esh-pfi-infrastructure/persistent-memory.d/2026-08-05-ci-flip-parked.md

• [2026-08-05] Fleet CI resilience — DEFAULT_ACTIONS_URL=self flip ATTEMPTED end-to-end, PARKED on a runner-auth blocker. Infra-ops to research the runner action-fetch auth, later (operator-directed 2026-08-05, deferred — not now; untracked, no issue).

Goal (worldtree-dev's operator-directed filing, run-9189 evidence): every Gitea Actions job hard-depends on github.com at step zero — act_runner resolves bare uses: refs (checkout/cache/setup-uv/etc.) against github at job start. A GitHub blip froze a real deploy (run 9189, connection reset cloning actions/checkout). Fix = mirror the action repos into Gitea + point DEFAULT_ACTIONS_URL at self, so github can be down and fleet CI doesn't care.

What's DONE + staged (all reversible, still in place):

• Fleet uses: audit (scripts in /tmp/claude-1000/gitea_uses_audit.py, run via ana-docker localhost API): 71 repos, 23 with workflows, but the raw ~42 action count is almost all dormant vendored-OSS mirrors (0 Action runs). The actually-running CI repos (Worldtree/arbo/althing/skaldsong/asset-engine/vor/task-board/nevermore/mead-hall/soong-lab) use just 7 action repos.
• 7 mirrors created + populated + public under gitea orgs actions + astral-sh: checkout, cache, upload-artifact, download-artifact, setup-node, setup-python, astral-sh/setup-uv. All in-use tags verified present (checkout@v4/v6, cache@v4, up/download-artifact@v3, setup-node@v4, setup-python@v5, setup-uv@v3/v5/v7). Actions DISABLED on all 7 (they're source mirrors; don't want their own CI). Repos are PUBLIC.
• Gitea = 1.26.1, container gitea on ana-docker; runner = gitea-runner (act_runner v0.6.0), label pfi-fleet, jobs run in a container:.

Mirror-creation FOOT-GUN (paid for): gitea's migrate-from-github is flaky — migrations ran 227–531s then 422'd, leaving broken empty repos (only cache synced). And github throttles ana-docker's colo IP after a clone burst (same pattern as the original github dependency). The reliable method: plain git clone --mirror on nh3-dev (residential egress) + push to gitea via git-SSH ssh://git@10.250.50.70:222 (auths as vh from nh3-dev). That populated the last 3 cleanly. Use that, not the gitea migrate API, to (re)build mirrors.

THE BLOCKER (why it's parked): with DEFAULT_ACTIONS_URL=self, the runner correctly resolves uses: actions/checkout@v4 → https://gitea.phasefinal.com/actions/checkout (confirmed in the runner log + the decompressed job log at /data/gitea/actions_log/vh/<repo>/*.log.zst — zstd, decompress on the ana-docker HOST, not in the gitea container which lacks zstd). But the fetch fails on auth: authentication required: Invalid username or token. Password authentication is not supported for Git operations. The runner is NOT fetching anonymously — it sends a credential gitea rejects. So REQUIRE_SIGNIN_VIEW=false did NOT fix it (that would only help an anonymous fetch; anon clone of the public mirror does work now). The real issue is how act_runner v0.6.0 authenticates its action-fetch to a gitea 1.26 instance — that's the research task.

Current CONFIG STATE (post-revert): DEFAULT_ACTIONS_URL is REMOVED from gitea app.ini → back to github default (CI works normally). REQUIRE_SIGNIN_VIEW = false was SET and KEPT (operator: "require_signin_view false on internal wg net") — now a standing change on the internal WG net (anon view of PUBLIC repos only; private repos stay auth-gated). app.ini backups on the box: /data/gitea/conf/app.ini.bak-* (signinflip / revert / actions).

Smoke method (for when re-attempting): create a throwaway vh/actions-smoke repo with a minimal runs-on: pfi-fleet + container: python:3.11.10-slim-bookworm + uses: actions/checkout@v4 + echo workflow (adding the workflow file triggers on: push); poll /repos/vh/actions-smoke/actions/tasks. ci.yml has NO workflow_dispatch and the run rerun API 404s on 1.26 — pushing a commit is the trigger. SUCCESS = the checkout step resolves from the local mirror.

NEXT STEP (my deferred task): research act_runner's action-fetch auth on gitea 1.26 (how it should authenticate; a runner config token, a gitea setting, or a version constraint). worldtree-dev (filer, runs gitea CI daily) offered as an alternative but operator directed infra-ops to do it. Everything's staged for a clean re-attempt once the auth path is understood; if dropped, tear down the actions/astral-sh orgs + 7 mirrors. Related: [[2026-08-03-worldtree-b168-384-385-arc]] (the gitea-CI stack context).