pocketbase-bot: apply website metadata requests from Accept/Decline boxes

The website now posts each requested change as its own comment with the
command and two checkboxes. Ticking one edits the comment: Accept runs
the command as if a maintainer had typed it, Decline records the
refusal, and the issue closes once every change is decided. Only users
with write access can decide. app_vars is checked field by field before
it is saved.

.github/workflows/pocketbase-bot.yml

@@ -2,7 +2,7 @@ name: PocketBase Bot
 
 on:
   issue_comment:
-    types: [created]
+    types: [created, edited]
 
 permissions:
   issues: write
@@ -25,6 +25,9 @@ jobs:
           POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
           COMMENT_BODY: ${{ github.event.comment.body }}
           COMMENT_ID: ${{ github.event.comment.id }}
+          EVENT_ACTION: ${{ github.event.action }}
+          SENDER: ${{ github.event.sender.login }}
+          PREVIOUS_BODY: ${{ github.event.changes.body.from }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           IS_PR_COMMENT: ${{ github.event.issue.pull_request && 'true' || 'false' }}
           REPO_OWNER: ${{ github.repository_owner }}
@@ -87,7 +90,7 @@ jobs:
             const issueNumber = parseInt(process.env.ISSUE_NUMBER, 10);
             const isPrComment = process.env.IS_PR_COMMENT === 'true';
             const commentId = parseInt(process.env.COMMENT_ID, 10);
-            const actor = process.env.ACTOR;
+            let actor = process.env.ACTOR;
 
             function ghRequest(path, method, body) {
               const headers = {
@@ -278,7 +281,65 @@ jobs:
             // Accept /pocketbase at the start of ANY line (leading whitespace ok),
             // so the command works even when preceded by other text. Mid-sentence
             // mentions and blockquoted ("> ...") examples are ignored.
-            const commentBody = process.env.COMMENT_BODY || '';
+            let commentBody = process.env.COMMENT_BODY || '';
+
+            // ── Metadata requests from the website ─────────────────────────────
+            // One comment per requested change, each with Accept/Decline boxes.
+            // Ticking one edits the comment; that edit is the only event handled.
+            const REQUEST_MARKER = '<!-- pb-request -->';
+            const DONE_MARKER = '<!-- pb-request:done -->';
+            const isRequest = commentBody.includes(REQUEST_MARKER);
+            let decidedBy = null;
+            if (process.env.EVENT_ACTION === 'edited' && !isRequest) process.exit(0);
+            if (isRequest) {
+              if (process.env.EVENT_ACTION !== 'edited' || commentBody.includes(DONE_MARKER)) process.exit(0);
+              const ticked = (body, word) =>
+                new RegExp('^[ \\t]*[-*] \\[[xX]\\] ' + word + '[ \\t]*\\r?$', 'm').test(body);
+              const previous = process.env.PREVIOUS_BODY || '';
+              const accept = ticked(commentBody, 'Accept') && !ticked(previous, 'Accept');
+              const decline = ticked(commentBody, 'Decline') && !ticked(previous, 'Decline');
+              if (accept === decline) process.exit(0);
+
+              const sender = process.env.SENDER;
+              const permRes = await ghRequest(
+                '/repos/' + owner + '/' + repo + '/collaborators/' + encodeURIComponent(sender) + '/permission'
+              );
+              const level = permRes.ok ? JSON.parse(permRes.body).permission : 'none';
+              if (level !== 'admin' && level !== 'write') {
+                await postComment(
+                  '❌ **PocketBase Bot**: @' + sender + ' is not authorized to decide metadata requests.\n' +
+                  'Only maintainers with write access can accept or decline them.'
+                );
+                process.exit(0);
+              }
+
+              const heading = (commentBody.match(/^### (.+)$/m) || [])[1] || 'this change';
+              const command = commentBody.match(/<!-- pb-command -->\r?\n([\s\S]*?)\r?\n<!-- \/pb-command -->/);
+              const decided = commentBody
+                .replace(/^[ \t]*[-*] \[[ xX]\] (Accept|Decline)[ \t]*\r?\n?/gm, '')
+                .replace(
+                  REQUEST_MARKER,
+                  '**' + (accept ? '✅ Accepted' : '❌ Declined') + '** by @' + sender + '\n\n' +
+                  REQUEST_MARKER + '\n' + DONE_MARKER
+                );
+              const markRes = await ghRequest(
+                '/repos/' + owner + '/' + repo + '/issues/comments/' + commentId, 'PATCH', { body: decided }
+              );
+              if (!markRes.ok) console.warn('Could not mark the request as decided:', markRes.body);
+
+              if (decline) {
+                await postComment('❌ **PocketBase Bot**: **' + heading + '** declined by @' + sender + '.');
+                process.exit(0);
+              }
+              if (!command) {
+                await postComment('❌ **PocketBase Bot**: no command found in the request for **' + heading + '**.');
+                process.exit(0);
+              }
+              commentBody = command[1];
+              decidedBy = sender;
+              actor = sender;
+            }
+
             const cmdLine = commentBody
               .split('\n')
               .map(l => l.trim())
@@ -292,7 +353,7 @@ jobs:
 
