Two workflows have been red on every branch for days, for reasons unrelated to any code change. Diagnosed during the v0.2.3 release run; filing rather than patching blind.
selinux (rocky-9, fedora-latest) — red since Aug 23
checkmodule refuses the module:
colony_firewall.te:228: ERROR 'syntax error' at token 'files_runtime_filetrans' (line 5312)
The .te file has not changed since it was written. The refpolicy shipped in the current fedora-latest and rocky-9 container images no longer exposes the files_runtime_filetrans interface under that name — this is distro refpolicy drift, and the fix is to adapt the interface call (or gate it in an optional_policy / ifdef) against both refpolicy versions, tested in both containers.
vm kernel matrix (all 5 entries) — red since Aug 25
Every entry fails at "Fetch the kernel" (docker create + docker cp /boot/vmlinuz), exit 1 within ~1s of the pull starting. The pull itself begins (layers reach "Verifying Checksum"), so the pinned digests still exist in ghcr. Suspects, unconfirmed:
- cilium/ci-kernels image layout change (vmlinuz no longer at
/boot/vmlinuz) — but the pinned-by-digest images should be immutable, so more likely:
- docker/runner-image behaviour change around pulling by digest, or
- the interleaved log streams are hiding the real error; re-run one entry with
set -x to get a clean line.
Note the job also references actions/download-artifact@d3f86a1… (an old v4 SHA) in at least one step while #6 bumped the workflow to 8.0.1 — worth unifying while in there.
Why it matters
Eight permanently red checks train everyone to merge through red — the v0.2.3 PRs were merged over them, correctly but uncomfortably. The port-53 preflight half is already fixed in #21; these two are what remains.
Two workflows have been red on every branch for days, for reasons unrelated to any code change. Diagnosed during the v0.2.3 release run; filing rather than patching blind.
selinux (rocky-9, fedora-latest) — red since Aug 23
checkmodulerefuses the module:The .te file has not changed since it was written. The refpolicy shipped in the current fedora-latest and rocky-9 container images no longer exposes the
files_runtime_filetransinterface under that name — this is distro refpolicy drift, and the fix is to adapt the interface call (or gate it in anoptional_policy/ifdef) against both refpolicy versions, tested in both containers.vm kernel matrix (all 5 entries) — red since Aug 25
Every entry fails at "Fetch the kernel" (
docker create+docker cp /boot/vmlinuz), exit 1 within ~1s of the pull starting. The pull itself begins (layers reach "Verifying Checksum"), so the pinned digests still exist in ghcr. Suspects, unconfirmed:/boot/vmlinuz) — but the pinned-by-digest images should be immutable, so more likely:set -xto get a clean line.Note the job also references
actions/download-artifact@d3f86a1…(an old v4 SHA) in at least one step while #6 bumped the workflow to 8.0.1 — worth unifying while in there.Why it matters
Eight permanently red checks train everyone to merge through red — the v0.2.3 PRs were merged over them, correctly but uncomfortably. The port-53 preflight half is already fixed in #21; these two are what remains.