ci(workflows): drive breakpoint via BREAKPOINT_ENDPOINT repo variable

Move both the gating signal and the rendezvous server address into a single `vars.BREAKPOINT_ENDPOINT` repository variable. Fork PRs do not see repository variables, so the if-condition evaluates to false and the step is skipped on forks. Internal PRs run the breakpoint against whatever endpoint is configured in the variable, which keeps the address out of the workflow source. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
ci(workflows): gate breakpoint step behind BREAKPOINT_ENABLED secret
2026-04-29 17:52:44 +02:00 · 2026-04-29 17:48:19 +02:00 · 2026-04-29 14:59:44 +02:00 · 2026-04-29 14:49:25 +02:00
1 changed files with 14 additions and 0 deletions
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@ -313,6 +313,20 @@ jobs:
          name: image-list
          path: /tmp/${{ env.SANDBOX_NAME }}/_out/images.txt

+      # ▸ Open an SSH breakpoint to the failing sandbox so maintainers can attach
+      #   to the live runner, inspect Talos/Cozystack state and resume with
+      #   `breakpoint resume`. Times out after 30m.
+      #   Configured via the BREAKPOINT_ENDPOINT repository variable — in fork
+      #   PRs repository variables are not exposed, so the step is skipped and
+      #   forks cannot reach the self-hosted rendezvous server.
+      - name: Breakpoint on E2E failure
+        if: failure() && vars.BREAKPOINT_ENDPOINT != ''
+        uses: namespacelabs/breakpoint-action@v0
+        with:
+          duration: 30m
+          endpoint: ${{ vars.BREAKPOINT_ENDPOINT }}
+          authorized-users: kvaps, gecube, kingdonb, lllamnyp, aobort, tym83, klinch0, nbykov0, matthieu-robin, mattia-eleuteri
+
      # ▸ Tear down environment (always runs)
      - name: Tear down sandbox
        if: always()
Author	SHA1	Message	Date
Andrei Kvapil	74c102ee71	ci(workflows): drive breakpoint via BREAKPOINT_ENDPOINT repo variable Move both the gating signal and the rendezvous server address into a single `vars.BREAKPOINT_ENDPOINT` repository variable. Fork PRs do not see repository variables, so the if-condition evaluates to false and the step is skipped on forks. Internal PRs run the breakpoint against whatever endpoint is configured in the variable, which keeps the address out of the workflow source. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2026-04-29 17:52:44 +02:00
Andrei Kvapil	fc51970452	ci(workflows): gate breakpoint step behind BREAKPOINT_ENABLED secret Fork PRs do not receive repository secrets, so referencing secrets.BREAKPOINT_ENABLED in the step env makes the if condition evaluate to false on forks and the step is skipped. Internal PRs keep the breakpoint behavior. This prevents fork PR runs from exposing the self-hosted rendezvous server endpoint. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2026-04-29 17:48:19 +02:00
Andrei Kvapil	39d8ed90dc	ci(workflows): always open breakpoint on E2E failure Drop the `debug` label gating — open the SSH breakpoint on every E2E failure, not only debug-labeled PRs. Maintainers can release the sandbox immediately with `breakpoint resume` if they don't need it. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2026-04-29 14:59:44 +02:00
Andrei Kvapil	d08ff8209f	ci(workflows): open SSH breakpoint on E2E failure for debug-labeled PRs When a PR carries the `debug` label and the E2E job fails, pause the workflow and expose an SSH endpoint via the self-hosted breakpoint rendezvous server. Maintainers can attach to the live sandbox to inspect Talos and Cozystack state before teardown. Inspired by squat/kilo's CI setup. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Andrei Kvapil <kvapss@gmail.com>	2026-04-29 14:49:25 +02:00