Skip the appliance test only on 404, and stop forcing IPv6 on the probe #4

Merged

marcos-mendez merged 1 commit from fix/appliance-skip-only-on-404 into main

2026-09-26 17:58:46 -03:00

marcos-mendez commented

2026-09-26 17:57:43 -03:00

(Migrated from github.com)

Rehearsing the job on keel-lxc-1 from a clean clone of keel-core master
showed the skip swallowing a failure:

keel commit 7227530
curl: (6) Could not resolve host: mirror.keellinux.org
SKIP: not published

Two faults in one step.

The skip was too generous. The probe was curl -6 -fsS and anything other
than success meant "not published yet", so an unreachable mirror produced a
green check that had tested nothing, which is the opposite of what a gate is
for. It now reads the HTTP status: 200 runs the test, 404 skips with the notice
and the summary section, and everything else, a transport failure included,
fails the job with the status or the curl exit code in the message. Two retries
cover a transient hiccup.

Forcing IPv6 broke the probe on the only runner there is. The mirror is
served by the same VM the runner runs on, and that VM resolves its own public
names to itself (resolvectl query mirror.keellinux.org answers 127.0.1.1,
Data from: synthetic), so there is no AAAA record to force and curl -6
could not resolve the name at all. keel pull never forced a family, which is
why it worked throughout; the resolver picks, and wherever the name has an AAAA
record the transfer goes over IPv6. On this runner the request does not leave
the machine, which is better than either family.

Test plan:

Rehearsed again on keel-lxc-1 after the change: the probe answers 200,
the parent check passes, and the boot test runs.
Merge, then the next appliance / build-and-boot run.

Rehearsing the job on `keel-lxc-1` from a clean clone of keel-core `master` showed the skip swallowing a failure: keel commit 7227530 curl: (6) Could not resolve host: mirror.keellinux.org SKIP: not published Two faults in one step. **The skip was too generous.** The probe was `curl -6 -fsS` and anything other than success meant "not published yet", so an unreachable mirror produced a green check that had tested nothing, which is the opposite of what a gate is for. It now reads the HTTP status: 200 runs the test, 404 skips with the notice and the summary section, and everything else, a transport failure included, fails the job with the status or the curl exit code in the message. Two retries cover a transient hiccup. **Forcing IPv6 broke the probe on the only runner there is.** The mirror is served by the same VM the runner runs on, and that VM resolves its own public names to itself (`resolvectl query mirror.keellinux.org` answers `127.0.1.1`, `Data from: synthetic`), so there is no AAAA record to force and `curl -6` could not resolve the name at all. `keel pull` never forced a family, which is why it worked throughout; the resolver picks, and wherever the name has an AAAA record the transfer goes over IPv6. On this runner the request does not leave the machine, which is better than either family. Test plan: - [x] Rehearsed again on `keel-lxc-1` after the change: the probe answers 200, the parent check passes, and the boot test runs. - [ ] Merge, then the next `appliance / build-and-boot` run.