             // ── Permission check ───────────────────────────────────────────────
             const association = process.env.ACTOR_ASSOCIATION;
-            if (association !== 'OWNER' && association !== 'MEMBER') {
+            if (!decidedBy && association !== 'OWNER' && association !== 'MEMBER') {
               await addReaction('-1');
               await postComment(
                 '❌ **PocketBase Bot**: @' + actor + ' is not authorized to use this command.\n' +
@@ -957,6 +1018,35 @@ jobs:
                   );
                   process.exit(0);
                 }
+                if (fieldName === 'app_vars') {
+                  const TYPES = ['text', 'password', 'number', 'boolean', 'select'];
+                  const problems = [];
+                  if (!Array.isArray(parsedJson)) problems.push('must be a JSON array');
+                  else parsedJson.forEach(function (v, i) {
+                    const at = 'entry ' + (i + 1) + ': ';
+                    if (!v || typeof v !== 'object' || Array.isArray(v)) { problems.push(at + 'must be an object'); return; }
+                    if (typeof v.name !== 'string' || !/^var_[a-z0-9_]+$/.test(v.name)) problems.push(at + '`name` must look like `var_example`');
+                    if (typeof v.label !== 'string' || !v.label.trim()) problems.push(at + '`label` is required');
+                    if (TYPES.indexOf(v.type) === -1) problems.push(at + '`type` must be one of ' + TYPES.join(', '));
+                    if (v.default !== undefined && typeof v.default !== 'string') problems.push(at + '`default` must be a string');
+                    if (v.type === 'select') {
+                      const opts = v.options;
+                      if (!Array.isArray(opts) || opts.length === 0 || opts.some(function (o) { return typeof o !== 'string' || !o; })) {
+                        problems.push(at + 'a select needs `options`, a non-empty array of strings');
+                      } else if (v.default !== undefined && opts.indexOf(v.default) === -1) {
+                        problems.push(at + '`default` must be one of its options');
+                      }
+                    }
+                    ['required', 'secret'].forEach(function (k) {
+                      if (v[k] !== undefined && typeof v[k] !== 'boolean') problems.push(at + '`' + k + '` must be true or false');
+                    });
+                  });
+                  if (problems.length > 0) {
+                    await addReaction('-1');
+                    await postComment('❌ **PocketBase Bot**: `app_vars` was not saved.\n\n- ' + problems.join('\n- '));
+                    process.exit(0);
+                  }
+                }
                 setPayload[fieldName] = parsedJson;
               } else {
                 setPayload[fieldName] = codeBlockValue;
@@ -1236,3 +1326,58 @@ jobs:
           });
           ENDSCRIPT
         shell: bash
+
+      - name: Close a metadata request once every change is decided
+        if: always() && github.event.action == 'edited' && contains(github.event.comment.body, '<!-- pb-request -->')
+        env:
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          REPO: ${{ github.repository }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          node << 'ENDSCRIPT'
+          (async function () {
+            const api = 'https://api.github.com/repos/' + process.env.REPO + '/issues/' + process.env.ISSUE_NUMBER;
+            const headers = {
+              'Authorization': 'Bearer ' + process.env.GITHUB_TOKEN,
+              'Accept': 'application/vnd.github+json',
+              'Content-Type': 'application/json',
+              'User-Agent': 'pocketbase-bot'
+            };
+            const https = require('https');
+            function call(method, url, body) {
+              return new Promise(function (resolve, reject) {
+                const req = https.request(url, { method: method, headers: headers }, function (res) {
+                  let data = '';
+                  res.on('data', function (d) { data += d; });
+                  res.on('end', function () { resolve({ ok: res.statusCode < 300, status: res.statusCode, body: data }); });
+                });
+                req.on('error', reject);
+                if (body) req.write(JSON.stringify(body));
+                req.end();
+              });
+            }
+            const requests = [];
+            for (let page = 1; page <= 10; page++) {
+              const res = await call('GET', api + '/comments?per_page=100&page=' + page);
+              if (!res.ok) throw new Error('Could not list comments: ' + res.status);
+              const comments = JSON.parse(res.body);
+              for (const c of comments) {
+                if ((c.body || '').includes('<!-- pb-request -->')) requests.push(c.body);
+              }
+              if (comments.length < 100) break;
+            }
+            const open = requests.filter(function (b) { return !b.includes('<!-- pb-request:done -->'); });
+            if (requests.length === 0 || open.length > 0) {
+              console.log(open.length + ' of ' + requests.length + ' changes still undecided.');
+              return;
+            }
+            const accepted = requests.filter(function (b) { return b.includes('✅ Accepted'); }).length;
+            const res = await call('PATCH', api, { state: 'closed', state_reason: accepted > 0 ? 'completed' : 'not_planned' });
+            if (!res.ok) throw new Error('Could not close the issue: ' + res.status);
+            console.log('Closed: ' + accepted + ' accepted, ' + (requests.length - accepted) + ' declined.');
+          })().catch(function (e) {
+            console.error(e.message || e);
+            process.exit(1);
+          });
+          ENDSCRIPT
+        shell: bash

