Warpgate answers 401 on its root, a login wall, and the check failed it
(DevScripts issue 2537). Any answer now counts as the app being up,
except no answer, 404/410, a 5xx or a redirect loop. Same rule for VMs.
GitHub limits a check run summary to 65535 bytes, not characters. The
shopware report (DevScripts PR 2478) had emoji-heavy logs and failed with
422. Cut by bytes at a character boundary and close an open log block.
Version files were set back to 0.0.0-ci for the update test. Shopware's
update_script reads ~/.shopware to pin composer to the installed series
(~6.7.0), so it got ~0.0.0 and failed. Append -dev instead (6.7.16.0-dev):
the engine ranks it below the release, so the update still runs. Commit
hashes keep 0.0.0-ci.
The website now posts each requested change as its own comment with the
command and two checkboxes. Ticking one edits the comment: Accept runs
the command as if a maintainer had typed it, Decline records the
refusal, and the issue closes once every change is decided. Only users
with write access can decide. app_vars is checked field by field before
it is saved.
The ARM runner's resolver cannot resolve ports.ubuntu.com since this
afternoon; apt then hangs. The name is now looked up over DNS-over-HTTPS
when needed, and a failing apt prints the runner's network state.
Setting is_dev to false left platforms as DevScripts had them, usually empty or pve only, although a container in ProxmoxVE is synced to Incus from then on. 36 production records had no platforms because of it. The migration now sets pve and incus for containers, pve where nothing was set, and amd64 for an empty architectures.
- ARM runs on GitHub's ubuntu-24.04-arm runner (free for public repos), set
up by arm-runner-setup.sh: Incus 6.0 LTS from Zabbly (key pinned, APT
pin), screenshots through Playwright. ARM rows are shown but never count:
not in the headline, the check, the review or the approval, and the job
runs with continue-on-error.
- var_arm64=no is not built on ARM; unset is built with var_arm64=yes.
- arm-script-test.yml builds one script on ARM by hand, posting nothing.
- Update test: only the versions update_script checks are set back.
- The screenshot browser gets a writable HOME.
- vm/ scripts run unattended (VM_UNATTENDED=1) on the Proxmox hosts, IDs
9100-9199, one VM per host at a time. Checks: success line, the VM keeps
running, a DHCP lease, and a ${VM_IP} URL answering 200. Console
screenshot from QEMU when there is no web UI. ARM64-only scripts are
listed as not built.
- Every ct/ script now builds on pve and incus (new incus-test runners,
incus-ci-host-setup.sh); the comment gets a Platform column.
- Spinner frames are dropped from logs and live output.
- The sweeper ignores and removes locks of killed jobs (older than 3h).
Update test: after a passing install, every version file the install
wrote (~/.<app>) is set back to 0.0.0-ci and the container's own
`update` runs unattended, pulling the PR's ct/ script, so
update_script's real path is exercised. It must report "Updated
successfully" without errors, and services and URL are checked again.
Apps without a version file get "nothing to update", a GitHub rate
limit counts as not tested. Separate Install and Update columns in the
report; a failed update requests changes like a failed install.
The job's read-only token is passed to the build so release lookups are
not rate limited (all test containers share one public IP).
/test <app> in an issue builds that app from main, install and update,
and answers in the issue; no check run, review or approval.
A second test host (pve-ci-2) now serves both repositories. The setup
script registered runners as pve-ci-<repo> with --replace, which would
have made it take over the first host's registration; they are now
named <host>-<repo>.
Anyone with write access can push to a push-app-to-main branch, and the
bot's approval counts toward the main ruleset's required review. The
approval now only covers what a migration contains: if the PR changes
anything besides ct/*.sh and install/*.sh (workflows, misc/, ...), it is
tested as usual but not approved, and the result comment says why.
PRs that the push-app-to-main app opens on a branch of this repository
(scripts moving over from DevScripts, reviewed and tested there,
writable only by writers) are now built on pull_request_target for
every push, pinned to the pushed commit; an event for an older push is
ignored. When every script passes, the bot approves the tested commit,
which counts toward the main ruleset's required review; a new push
drops it as stale, and a later run that does not fully pass withdraws
it. Untestable (CPU) and setup errors are never approved. All other
PRs still need /test and are never approved.
A /test on a PR that only changes vm/ (#18578, TrueNAS) found nothing
to build and stopped without a word. The gate now always answers:
"Nothing to build" with the reason for each file (vm/ not covered,
tools/ not built, install/ script without a ct/ script of the same
name, more than 10 scripts), and when some scripts are built the rest
are listed as "Not built" in the progress and the result comment.
File names from the PR are put in code spans with backticks and line
breaks removed.
OpenCloud reads var_opencloud_${server}_fqdn for each server in
servers=("opencloud" "collabora" "wopi"), so the scan for literal
var_ names found nothing and the build stopped at the first prompt
(#18586). Templates of the form var_...${x}... are now expanded with
the words of `for x in ...`, or of the array that loop walks; nothing
is executed. Hostname-like answers are derived from the variable name
(ci-opencloud-collabora.example.test), so several cannot collide.
A maintainer comments `/test` on a pull request and a self-hosted
runner on a disposable Proxmox VE host builds every ct/ script the PR
touches (and the ct/ entry point of every changed install/ script),
checks the result and reports back on the PR.
- Gate: only users with write access; builds the latest commit only if
nothing was pushed to the fork after the comment, or a pinned
`/test <full sha>`.
- Build: the PR tree at that commit is served from the test host with
every raw.githubusercontent.com/community-scripts/ProxmoxVE/main URL
rewritten to it, so engine changes in the PR are tested too.
Unattended (mode=default); prompts declared the AGENTS.md way are
pre-answered with CI values.
