ci: reach the rabbitmq service by network alias instead of a host port #4

Merged

nsaspy merged 3 commits from fix/rabbitmq-service-host-port-collision into master 2026-09-07 05:43:07 +00:00

Conversation 0 Commits 3 Files changed 3 +54 -69

nsaspy commented 2026-09-07 04:20:43 +00:00

Owner

Copy link

Fixes the runner failure on task 1980 (and 1981-1983):

failed to start container: ... Bind for 0.0.0.0:5672 failed: port is already allocated

Root cause

The rabbitmq-routing service declared ports: [5672:5672], which publishes 0.0.0.0:5672 on the shared runner host (source-build, runner a445892c, capacity 20). The push run and the PR run of the same commit execute concurrently (different concurrency groups), so the second job's service container creation collides on the host port and the job dies before any step runs. rabbitmq-routing has never passed on this runner for this reason.

Fix

• Drop the ports mapping: the service container joins the job's Docker network with DNS alias rabbitmq (verified by live docker inspect on the runner host: both job and service on starintel-actions, service alias rabbitmq, no port bindings). No host publishing → no cross-job collision.
• Job containers cannot reach the broker at 127.0.0.1 (separate network namespaces), so the integration tests read BBPD_TEST_RABBITMQ_HOST (default 127.0.0.1, preserving local/GitHub behavior) and the workflow overrides it to the service alias.

Verification

• All 4 integration tests pass locally against a network-reachable broker via BBPD_TEST_RABBITMQ_HOST
• Full unit suite passes unchanged (compileall, ruff, pytest)

Follow-up found while verifying

The python/determinism jobs also fail: they check out lost-rob0t/starintel-gpt-auto-dig, which does not exist on this forge (the schema repo lives at nsaspy/starintel-gpt-auto-dig). Worth a separate fix if those jobs should gate merges here.

Fixes the runner failure on task 1980 (and 1981-1983): failed to start container: ... Bind for 0.0.0.0:5672 failed: port is already allocated ## Root cause The `rabbitmq-routing` service declared `ports: [5672:5672]`, which publishes `0.0.0.0:5672` on the shared runner host (source-build, runner a445892c, capacity 20). The push run and the PR run of the same commit execute concurrently (different concurrency groups), so the second job's service container creation collides on the host port and the job dies before any step runs. `rabbitmq-routing` has never passed on this runner for this reason. ## Fix - Drop the `ports` mapping: the service container joins the job's Docker network with DNS alias `rabbitmq` (verified by live `docker inspect` on the runner host: both job and service on `starintel-actions`, service alias `rabbitmq`, no port bindings). No host publishing → no cross-job collision. - Job containers cannot reach the broker at `127.0.0.1` (separate network namespaces), so the integration tests read `BBPD_TEST_RABBITMQ_HOST` (default `127.0.0.1`, preserving local/GitHub behavior) and the workflow overrides it to the service alias. ## Verification - All 4 integration tests pass locally against a network-reachable broker via `BBPD_TEST_RABBITMQ_HOST` - Full unit suite passes unchanged (`compileall`, `ruff`, `pytest`) ## Follow-up found while verifying The `python`/`determinism` jobs also fail: they check out `lost-rob0t/starintel-gpt-auto-dig`, which does not exist on this forge (the schema repo lives at `nsaspy/starintel-gpt-auto-dig`). Worth a separate fix if those jobs should gate merges here.

nsaspy added 1 commit 2026-09-07 04:20:43 +00:00

ci: reach the rabbitmq service by network alias instead of a host port ... f6bd714403

The rabbitmq-routing job declared a 5672:5672 host port mapping. The
Forgejo runner host executes up to 20 jobs concurrently on one Docker
network, and the push and pull_request runs of the same commit race
there: the second job's service container fails to start with 'Bind for
0.0.0.0:5672 failed: port is already allocated' (tasks 1980-1983).

The service container already joins the job's Docker network with the
DNS alias 'rabbitmq' (verified by live container inspection on the
runner host), so the host port mapping is unnecessary. Job containers
cannot reach the broker at 127.0.0.1 (separate network namespaces), so
the integration tests now read the broker host from
BBPD_TEST_RABBITMQ_HOST with the previous 127.0.0.1 behavior as the
default, and the workflow overrides it to the service alias.

All four integration tests pass locally against a network-reachable
broker via the override, and the full unit suite passes unchanged.

nsaspy added 1 commit 2026-09-07 04:23:21 +00:00

ci: check out the schema repo from an existing forge owner ... 61251b8e7c

lost-rob0t/starintel-gpt-auto-dig does not exist on git.starintel.actor;
the schema conformance source lives at nsaspy/starintel-gpt-auto-dig.
The failed checkout aborted the python, determinism, and rabbitmq-routing
jobs before their steps could run.

nsaspy added 1 commit 2026-09-07 05:36:08 +00:00

ci: drop unsupported artifact actions and unmapped install-nix-action ... 6946930589

Verified against the runner's job logs (read from the forge database):

- nix job: the runner clones actions from the forge's action alias, and
  cachix/install-nix-action is not mirrored there (actions/checkout is),
  so the job died at clone time in ~6s. Reference the action by full
  github URL instead. Reproduced the whole job locally in the runner
  image: install + nix flake check + nix build all pass.
- python 3.13 and determinism jobs: every real step passed (142 tests,
  79 conformance fixtures ok) and only actions/upload-artifact@v4
  failed: the GHES-restricted artifact v4 client refuses non-GitHub
  servers, so Forgejo cannot serve it. Drop the coverage upload and
  merge determinism + cross-version-determinism into one job that runs
  both Python versions and cmp's the two probes directly, preserving
  the byte-equivalence contract without artifacts.
- drop setup-python's cache: pip: the runner's advertised cache host
  times out from job containers, costing a fixed delay per job.

The quality gate now checks config-safety, python, determinism,
rabbitmq-routing, and nix.

nsaspy merged commit d9fdc766e1 into master 2026-09-07 05:43:07 +00:00

nsaspy referenced this pull request from a commit 2026-09-07 05:43:07 +00:00

Merge pull request 'ci: reach the rabbitmq service by network alias instead of a host port' (#4) from fix/rabbitmq-service-host-port-collision into master

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

nsaspy/star-bbpd!4

No description provided.