.github/workflows/scripts/ci-controller-setup.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Installs ci-vm-controller.sh on the hypervisor (prox1): the script, the
+# token reader, a systemd unit per CI VM, and each VM's config. Run as root
+# on prox1 from a directory that also holds ci-vm-controller.sh:
+#
+#   scp ci-controller-setup.sh ci-vm-controller.sh root@prox1:/root/ci-controller/
+#   ssh root@prox1 'cd /root/ci-controller && bash ci-controller-setup.sh'
+#
+# It does not start anything: a VM goes into service with
+#   systemctl enable --now ci-vm-controller@<vmid>
+# once it has a 'clean' snapshot without any runner registered (see
+# docs/guides/pr-script-testing.md, "Single-use hosts").
+#
+# The token (/etc/ci-controller/token) is put there by hand: a fine-grained
+# token for the two repositories with Administration: read and write only.
+
+set -euo pipefail
+cd "$(dirname "$0")"
+[[ -f ci-vm-controller.sh ]] || { echo "ci-vm-controller.sh missing next to this script" >&2; exit 1; }
+command -v jq >/dev/null || DEBIAN_FRONTEND=noninteractive apt-get install -y -qq jq >/dev/null
+
+install -m 755 ci-vm-controller.sh /usr/local/sbin/ci-vm-controller.sh
+install -d -m 700 /etc/ci-controller
+
+cat >/usr/local/sbin/ci-gh-token <<'EOF'
+#!/bin/sh
+# Prints the token ci-vm-controller.sh uses (Administration: write on the CI
+# repositories). Swap this for a GitHub App token later without touching
+# the controller.
+exec cat /etc/ci-controller/token
+EOF
+chmod 755 /usr/local/sbin/ci-gh-token
+
+cat >/etc/systemd/system/ci-vm-controller@.service <<'EOF'
+[Unit]
+Description=Single-use CI runner host, VM %i
+After=network-online.target pve-cluster.service pvedaemon.service
+Wants=network-online.target
+# A missing token is a setup error, not something to retry every 30 s.
+ConditionPathExists=/etc/ci-controller/token
+
+[Service]
+ExecStart=/usr/local/sbin/ci-vm-controller.sh %i
+Restart=always
+RestartSec=30
+# Stopping the controller leaves the VM as it is; the next start resets it,
+# which also ends a job that may still be running there.
+KillMode=mixed
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# One repository per host: see ci-vm-controller.sh.
+conf() { # conf <vmid> <ip> <name> <label> <repo>
+  cat >"/etc/ci-controller/$1.conf" <<EOF
+VM_IP=$2
+HOST_NAME=$3
+LABEL=$4
+REPOS=$5
+EOF
+}
+conf 200 10.201.146.232 pve-ci     proxmox-test community-scripts/DevScripts
+conf 201 10.201.146.231 pve-ci-2   proxmox-test community-scripts/ProxmoxVE
+conf 202 10.201.146.233 incus-ci   incus-test   community-scripts/DevScripts
+conf 203 10.201.146.234 incus-ci-2 incus-test   community-scripts/ProxmoxVE
+
+systemctl daemon-reload
+echo "Installed. Token: $([[ -s /etc/ci-controller/token ]] && echo present || echo 'MISSING (/etc/ci-controller/token)')"