- Checks: build and install succeed, container running, no failed
units, the URL the script prints answers 200. Screenshot of that URL.
- Report: check run, one comment (results, screenshot, install log,
mentions of the PR author and whoever asked), changes requested on a
real failure, dismissed again on a pass. CPU-feature failures (no
AVX2 on the test host) are marked untestable, not failed.
- The test job has a read-only token and no secrets; its runner carries
only the proxmox-test label. Container IDs 9050-9099.
Same file as in DevScripts; github.repository selects the URLs and the
container ID range.
openwrt-vm and umbrel-os-vm kept the DevScripts base URL when they moved over, and telemetry filed their production runs under DevScripts. The check fails a pull request that adds such a URL to ct, install, vm or tools.
close-invalid-pr-template.yml now comments and labels (missing pr template,
stale) instead of closing immediately, clears itself once fixed. stale_pr_close.yml
gains the engagement-gated/keep-open/maintainer-reset behavior already used in
DevScripts, so a template-stale PR only closes via its own re-check.
request-script.yml discussion template gets an optional Justification field;
a new workflow verifies stars/age against GitHub for the submitted repo and
either does nothing (eligible), labels investigation (ineligible + justified),
or closes the discussion (ineligible, no justification).
Moved the AI Assistance section to the end of pull_request_template.md.
* Drop the legacy engine copies from misc/
Nothing has loaded misc/*.func since ct/, install/, vm/ and tools/ moved to
community-scripts/core. misc/api.func stays until vm/owncloud-vm.sh gets its
DevScripts rewrite.
misc/images/ moves to .github/assets/. The tombstone stub for removed scripts
sourced misc/build.func and called variables(), which core's PVE engine does
not define; it now sources core.func.
* Drop misc/api.func
vm/owncloud-vm.sh was its last caller; DevScripts holds that script's rewrite
onto core/pve/vm-core.func. Merge this after the promotion.
When a merged PR came from a DevScripts migration, the telemetry service
re-attributes that script's DevScripts records. Needs the
TELEMETRY_ADMIN_TOKEN secret; without it the step is skipped.
Contribution docs, the PR template and the workflows that talk to the
testing repository use the new name. Migration PRs are matched by either
name, and three license headers pointed at contributor forks.
Engine pull requests were only filtered by invalid/wontdo/wontfix/duplicate,
so every "Generate app headers" run from core landed in the changelog. They now
honour the same "automated pr" label as this repository's own bot PRs.
A fix to tools/addon/all-templates.sh got no comment because only ct/ and
install/ were recognised. Each script now also says where it runs, read from
what it calls: the Proxmox VE host, inside a guest, or PBS/PMG/PDM.
It called GitHub Models, which GitHub retired on 2026-07-30. The endpoint now
answers every request with a plain-text "OK", so each mention ended in "Could
not parse the model response". The /pocketbase slash-command bot is unaffected.
generate-app-headers.sh read APP with a plain grep -oP, so a script that
sets APP twice yielded both lines and the filename became
"almalinux
almalinux${var_version}vm". Three of those are in the tree
and they make main impossible to check out on Windows.
Nothing reads vm/headers: get_header fetches banners from the core
repo, which already carries clean almalinux, debian and ubuntu.
* pocketbase-bot: accept the var_ names and two missing fields
cpu, ram, hdd, os and version were already reachable, but only under
the PocketBase names. People type what the ct scripts call them, so
"/pocketbase <slug> var_ram=4096" was rejected as an unknown field
while "ram=4096" worked. The bot already carried the mapping as
RESOURCE_TO_CT_VAR, for display only.
Normalise the keys in parseKVPairs, so both the field=value path and
the method path accept them, along with disk and memory as the other
two names people reach for. Matching is case-insensitive.
pin_reason and last_update_commit exist on the record and are worth
editing, but were not in ALLOWED_FIELDS. slug, script_created and
script_updated stay out: the first is the key the command looks the
record up by, the other two belong to the timestamp workflow. notes and
install_methods keep their own subcommands.
* pocketbase-bot: write the sync PR against the PR template
The sync PR body had its own Summary and Source headings, so the
autolabeler found none of the template checkboxes it looks for and the
PR came out with nothing but "needs triage". It also never referenced
the issue the command came from.
Write the body the way the template expects, with the Website update
box ticked, which is what a PocketBase sync is. Tested thoroughly stays
unticked and Tested on says not tested, because nothing here was run;
close-invalid-pr-template skips bot authors, so that costs nothing.
Reference the triggering number as Fixes when the command came from an
issue and as a plain mention when it came from a PR comment, where
Fixes would point the PR at itself. issue_comment carries both under
github.event.issue, so the new IS_PR_COMMENT tells them apart.
* ci: stop the .app header PR being closed as a new script
allowedBots carried "community-scripts-pr-app" but not the
"[bot]"-suffixed name GitHub actually reports, and the check is an exact
match, so the exemption never applied to it. push-app-to-main is listed
both ways; this one was not. PR #17304 was closed as an untested new
script submission because of it.
generate-app-headers.sh empties ct/headers, tools/headers and
vm/headers and writes them again, so every run reports those files as
added. That is what the autolabeler's new-script rule looks for, and
the vm rule matched vm/headers too. Exclude the header directories from
both, and skip them in the close workflow's own added-file fallback, so
the label cannot come back by another route.
Checked against minimatch with the shipped config: header files get
neither label, ct/*.sh, install/*.sh and vm/*.sh still get theirs.
* pocketbase-bot: label the sync PR as a bugfix
The sync corrects CT defaults that no longer match the PocketBase
record, so bugfix describes it better than website update, which is
meant for metadata changes on the site itself.
