Toilville/forge-kv-cache
Watch
5
0
Fork
You've already forked forge-kv-cache
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(ci): work around read-only $HOME/.ssh and non-writable CARGO_HOME #3

Merged
peterswimm merged 2 commits from fix/ci-runner-permissions into main 2026-07-17 14:10:40 +00:00
Conversation 0 Commits 2 Files changed 1 +16 -10
peterswimm commented 2026-07-17 01:32:48 +00:00
Owner
Copy link

Every CI run on this repo has been failing silently since it was created — checked the real Forgejo action logs (via SSH to the forge host, not just local testing) and found two real infra issues:

  • linux (core): /home/runner/.ssh/known_hosts: Read-only file system, then failed to create directory /usr/local/cargo/git/db/...: Permission denied — the container's $HOME/.ssh is read-only and the default CARGO_HOME isn't writable.
  • macOS (mlx): the SSH-healing step itself exits non-zero for a reason not fully diagnosable from the log alone.

Fix: stop writing into $HOME/.ssh at all. Use GIT_SSH_COMMAND with UserKnownHostsFile pointed at /tmp (always writable) and StrictHostKeyChecking=accept-new. Redirect CARGO_HOME to /tmp on the linux job too.

Every CI run on this repo has been failing silently since it was created — checked the real Forgejo action logs (via SSH to the forge host, not just local testing) and found two real infra issues: - **linux (core)**: `/home/runner/.ssh/known_hosts: Read-only file system`, then `failed to create directory /usr/local/cargo/git/db/...: Permission denied` — the container's $HOME/.ssh is read-only and the default CARGO_HOME isn't writable. - **macOS (mlx)**: the SSH-healing step itself exits non-zero for a reason not fully diagnosable from the log alone. Fix: stop writing into $HOME/.ssh at all. Use `GIT_SSH_COMMAND` with `UserKnownHostsFile` pointed at /tmp (always writable) and `StrictHostKeyChecking=accept-new`. Redirect `CARGO_HOME` to /tmp on the linux job too.
fix(ci): work around read-only \$HOME/.ssh and non-writable CARGO_HOME on the linux runner
Some checks failed
CI / Core (default features, no MLX) (pull_request) Failing after 4s
Details
CI / lint-workflows (pull_request) Successful in 16s
Details
CI / MLX feature (macOS + Apple Silicon) (pull_request) Failing after 2s
Details
6528f24cd4 
Every CI run since this repo was created has been failing, unnoticed —
verified via the real Forgejo action logs, not just local testing:

- core (linux): /home/runner/.ssh/known_hosts: Read-only file system,
  then failed to create directory /usr/local/cargo/git/db/...:
  Permission denied. The linux self-hosted runner's container has a
  read-only $HOME/.ssh and non-writable default CARGO_HOME.
- mlx (macOS): the SSH-healing step itself exited non-zero for reasons
  not fully diagnosable from the log alone.

Fix: stop writing into $HOME/.ssh entirely. Use
GIT_SSH_COMMAND with UserKnownHostsFile pointed at /tmp (always
writable) and StrictHostKeyChecking=accept-new (trust-on-first-use,
same practical trust level as the old ssh-keyscan approach, without
needing to pre-seed known_hosts). Redirect CARGO_HOME to /tmp on the
linux job too, sidestepping the non-writable default.
fix(ci): force cargo to use system git CLI for SSH fetches
Some checks failed
CI / MLX feature (macOS + Apple Silicon) (pull_request) Failing after 2s
Details
CI / Core (default features, no MLX) (pull_request) Failing after 15s
Details
CI / lint-workflows (pull_request) Successful in 16s
Details
91c2cd8e3b 
Cargo's built-in libgit2 SSH transport has its own known-hosts store
(net.ssh.known-hosts in cargo config), completely separate from
OpenSSH's — it ignores GIT_SSH_COMMAND. CARGO_NET_GIT_FETCH_WITH_CLI
makes cargo shell out to the system git CLI instead, so our
known_hosts override actually takes effect for git-dependency fetches.
peterswimm deleted branch fix/ci-runner-permissions 2026-07-17 14:10:40 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Toilville/forge-kv-cache!3
No description provided.