3.4.0 adds FUTO Backups, which run restic from PATH and use restic-proxy when it is there. Both are built from the refs the server Dockerfile pins, and an update only rebuilds them when those change. pigz is installed, which database backups now use for compression when present. mise skips its own restic, and the extism-js fallback follows the js-pdk version in mise.toml (v1.7.0) instead of a fixed v1.6.0.
Update test: after a passing install, every version file the install
wrote (~/.<app>) is set back to 0.0.0-ci and the container's own
`update` runs unattended, pulling the PR's ct/ script, so
update_script's real path is exercised. It must report "Updated
successfully" without errors, and services and URL are checked again.
Apps without a version file get "nothing to update", a GitHub rate
limit counts as not tested. Separate Install and Update columns in the
report; a failed update requests changes like a failed install.
The job's read-only token is passed to the build so release lookups are
not rate limited (all test containers share one public IP).
/test <app> in an issue builds that app from main, install and update,
and answers in the issue; no check run, review or approval.
A second test host (pve-ci-2) now serves both repositories. The setup
script registered runners as pve-ci-<repo> with --replace, which would
have made it take over the first host's registration; they are now
named <host>-<repo>.
Anyone with write access can push to a push-app-to-main branch, and the
bot's approval counts toward the main ruleset's required review. The
approval now only covers what a migration contains: if the PR changes
anything besides ct/*.sh and install/*.sh (workflows, misc/, ...), it is
tested as usual but not approved, and the result comment says why.
PRs that the push-app-to-main app opens on a branch of this repository
(scripts moving over from DevScripts, reviewed and tested there,
writable only by writers) are now built on pull_request_target for
every push, pinned to the pushed commit; an event for an older push is
ignored. When every script passes, the bot approves the tested commit,
which counts toward the main ruleset's required review; a new push
drops it as stale, and a later run that does not fully pass withdraws
it. Untestable (CPU) and setup errors are never approved. All other
PRs still need /test and are never approved.
A /test on a PR that only changes vm/ (#18578, TrueNAS) found nothing
to build and stopped without a word. The gate now always answers:
"Nothing to build" with the reason for each file (vm/ not covered,
tools/ not built, install/ script without a ct/ script of the same
name, more than 10 scripts), and when some scripts are built the rest
are listed as "Not built" in the progress and the result comment.
File names from the PR are put in code spans with backticks and line
breaks removed.
OpenCloud reads var_opencloud_${server}_fqdn for each server in
servers=("opencloud" "collabora" "wopi"), so the scan for literal
var_ names found nothing and the build stopped at the first prompt
(#18586). Templates of the form var_...${x}... are now expanded with
the words of `for x in ...`, or of the array that loop walks; nothing
is executed. Hostname-like answers are derived from the variable name
(ci-opencloud-collabora.example.test), so several cannot collide.
A maintainer comments `/test` on a pull request and a self-hosted
runner on a disposable Proxmox VE host builds every ct/ script the PR
touches (and the ct/ entry point of every changed install/ script),
checks the result and reports back on the PR.
- Gate: only users with write access; builds the latest commit only if
nothing was pushed to the fork after the comment, or a pinned
`/test <full sha>`.
- Build: the PR tree at that commit is served from the test host with
every raw.githubusercontent.com/community-scripts/ProxmoxVE/main URL
rewritten to it, so engine changes in the PR are tested too.
Unattended (mode=default); prompts declared the AGENTS.md way are
pre-answered with CI values.
- Checks: build and install succeed, container running, no failed
units, the URL the script prints answers 200. Screenshot of that URL.
- Report: check run, one comment (results, screenshot, install log,
mentions of the PR author and whoever asked), changes requested on a
real failure, dismissed again on a pass. CPU-feature failures (no
AVX2 on the test host) are marked untestable, not failed.
- The test job has a read-only token and no secrets; its runner carries
only the proxmox-test label. Container IDs 9050-9099.
Same file as in DevScripts; github.repository selects the URLs and the
container ID range.
Debian 13's memcached also listens on ::1 and cannot start in a container with IPv6 disabled, so openproject configure failed (#18579). adventurelog had the same memcached silently down. Both drop the ::1 listener.
* Tunarr: drop binary rename for the new release folder layout
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Tunarr: track the latest ErsatzTV-ffmpeg and link ffmpeg into /usr/bin
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
update_script never wrote ~/.openobserve, so check_for_gh_release reported
an update on every run and reinstalled the release. Write the version after
extraction, as other ct scripts do, and overwrite instead of append at install.
The unit ExecStop=killall failed with 203/EXEC because psmisc is never
installed. OpenObserve treats SIGQUIT and SIGTERM alike, so drop ExecStop
and remove it from existing units during update.
Co-authored-by: BadFlo <7882184+BadFlo@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The release tarball stores the binary as uid/gid 1001. Extracted as root,
GNU tar keeps that owner, so /opt/openobserve/openobserve ended up owned by
a non-existent uid after install and every update.
Co-authored-by: BadFlo <7882184+BadFlo@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(immich): download before stopping, and clear maintenance mode after an interrupted update
setup_uv and the Immich release fetch ran after maintenance mode, the service stop and rm -rf app/*, so a failed download (e.g. a GitHub releases/download 504) left the container with no app at all. They now run first, while the old install is still serving.
The fetch writes the new version to ~/.immich, so the old version is put back until the update finishes and a failed run can still be retried.
Maintenance mode is now disabled whenever immich-admin exists at the end, not only when this run enabled it. Since #17798 a re-run after an interrupted update skips the enable, so it skipped the disable too and left the web UI on the maintenance page.
* fix(immich): trim comments to the AGENTS.md limit
* fix(immich): rely on the core pending marker, and only clear maintenance mode this run owns
fetch_and_deploy_release already keeps ~/.immich.pending until a clean exit and redoes the update while it exists, so the hand-rolled version swap is dropped; PREV_IMMICH now reads CS_PREVIOUS_VERSION so a redo sees the real old version.
Maintenance mode is disabled when this run enabled it, or when app/ was empty at the start (an interrupted run left it on), rather than whenever immich-admin exists.
* immich: drop comment per review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* kan: bump Node.js from 20 to 24
* Set NODE_VERSION and NODE_MODULE before setup
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
