.
- If SBX_IPMI_SIM_IMAGE is neither present locally nor pullable, continue without COMPOSE_PROFILES=ipmi instead of failing up/ci.
- Emit heartbeat + stderr warning to make the fallback explicit.
2) fixtures/vault-seed.sh
- Remove dependency on a host-installed vault binary.
- Add a shell function that executes vault commands inside sandbox-vault via docker exec, forwarding VAULT_ADDR and VAULT_TOKEN.
- Keeps seeding self-contained and consistent with the running stack.
3) tests/bats/cli-smoke.bats
- Same portability fix as seed script: run vault commands inside sandbox-vault instead of requiring host vault CLI.
- Eliminates command-not-found failures in bats smoke tests on fresh machines.
4) compose/bmc-sim.yaml
- Escape HOSTNAME in the openssl subject from to 18386{HOSTNAME}.
- Prevents docker compose host-side interpolation warning and preserves container runtime expansion.
5) compose/core.yaml
- power-control: set platform: linux/amd64 to avoid manifest/platform resolution failures on arm64 hosts.
- fru-tracker: tune sqlite DSN with _busy_timeout=5000 and _journal_mode=WAL to reduce write-lock contention during reconcile-heavy UC7 runs.
6) tests/integration/uc4_tokensmith_smd_test.go
- Add jwt.WithLeeway(30*time.Second) to token parsing.
- Reduces false negatives caused by minor clock skew where freshly minted tokens can briefly appear 'not valid yet'.
Net effect:
- Sandbox startup is more resilient when optional/local images are missing.
- Vault seed + bats smoke no longer require host vault installation.
- Compose warning noise is removed.
- UC4 claim validation is less flaky across hosts.
- Host architecture and sqlite contention edge cases are handled better for local CI iteration.
Signed-off-by: jvd10 <jay.depasse@hpe.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR hardens local CI reliability for the integration sandbox, especially on macOS/arm64 and environments without host Vault tooling.
Summary of changes:
Made startup resilient when the optional IPMI simulator image is unavailable by conditionally enabling the ipmi profile and warning instead of failing.
Removed host Vault CLI dependency in both fixture seeding and Bats smoke tests by executing Vault commands inside the sandbox-vault container.
Fixed docker-compose interpolation warning in bmc-sim TLS cert generation by escaping HOSTNAME correctly for container-time expansion.
Added linux/amd64 platform pin for power-control to avoid architecture pull/runtime issues on arm64 hosts.
Tuned fru-tracker SQLite connection settings with busy timeout and WAL mode to reduce lock contention during reconcile-heavy runs.
Reduced UC4 JWT timing flake by adding parser leeway in the integration test.
Motivation/context:
Local make ci runs were failing due to environment sensitivity (missing optional image, missing host Vault CLI, arm64 image/platform friction, and test timing/database contention edge cases).
These changes improve portability and reduce flaky failures during local verification.