vendel.xi2ix.com/xi2ix.com-website
1
0
Fork 0
Code Issues 9 Pull requests Projects Releases Packages Wiki Activity Actions

CI failure: ci.yaml / gates #8

New issue
Closed
opened 2026-07-16 16:15:46 +00:00 by vendel.xi2ix.com · 2 comments
vendel.xi2ix.com commented 2026-07-16 16:15:46 +00:00
Owner
Copy link

Workflow: ci.yaml
Job: gates
Run: https://forgejo.lab.xi2ix.de/vendel.xi2ix.com/xi2ix.com-website/actions/runs/147
Commit: 352a6d188b
Branch/ref: main
Triggered by: vendel.xi2ix.com

Captured output (tail, per failing-eligible step)

/tmp/gsd-failhook-ci-gates-go-test.log

go: downloading golang.org/x/text v0.38.0
go: downloading github.com/joho/godotenv v1.5.1
go: downloading github.com/stretchr/testify v1.11.1
go: downloading github.com/caarlos0/env/v11 v11.4.1
go: downloading golang.org/x/crypto v0.53.0
go: downloading github.com/jackc/pgx/v5 v5.10.0
go: downloading github.com/pgvector/pgvector-go/pgx v0.4.0
go: downloading github.com/pressly/goose/v3 v3.27.1
go: downloading github.com/pgvector/pgvector-go v0.4.0
go: downloading github.com/BurntSushi/toml v1.6.0
go: downloading github.com/wneessen/go-mail v0.7.3
go: downloading github.com/nicksnyder/go-i18n/v2 v2.6.1
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/go-playground/validator/v10 v10.30.3
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/microcosm-cc/bluemonday v1.0.27
go: downloading github.com/a-h/templ v0.3.1020
go: downloading github.com/yuin/goldmark v1.8.2
go: downloading github.com/testcontainers/testcontainers-go v0.42.0
go: downloading github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
go: downloading github.com/x448/float16 v0.8.4
go: downloading github.com/sethvargo/go-retry v0.3.0
go: downloading go.uber.org/multierr v1.11.0
go: downloading github.com/davecgh/go-spew v1.1.1
go: downloading github.com/pmezard/go-difflib v1.0.0
go: downloading github.com/jackc/puddle/v2 v2.2.2
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761
go: downloading github.com/aymerick/douceur v0.2.0
go: downloading golang.org/x/net v0.55.0
go: downloading github.com/gabriel-vasile/mimetype v1.4.13
go: downloading github.com/go-playground/universal-translator v0.18.1
go: downloading github.com/leodido/go-urn v1.4.0
go: downloading github.com/mfridman/interpolate v0.0.2
go: downloading golang.org/x/sync v0.21.0
go: downloading github.com/gorilla/css v1.0.1
go: downloading dario.cat/mergo v1.0.2
go: downloading github.com/cenkalti/backoff/v4 v4.3.0
go: downloading github.com/containerd/errdefs v1.0.0
go: downloading github.com/containerd/platforms v0.2.1
go: downloading github.com/cpuguy83/dockercfg v0.3.2
go: downloading github.com/moby/go-archive v0.2.0
go: downloading github.com/moby/moby/api v1.54.2
go: downloading github.com/moby/moby/client v0.4.1
go: downloading github.com/moby/patternmatcher v0.6.1
go: downloading github.com/opencontainers/image-spec v1.1.1
go: downloading github.com/go-playground/locales v0.14.1
go: downloading golang.org/x/sys v0.46.0
go: downloading github.com/containerd/log v0.1.0
go: downloading github.com/moby/sys/sequential v0.6.0
go: downloading github.com/moby/sys/userns v0.1.0
go: downloading github.com/moby/sys/user v0.4.0
go: downloading github.com/containerd/errdefs/pkg v0.3.0
go: downloading github.com/distribution/reference v0.6.0
go: downloading github.com/docker/go-connections v0.7.0
go: downloading github.com/opencontainers/go-digest v1.0.0
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0
go: downloading go.opentelemetry.io/otel/trace v1.43.0
go: downloading github.com/docker/go-units v0.5.0
go: downloading github.com/moby/term v0.5.2
go: downloading github.com/magiconair/properties v1.8.10
go: downloading github.com/shirou/gopsutil/v4 v4.26.3
go: downloading github.com/moby/docker-image-spec v1.3.1
go: downloading github.com/klauspost/compress v1.18.5
go: downloading github.com/sirupsen/logrus v1.9.4
go: downloading go.opentelemetry.io/otel v1.43.0
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading go.opentelemetry.io/otel/metric v1.43.0
go: downloading github.com/tklauser/go-sysconf v0.3.16
go: downloading github.com/go-logr/logr v1.4.3
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/tklauser/numcpus v0.11.0
?   	xi2ix.com/website	[no test files]
?   	xi2ix.com/website/assets	[no test files]
?   	xi2ix.com/website/cmd/ingest	[no test files]
?   	xi2ix.com/website/cmd/server	[no test files]
ok  	xi2ix.com/website/deploy/chart	0.015s
ok  	xi2ix.com/website/internal/admin	36.589s
ok  	xi2ix.com/website/internal/antispam	27.956s
?   	xi2ix.com/website/internal/brandterms	[no test files]
ok  	xi2ix.com/website/internal/config	0.014s
ok  	xi2ix.com/website/internal/contact	100.146s
ok  	xi2ix.com/website/internal/corpus	0.059s
ok  	xi2ix.com/website/internal/db	42.619s
?   	xi2ix.com/website/internal/db/sqlc	[no test files]
ok  	xi2ix.com/website/internal/email	13.569s
ok  	xi2ix.com/website/internal/i18n	0.344s
ok  	xi2ix.com/website/internal/ix	2.528s
ok  	xi2ix.com/website/internal/ix/eval	0.009s
ok  	xi2ix.com/website/internal/ollama	1.047s
ok  	xi2ix.com/website/internal/pages	0.446s
ok  	xi2ix.com/website/internal/repo	105.465s
ok  	xi2ix.com/website/internal/routes	0.005s
ok  	xi2ix.com/website/internal/server	25.976s
?   	xi2ix.com/website/internal/testsupport	[no test files]
ok  	xi2ix.com/website/internal/views	0.527s