.github/workflows/scripts/ci-vm-controller.sh

@@ -0,0 +1,201 @@
+#!/usr/bin/env bash
+# Keeps one CI VM (pve-ci, incus-ci, ...) as a single-use GitHub runner host.
+# Runs on the hypervisor (prox1), which PR code never touches.
+#
+# Every cycle:
+#   1. roll the VM back to its clean snapshot and boot it;
+#   2. register a just-in-time runner on it (generate-jitconfig) for the
+#      host's repository. Such a runner takes exactly one job and is deleted
+#      by GitHub afterwards, so its credentials are worthless once that job
+#      is over;
+#   3. (with several repositories in REPOS: as soon as one runner is busy,
+#      delete the others that are still idle, so no second job starts on a
+#      host that is about to be reset);
+#   4. once every runner of this cycle is gone, start over at 1.
+#
+# PR code runs as root on the VM, so nothing the VM says is trusted: when a
+# job is over is read from GitHub's API, never from the VM.
+#
+# Config: /etc/ci-controller/<vmid>.conf (or the environment), see below.
+# Usage:  ci-vm-controller.sh <vmid>          run forever (the systemd unit)
+#         ONE_CYCLE=1 ci-vm-controller.sh <vmid>   one job, then stop (testing)
+
+set -euo pipefail
+
+VMID=${1:?usage: ci-vm-controller.sh <vmid>}
+CONF=${CONF:-/etc/ci-controller/$VMID.conf}
+# shellcheck source=/dev/null
+[[ -f "$CONF" ]] && . "$CONF"
+
+: "${VM_IP:?VM_IP}"                       # address of the CI VM
+: "${HOST_NAME:?HOST_NAME}"               # runner name prefix, e.g. pve-ci
+: "${LABEL:?LABEL}"                       # proxmox-test or incus-test
+# One repository per host. Several would each have a runner waiting on the
+# VM, and a job of one could read the idle runner's JIT config of the other
+# and use it elsewhere before it is withdrawn: one repository's PR code
+# faking the other's results. (Several are fine within one trust domain.)
+: "${REPOS:?REPOS, e.g. community-scripts/DevScripts}"
+EXTRA_LABELS=${EXTRA_LABELS:-}            # space-separated, e.g. for a test
+SNAPSHOT=${SNAPSHOT:-clean}
+TOKEN_CMD=${TOKEN_CMD:-/usr/local/sbin/ci-gh-token}  # prints a token with repo Administration: write
+PVE=${PVE:-}                              # prefix for qm, e.g. "ssh root@prox1" when not run on it
+GUEST_SSH=${GUEST_SSH:-"ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new root@$VM_IP"}
+POLL=${POLL:-20}
+MAX_BUSY_MIN=${MAX_BUSY_MIN:-180}         # the test job's own limit is 90
+MAX_IDLE_MIN=${MAX_IDLE_MIN:-720}         # recycle an idle host twice a day
+ONE_CYCLE=${ONE_CYCLE:-}
+
+log() { echo "[$(date -u +%FT%TZ)] vm $VMID: $*"; }
+qm() { if [[ -n "$PVE" ]]; then $PVE qm "$@"; else command qm "$@"; fi; }
+
+# Not in a subshell, so the status and the cached token survive the call:
+# api METHOD PATH [JSON] -> body in $API_BODY, HTTP status in $API_STATUS.
+API_FILE=$(mktemp)
+trap 'rm -f "$API_FILE"' EXIT
+TOKEN="" TOKEN_AT=0
+api() {
+  local method=$1 path=$2 data=${3:-}
+  # Cached for 30 minutes (an App installation token lives 60).
