vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Hold a job's cache namespace while the job runs

a29ce1f76aaf7ebc4b24afad36c56a0f7f01254e · Keenan Nemetz · 3d ago · parent b492b557

Hold a job's cache namespace while the job runs

A namespace was only safe while one job existed per runner. Two runners
sharing a --dir already had the bug: the trimmer deletes whole namespaces
and `--no-cache` empties one, either of which can land on a tree another
process has mounted. A Go module cache that loses a file mid-build is a
checksum error deep in a build, which is the case the whole-namespace
eviction rule exists to avoid.

A job now holds its namespace for as long as the container may be inside
it — shared, so two builds of the same repository still run together —
and eviction takes the same lock with LOCK_NB and leaves what is in use
for a later pass. `--no-cache` takes the namespace exclusively, because
emptying it afterwards must not land on somebody else's build.

The runner also stops trimming at the end of each job: the cap is
enforced at startup and on a timer, so eviction no longer belongs to one
job's lifetime. Lock files live under <root>/.locks, mirroring the
namespace, so a cache tree holds namespaces and nothing else; they are
never deleted, for the reason gitcache's are not.

`vole workflow run` gets the same lock, so two local runs in one checkout
cannot delete each other's cache either.

Refs: 01M6SCWCSX39QXS38QAHQSMVGX (#216)

ci/cache/lock_unix.go +37

@@ -0,0 +1,37 @@
	1	//go:build unix
	2
	3	package cache
	4
	5	import (
	6	"os"
	7	"syscall"
	8	)
	9
	10	// lockFile takes the lock f names. A shared lock is what a job holds while it has
	11	// the namespace mounted; exclusive is what eviction takes. wait=false asks rather
	12	// than waits: the caller has other namespaces it can try.
	13	//
	14	// A signal can interrupt the wait and the lock is not held when it does, so the
	15	// call asks again rather than reporting a failure the caller cannot act on.
	16	func lockFile(f *os.File, exclusive, wait bool) (func(), bool, error) {
	17	how := syscall.LOCK_SH
	18	if exclusive {
	19	how = syscall.LOCK_EX
	20	}
	21	if !wait {
	22	how \|= syscall.LOCK_NB
	23	}
	24	for {
	25	err := syscall.Flock(int(f.Fd()), how)
	26	switch err {
	27	case nil:
	28	return func() { _ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN) }, true, nil
	29	case syscall.EINTR:
	30	continue
	31	case syscall.EWOULDBLOCK:
	32	return nil, false, nil
	33	default:
	34	return nil, false, err
	35	}
	36	}
	37	}