/tmp/gsd-failhook-ci-gates-lhci.log

Discovered job container (d0a933a933b2) network: FORGEJO-ACTIONS-TASK-1883_WORKFLOW-ci_JOB-gates-gates-network
c88e652e228b0aebfd965fbba047548711f15db1e109920cb326f042de7210e0
psql: error: connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed: No such file or directory
	Is the server running locally and accepting connections on that socket?

/tmp/gsd-failhook-ci-gates-xss-ssti.log

==> [D-06] XSS/SSTI static scan over internal/views (templ auto-escape contract)
    OK: no templ.Raw / template.HTML / templ.SafeURL on any render path.
==> [D-06] forbidden brand-term scan (reusing internal/brandterms via i18n gate)
ok  	xi2ix.com/website/internal/i18n	0.090s
==> RESULT: PASS — D-06 XSS/SSTI + forbidden-term gate clean.
**Workflow:** ci.yaml **Job:** gates **Run:** https://forgejo.lab.xi2ix.de/vendel.xi2ix.com/xi2ix.com-website/actions/runs/147 **Commit:** 352a6d188b011485b5304d9647e9646447fa5f06 **Branch/ref:** main **Triggered by:** vendel.xi2ix.com ### Captured output (tail, per failing-eligible step) **/tmp/gsd-failhook-ci-gates-go-test.log** ``` go: downloading golang.org/x/text v0.38.0 go: downloading github.com/joho/godotenv v1.5.1 go: downloading github.com/stretchr/testify v1.11.1 go: downloading github.com/caarlos0/env/v11 v11.4.1 go: downloading golang.org/x/crypto v0.53.0 go: downloading github.com/jackc/pgx/v5 v5.10.0 go: downloading github.com/pgvector/pgvector-go/pgx v0.4.0 go: downloading github.com/pressly/goose/v3 v3.27.1 go: downloading github.com/pgvector/pgvector-go v0.4.0 go: downloading github.com/BurntSushi/toml v1.6.0 go: downloading github.com/wneessen/go-mail v0.7.3 go: downloading github.com/nicksnyder/go-i18n/v2 v2.6.1 go: downloading gopkg.in/yaml.v3 v3.0.1 go: downloading github.com/go-playground/validator/v10 v10.30.3 go: downloading github.com/google/uuid v1.6.0 go: downloading github.com/microcosm-cc/bluemonday v1.0.27 go: downloading github.com/a-h/templ v0.3.1020 go: downloading github.com/yuin/goldmark v1.8.2 go: downloading github.com/testcontainers/testcontainers-go v0.42.0 go: downloading github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0 go: downloading github.com/x448/float16 v0.8.4 go: downloading github.com/sethvargo/go-retry v0.3.0 go: downloading go.uber.org/multierr v1.11.0 go: downloading github.com/davecgh/go-spew v1.1.1 go: downloading github.com/pmezard/go-difflib v1.0.0 go: downloading github.com/jackc/puddle/v2 v2.2.2 go: downloading github.com/jackc/pgpassfile v1.0.0 go: downloading github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 go: downloading github.com/aymerick/douceur v0.2.0 go: downloading golang.org/x/net v0.55.0 go: downloading github.com/gabriel-vasile/mimetype v1.4.13 go: downloading github.com/go-playground/universal-translator v0.18.1 go: downloading github.com/leodido/go-urn v1.4.0 go: downloading github.com/mfridman/interpolate v0.0.2 go: downloading golang.org/x/sync v0.21.0 go: downloading github.com/gorilla/css v1.0.1 go: downloading dario.cat/mergo v1.0.2 go: downloading github.com/cenkalti/backoff/v4 v4.3.0 go: downloading github.com/containerd/errdefs v1.0.0 go: downloading github.com/containerd/platforms v0.2.1 go: downloading github.com/cpuguy83/dockercfg v0.3.2 go: downloading github.com/moby/go-archive v0.2.0 go: downloading github.com/moby/moby/api v1.54.2 go: downloading github.com/moby/moby/client v0.4.1 go: downloading github.com/moby/patternmatcher v0.6.1 go: downloading github.com/opencontainers/image-spec v1.1.1 