+  if [[ -z "$TOKEN" || $(($(date +%s) - TOKEN_AT)) -gt 1800 ]]; then
+    TOKEN=$($TOKEN_CMD) || { log "no GitHub token"; API_STATUS=000 API_BODY=""; return 1; }
+    TOKEN_AT=$(date +%s)
+  fi
+  API_STATUS=$(curl -sS -o "$API_FILE" -w '%{http_code}' -X "$method" \
+    -H "Authorization: Bearer $TOKEN" -H 'Accept: application/vnd.github+json' \
+    -H 'X-GitHub-Api-Version: 2022-11-28' ${data:+-d "$data"} "https://api.github.com$path") || API_STATUS=000
+  API_BODY=$(<"$API_FILE")
+  [[ "$API_STATUS" != 000 ]]
+}
+
+reset_vm() {
+  log "rolling back to '$SNAPSHOT'"
+  [[ "$(qm status "$VMID")" == *running* ]] && qm stop "$VMID" --timeout 60 >/dev/null
+  qm rollback "$VMID" "$SNAPSHOT" >/dev/null
+  qm start "$VMID" >/dev/null
+  local i
+  for i in $(seq 1 60); do
+    $GUEST_SSH true 2>/dev/null && { log "booted"; return 0; }
+    sleep 5
+  done
+  log "no SSH after 5 minutes"
+  return 1
+}
+
+# Parallel arrays: one entry per runner registered in this cycle.
+R_REPO=() R_ID=() R_GONE=()
+
+register() { # register <owner/repo>
+  local repo=$1 name dir labels body cfg id
+  name="$HOST_NAME-${repo#*/}-$(date +%s)"
+  dir=/opt/actions-runner/${repo#*/}
+  labels=$(printf '%s\n' "$LABEL" $EXTRA_LABELS | jq -R . | jq -sc .)
+  api POST "/repos/$repo/actions/runners/generate-jitconfig" \
+    "$(jq -nc --arg n "$name" --argjson l "$labels" '{name: $n, runner_group_id: 1, labels: $l, work_folder: "_work"}')" || return 1
+  body=$API_BODY
+  [[ "$API_STATUS" == 201 ]] || { log "$repo: generate-jitconfig failed ($API_STATUS): $(jq -r .message <<<"$body" 2>/dev/null)"; return 1; }
+  id=$(jq -r .runner.id <<<"$body")
+  cfg=$(jq -r .encoded_jit_config <<<"$body")
+  # The config goes in through stdin, not the command line.
+  if ! $GUEST_SSH "umask 077; cat >/run/ci-jit-${repo#*/} && systemd-run --quiet --collect --unit=ci-jit-${repo#*/} \
+      -p WorkingDirectory=$dir -E RUNNER_ALLOW_RUNASROOT=1 \
+      /bin/sh -c 'cfg=\$(cat /run/ci-jit-${repo#*/}); rm -f /run/ci-jit-${repo#*/}; exec ./run.sh --jitconfig \"\$cfg\"'" <<<"$cfg"; then
+    log "$repo: could not start the runner on the VM"
+    api DELETE "/repos/$repo/actions/runners/$id" >/dev/null || true
+    return 1
+  fi
+  R_REPO+=("$repo") R_ID+=("$id") R_GONE+=(0)
+  log "$repo: runner $name (id $id) started"
+}
+
+drop() { # drop <index>: delete an idle runner; GitHub refuses a busy one
+  local i=$1
+  api DELETE "/repos/${R_REPO[$i]}/actions/runners/${R_ID[$i]}" >/dev/null || return 1
+  if [[ "$API_STATUS" == 204 || "$API_STATUS" == 404 ]]; then R_GONE[$i]=1; return 0; fi
+  return 1
+}
+
+watch_cycle() {
+  local start busy_since="" i body status busy any_busy left offline_since=""
+  start=$(date +%s)
+  while :; do
+    sleep "$POLL"
+    any_busy=0 left=0 offline=0
+    for i in "${!R_ID[@]}"; do
+      [[ "${R_GONE[$i]}" == 1 ]] && continue
+      api GET "/repos/${R_REPO[$i]}/actions/runners/${R_ID[$i]}" || { left=1; continue; }
+      body=$API_BODY