go: downloading github.com/go-playground/locales v0.14.1 go: downloading golang.org/x/sys v0.46.0 go: downloading github.com/containerd/log v0.1.0 go: downloading github.com/moby/sys/sequential v0.6.0 go: downloading github.com/moby/sys/userns v0.1.0 go: downloading github.com/moby/sys/user v0.4.0 go: downloading github.com/containerd/errdefs/pkg v0.3.0 go: downloading github.com/distribution/reference v0.6.0 go: downloading github.com/docker/go-connections v0.7.0 go: downloading github.com/opencontainers/go-digest v1.0.0 go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 go: downloading go.opentelemetry.io/otel/trace v1.43.0 go: downloading github.com/docker/go-units v0.5.0 go: downloading github.com/moby/term v0.5.2 go: downloading github.com/magiconair/properties v1.8.10 go: downloading github.com/shirou/gopsutil/v4 v4.26.3 go: downloading github.com/moby/docker-image-spec v1.3.1 go: downloading github.com/klauspost/compress v1.18.5 go: downloading github.com/sirupsen/logrus v1.9.4 go: downloading go.opentelemetry.io/otel v1.43.0 go: downloading github.com/felixge/httpsnoop v1.0.4 go: downloading go.opentelemetry.io/otel/metric v1.43.0 go: downloading github.com/tklauser/go-sysconf v0.3.16 go: downloading github.com/go-logr/logr v1.4.3 go: downloading github.com/go-logr/stdr v1.2.2 go: downloading go.opentelemetry.io/auto/sdk v1.2.1 go: downloading github.com/cespare/xxhash/v2 v2.3.0 go: downloading github.com/tklauser/numcpus v0.11.0 ? xi2ix.com/website [no test files] ? xi2ix.com/website/assets [no test files] ? xi2ix.com/website/cmd/ingest [no test files] ? xi2ix.com/website/cmd/server [no test files] ok xi2ix.com/website/deploy/chart 0.015s ok xi2ix.com/website/internal/admin 36.589s ok xi2ix.com/website/internal/antispam 27.956s ? xi2ix.com/website/internal/brandterms [no test files] ok xi2ix.com/website/internal/config 0.014s ok xi2ix.com/website/internal/contact 100.146s ok xi2ix.com/website/internal/corpus 0.059s ok xi2ix.com/website/internal/db 42.619s ? xi2ix.com/website/internal/db/sqlc [no test files] ok xi2ix.com/website/internal/email 13.569s ok xi2ix.com/website/internal/i18n 0.344s ok xi2ix.com/website/internal/ix 2.528s ok xi2ix.com/website/internal/ix/eval 0.009s ok xi2ix.com/website/internal/ollama 1.047s ok xi2ix.com/website/internal/pages 0.446s ok xi2ix.com/website/internal/repo 105.465s ok xi2ix.com/website/internal/routes 0.005s ok xi2ix.com/website/internal/server 25.976s ? xi2ix.com/website/internal/testsupport [no test files] ok xi2ix.com/website/internal/views 0.527s ``` **/tmp/gsd-failhook-ci-gates-lhci.log** ``` Discovered job container (d0a933a933b2) network: FORGEJO-ACTIONS-TASK-1883_WORKFLOW-ci_JOB-gates-gates-network c88e652e228b0aebfd965fbba047548711f15db1e109920cb326f042de7210e0 psql: error: connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed: No such file or directory Is the server running locally and accepting connections on that socket? ``` **/tmp/gsd-failhook-ci-gates-xss-ssti.log** ``` ==> [D-06] XSS/SSTI static scan over internal/views (templ auto-escape contract) OK: no templ.Raw / template.HTML / templ.SafeURL on any render path. ==> [D-06] forbidden brand-term scan (reusing internal/brandterms via i18n gate) ok xi2ix.com/website/internal/i18n 0.090s ==> RESULT: PASS — D-06 XSS/SSTI + forbidden-term gate clean. ```
vendel.xi2ix.com commented 2026-07-16 22:22:40 +00:00
Author
Owner
Copy link

Root Cause gefunden + Fix gepusht (Commit 8eb7b7d) — bekanntes Docker-Postgres-Muster, nicht neu erfunden.

Recherche bestätigt: das offizielle postgres-Docker-Image startet beim ersten Boot eine TEMPORÄRE Instanz mit listen_addresses='' (nur Unix-Socket) um /docker-entrypoint-initdb.d/* auszuführen, fährt sie dann herunter und startet die echte, langlaufende Instanz. Unser pg_isready -U postgres (ohne -h) nutzt standardmäßig den Unix-Socket — der ist während der TEMPORÄREN Phase bereits erreichbar, der Check kann also fälschlich grün werden, während der direkt folgende psql-Bootstrap-Exec dann in den Neustart der temporären Instanz reinläuft ("No such file or directory" / "database system is shutting down"). Exakt dasselbe Muster wurde schon anderswo gemeldet und gefixt (z. B. security-onion-solutions/securityonion#15788) — Fix dort wie hier: -h 127.0.0.1 erzwingen, damit der Check erst grün wird, wenn die ECHTE Instanz wirklich auf TCP lauscht (die temporäre bindet gar kein TCP-Interface).

Angewendet auf beide Stellen (pg_isready + psql-Bootstrap-Exec) in ci.yaml. Test läuft im Rahmen unserer aktuellen 10-Zyklen-Serie (Betreiber-Auftrag: 10 grüne CI/CD-Durchläufe in Folge erreichen).

**Root Cause gefunden + Fix gepusht (Commit `8eb7b7d`) — bekanntes Docker-Postgres-Muster, nicht neu erfunden.** Recherche bestätigt: das offizielle `postgres`-Docker-Image startet beim ersten Boot eine TEMPORÄRE Instanz mit `listen_addresses=''` (nur Unix-Socket) um `/docker-entrypoint-initdb.d/*` auszuführen, fährt sie dann herunter und startet die echte, langlaufende Instanz. Unser `pg_isready -U postgres` (ohne `-h`) nutzt standardmäßig den Unix-Socket — der ist während der TEMPORÄREN Phase bereits erreichbar, der Check kann also fälschlich grün werden, während der direkt folgende `psql`-Bootstrap-Exec dann in den Neustart der temporären Instanz reinläuft ("No such file or directory" / "database system is shutting down"). Exakt dasselbe Muster wurde schon anderswo gemeldet und gefixt (z. B. security-onion-solutions/securityonion#15788) — Fix dort wie hier: `-h 127.0.0.1` erzwingen, damit der Check erst grün wird, wenn die ECHTE Instanz wirklich auf TCP lauscht (die temporäre bindet gar kein TCP-Interface). Angewendet auf beide Stellen (`pg_isready` + `psql`-Bootstrap-Exec) in `ci.yaml`. Test läuft im Rahmen unserer aktuellen 10-Zyklen-Serie (Betreiber-Auftrag: 10 grüne CI/CD-Durchläufe in Folge erreichen).
vendel.xi2ix.com commented 2026-07-16 22:32:21 +00:00
Author
Owner
Copy link

Bestätigt: Run 149 (commit 8eb7b7d) lief sauber durch, kein psql-Socket-Fehler mehr. Fix hält. Schließe das Issue.

Bestätigt: Run 149 (commit 8eb7b7d) lief sauber durch, kein psql-Socket-Fehler mehr. Fix hält. Schließe das Issue.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
plan/phase-06-grounded-ai-conversation
fix/ci-runner-dedicated-dind
No results found.
Labels
Clear labels   
ci-failure:ci.yaml-gates

Automated CI/CD failure-dedup label (gsd 260708-g89)

  
ci-failure:deploy.yaml-build-push-deploy

Automated CI/CD failure-dedup label (gsd 260708-g89)

  
rollback-drill

Scheduled/manual rollback-drill result -- NEVER a real production incident report (gsd 260721-gwo)

  
rollback-fired:drill

A helm rollback fired at the prod-smoke failure threshold — emitted by scripts/rollback-streak.sh (gsd 260727-nvm)

  
rollback-fired:production

A REAL 3-strike production rollback fired (NOT a drill) — emitted by scripts/rollback-streak.sh at the moment of firing

No labels
ci-failure:ci.yaml-gates
ci-failure:deploy.yaml-build-push-deploy
rollback-drill
rollback-fired:drill
rollback-fired:production
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
vendel.xi2ix.com/xi2ix.com-website#8
No description provided.