+      if [[ "$API_STATUS" == 404 ]]; then
+        R_GONE[$i]=1
+        log "${R_REPO[$i]}: runner ${R_ID[$i]} is gone (job done or removed)"
+        continue
+      fi
+      left=1
+      busy=$(jq -r .busy <<<"$body"); status=$(jq -r .status <<<"$body")
+      [[ "$busy" == true ]] && any_busy=1
+      [[ "$status" == offline ]] && offline=1
+    done
+    if [[ "$any_busy" == 1 && -z "$busy_since" ]]; then
+      busy_since=$(date +%s)
+      log "a job started; withdrawing the idle runners"
+    fi
+    # A host that has started a job takes no other one: it will be reset.
+    if [[ -n "$busy_since" ]]; then
+      for i in "${!R_ID[@]}"; do
+        [[ "${R_GONE[$i]}" == 1 ]] && continue
+        api GET "/repos/${R_REPO[$i]}/actions/runners/${R_ID[$i]}" || continue
+        body=$API_BODY
+        [[ "$API_STATUS" == 200 && "$(jq -r .busy <<<"$body")" == false ]] && drop "$i" &&
+          log "${R_REPO[$i]}: idle runner ${R_ID[$i]} withdrawn"
+      done
+    fi
+    [[ "$left" == 0 ]] && { log "cycle over"; return 0; }
+
+    local now; now=$(date +%s)
+    if [[ -n "$busy_since" && $((now - busy_since)) -gt $((MAX_BUSY_MIN * 60)) ]]; then
+      log "job still running after $MAX_BUSY_MIN minutes; resetting anyway"
+      break
+    fi
+    if [[ -z "$busy_since" && $((now - start)) -gt $((MAX_IDLE_MIN * 60)) ]]; then
+      log "idle for $MAX_IDLE_MIN minutes; recycling"
+      break
+    fi
+    # A runner that never comes online (or dies while idle) holds the host
+    # forever otherwise.
+    if [[ -z "$busy_since" && "$offline" == 1 ]]; then
+      [[ -z "$offline_since" ]] && offline_since=$now
+      if [[ $((now - offline_since)) -gt 300 ]]; then log "a runner is offline for 5 minutes; resetting"; break; fi
+    else
+      offline_since=""
+    fi
+  done
+  for i in "${!R_ID[@]}"; do [[ "${R_GONE[$i]}" == 1 ]] || drop "$i" || true; done
+}
+
+# Registrations of this host that a stopped or crashed controller left behind:
+# their VM was reset, so they are offline and never take a job, but they
+# clutter the runner list. Busy or online ones are left alone.
+cleanup_stale() {
+  local repo ids id
+  for repo in $REPOS; do
+    api GET "/repos/$repo/actions/runners?per_page=100" || continue
+    [[ "$API_STATUS" == 200 ]] || continue
+    ids=$(jq -r --arg p "$HOST_NAME-${repo#*/}-" \
+      '.runners[] | select((.name | startswith($p)) and .status == "offline" and (.busy | not)) | .id' <<<"$API_BODY")
+    for id in $ids; do
+      api DELETE "/repos/$repo/actions/runners/$id" && log "$repo: stale runner $id removed"
+    done
+  done
+}
+
+while :; do
+  R_REPO=() R_ID=() R_GONE=()
+  if reset_vm; then
+    cleanup_stale
+    ok=0
+    for repo in $REPOS; do register "$repo" && ok=1 || true; done
+    if [[ "$ok" == 1 ]]; then watch_cycle; else log "no runner could be registered"; sleep 60; fi
+  else
+    sleep 60
+  fi
+  [[ -n "$ONE_CYCLE" ]] && { log "ONE_CYCLE: stopping; the VM is left as the job left it"; break; }
+done

.github/workflows/scripts/incus-ci-host-setup.sh

@@ -6,6 +6,8 @@
 #
 #   incus-ci-host-setup.sh                       host only
 #   incus-ci-host-setup.sh <owner/repo> <token>  host + a runner for that repo
+#   incus-ci-host-setup.sh <owner/repo> jit      host + runner software only, for
+#                                                ci-vm-controller.sh (single-use host)
 #
 # The token is a runner *registration* token (valid one hour):
 #   gh api -X POST repos/<owner/repo>/actions/runners/registration-token --jq .token
@@ -176,6 +178,13 @@ if [[ $# -eq 2 ]]; then
     curl -fsSL "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz" | tar -xz
     ./bin/installdependencies.sh >/dev/null
   fi
+  # `jit`: a single-use host. ci-vm-controller.sh on the hypervisor registers
+  # a fresh runner for every job and resets the VM afterwards, so only the
+  # runner software goes on it, and the 'clean' snapshot is taken after this.
+  if [[ "$token" == jit ]]; then
+    echo "runner software for ${repo} installed; ci-vm-controller.sh registers a runner per job"
+    exit 0
+  fi
   if [[ -f .runner ]]; then
     ./svc.sh stop >/dev/null 2>&1 || true
     ./svc.sh uninstall >/dev/null 2>&1 || true

.github/workflows/scripts/pve-ci-host-setup.sh

@@ -5,6 +5,8 @@
 #
 #   pve-ci-host-setup.sh                       host only
 #   pve-ci-host-setup.sh <owner/repo> <token>  host + a runner for that repo
+#   pve-ci-host-setup.sh <owner/repo> jit      host + runner software only, for
+#                                              ci-vm-controller.sh (single-use host)
 #
 # The token is a runner *registration* token (valid one hour):
 #   gh api -X POST repos/<owner/repo>/actions/runners/registration-token --jq .token
@@ -196,6 +198,13 @@ if [[ $# -eq 2 ]]; then
     curl -fsSL "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz" | tar -xz
     ./bin/installdependencies.sh >/dev/null
   fi
+  # `jit`: a single-use host. ci-vm-controller.sh on the hypervisor registers
+  # a fresh runner for every job and resets the VM afterwards, so only the
+  # runner software goes on it, and the 'clean' snapshot is taken after this.
+  if [[ "$token" == jit ]]; then
+    echo "runner software for ${repo} installed; ci-vm-controller.sh registers a runner per job"
+    exit 0
+  fi
   # A registered runner is reconfigured from scratch: stop and remove the old
   # registration (the token works for removal too).
   if [[ -f .runner ]]; then

.github/workflows/scripts/pve-run-script.sh

@@ -555,7 +555,9 @@ check_health screenshot.png || fail "$health_problem"
 # only say "No update available" and never run update_script's real path. The
 # version files the install wrote (~/.<app>, one per fetch_and_deploy_gh_release)
 # that update_script checks are set back to 0.0.0-ci first; check_for_gh_release then sees an update and
-# runs it all. `update` is the /usr/bin/update the install generated: it pulls
+# runs it all. Apps deployed from a branch (fetch_and_deploy_gh_branch, checked
+# with check_for_gh_branch) store a commit hash instead of a version; the
+# engine compares both as plain strings, so 0.0.0-ci works for them too. `update` is the /usr/bin/update the install generated: it pulls
 # ct/<app>.sh from the URL this container was built from, i.e. the PR's tree.
 UPDATE_FAKE="0.0.0-ci"
 update_fail() {
@@ -568,7 +570,7 @@ version_files=$(guest_exec sh -c '
   for f in /root/.*; do
     [ -f "$f" ] || continue
     case "$f" in */.install-* | *.pending | *.bak | */.bash* | */.profile | */.hushlogin | */.viminfo | */.lesshst | */.wget-hsts | */.selected_editor) continue ;; esac
-    [ "$(wc -l <"$f")" -le 1 ] && grep -qE "^v?[0-9]+(\.[0-9A-Za-z_+-]+)+$" "$f" && echo "$f"
+    [ "$(wc -l <"$f")" -le 1 ] && grep -qE "^(v?[0-9]+(\.[0-9A-Za-z_+-]+)+|[0-9a-f]{7,40})$" "$f" && echo "$f"
   done' 2>/dev/null | grep -E '^/root/\.[A-Za-z0-9._-]+$')
 # Only set back what update_script checks: the names it passes to
 # check_for_*release. The install can also deploy helpers the update never