mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-10 19:07:19 +01:00
Krzysztof kuhy Rudnicki
d5c63b423b
Today the bot was up, healthy and answering nothing for three hours. A host
firewall change (fixed in testsAndMisc 334c0cd9) cut every Docker container
off the internet; signal-cli lost Signal and reconnected in a loop from
15:32:50 onward. Nothing noticed:
- the container's own healthcheck answered 204
- /v1/groups answered 200 out of local state, so discovery saw no change
- the bot's WebSocket to the container stayed OPEN, so the transport's
reconnect logic never fired
- /healthz answered {"status": "ok"} the entire time
The only symptom was silence, which is also what a quiet evening looks like.
signal_bot/liveness.py asks the one question that cannot be answered from a
cache -- GET /v1/devices, which needs a live round trip -- but only after
SILENCE_SECONDS (120) with no frame of any kind, so a busy group costs
nothing and an idle one costs one request per window. Three consecutive
failures and /healthz answers 503 with the reason. Verified end to end in
scripts/e2e.sh against the real process: 503 after 84s with the fake's
connection cut, back to 200 on its own 30s after restoring it.
scripts/signal_api_watchdog.sh + a two-minute user timer do the recovery the
bot cannot do for itself, since a wedged bot cannot restart the container it
depends on. Two tiers, so the steady state costs no Signal round trip at
all: the bot's own /healthz first, the authenticated probe only when that is
not 200. It stops after 3 restarts in 6 hours and escalates instead -- a
deregistered account or a blocked network is not fixable by restarting, and
a restart loop would hide it. Its own bash suite stubs curl and docker and
drives every branch including the give-up cap.
signal_bot/trust.py answers the other half: TRUSTED_INVITERS decides who may
put this bot in a group. The gate sits in GroupDirectory._permitted, which
both _join_pending and _adopt already route through -- gating only invites
would gate the door nobody uses, since prime_profile.sh exists precisely so
that an add becomes a direct join. Evidence is either the group-update
envelope, which is the only frame naming an inviter, or a trusted identity
being a full member in the listing. A refusal is logged once, with that
group's members, so the operator can see which string to add.
verify_allowlist moved to membership.py to keep discovery.py under the
250-line gate; it was already the module that owns MembershipError.
Verified live, by stopping the container by hand and touching nothing else:
18:54:35 docker stop signal-api
18:56:36 liveness: failure 1 of 3 after 123s of silence
18:57:36 failure 3 of 3 -> /healthz answers 503 from 18:57:45
18:58:18 watchdog: probe failed (1/2)
19:00:28 watchdog: probe failed (2/2) -> docker restart signal-api
19:00:36 liveness: receive path recovered after 8 failed probe(s)
19:01:13 watchdog: signal-api is back
Six minutes, unattended, against three hours of silence this afternoon. All
four real groups are still adopted with TRUSTED_INVITERS=+48123456789 set,
and no group was refused.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbjfWdAyHbCubac7wJKJZW
118 lines
4.0 KiB
YAML
118 lines
4.0 KiB
YAML
# Pre-commit hooks for signal-bot.
|
|
#
|
|
# Install with: pre-commit install
|
|
# Run manually: pre-commit run --all-files
|
|
#
|
|
# Every hook is `language: system` because the tools already live in .venv;
|
|
# pre-commit must not build isolated environments for them. fail_fast so a
|
|
# later check cannot run after an earlier one has already rejected the commit.
|
|
fail_fast: true
|
|
|
|
repos:
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v4.6.0
|
|
hooks:
|
|
- id: trailing-whitespace
|
|
args: [--markdown-linebreak-ext=md]
|
|
- id: end-of-file-fixer
|
|
- id: check-yaml
|
|
- id: check-json
|
|
- id: check-toml
|
|
- id: check-merge-conflict
|
|
- id: check-case-conflict
|
|
- id: check-executables-have-shebangs
|
|
- id: check-shebang-scripts-are-executable
|
|
- id: detect-private-key
|
|
- id: debug-statements
|
|
- id: check-ast
|
|
- id: mixed-line-ending
|
|
args: [--fix=lf]
|
|
|
|
- repo: local
|
|
hooks:
|
|
# Suppressions are blocked mechanically, not by discipline. This repo
|
|
# has zero of them and the only way it stays that way is a gate: the
|
|
# rule is "fix the finding, or ask first", and a habit is not a gate.
|
|
- id: no-noqa
|
|
name: block noqa / type:ignore comments
|
|
entry: '(?i)#\s*(noqa|type:\s*ignore)'
|
|
language: pygrep
|
|
types: [python]
|
|
|
|
- id: no-ruff-noqa
|
|
name: block file-level ruff noqa
|
|
entry: '(?i)#\s*ruff:\s*noqa'
|
|
language: pygrep
|
|
types: [python]
|
|
|
|
# The shared 250-line cap. Checks only the files in the commit, so an
|
|
# unrelated commit never breaks. No baseline, no allowlist -- those are
|
|
# suppressions. The exemption list lives with the checker in ~/utils so
|
|
# this repo's idea of the rule cannot drift from every other repo's.
|
|
- id: file-length
|
|
name: file length <= 250 lines
|
|
entry: scripts/check_file_length.sh
|
|
language: system
|
|
|
|
# Four markdown namespaces (README / CLAUDE* / DOCS* / TODO*), plus the
|
|
# rule that a TODO carries "REMOVE ME AFTER FINISH" and nothing else may.
|
|
- id: md-naming
|
|
name: markdown naming convention
|
|
entry: scripts/check_md_naming.sh
|
|
language: system
|
|
files: \.md$
|
|
|
|
# Exact pins at newest stable. Runs repo-wide: a pin goes stale because
|
|
# upstream released, not because this commit touched the manifest.
|
|
- id: dependency-freshness
|
|
name: dependencies are newest stable
|
|
entry: scripts/check_dependency_freshness.sh --all
|
|
language: system
|
|
pass_filenames: false
|
|
always_run: true
|
|
|
|
- id: ruff-format
|
|
name: ruff format
|
|
entry: .venv/bin/ruff format --check
|
|
language: system
|
|
types_or: [python, pyi]
|
|
|
|
- id: ruff
|
|
name: ruff (ALL rules)
|
|
entry: .venv/bin/ruff check --force-exclude
|
|
language: system
|
|
types_or: [python, pyi]
|
|
|
|
- id: mypy
|
|
name: mypy --strict
|
|
entry: .venv/bin/mypy
|
|
language: system
|
|
pass_filenames: false
|
|
args: [signal_bot, fake_signal]
|
|
|
|
- id: shellcheck
|
|
name: shellcheck
|
|
# Same severity floor as CI: a stricter runner version must not be
|
|
# the thing that discovers a finding this hook let through.
|
|
entry: shellcheck -x --severity=style
|
|
language: system
|
|
types: [shell]
|
|
|
|
# The watchdog is bash, so pytest cannot reach it. Its own suite stubs
|
|
# curl and docker and drives every branch, including the give-up cap.
|
|
- id: watchdog-tests
|
|
name: watchdog behaviour (bash)
|
|
entry: scripts/test_watchdog.sh
|
|
language: system
|
|
pass_filenames: false
|
|
files: ^scripts/(signal_api_watchdog|test_watchdog)\.sh$
|
|
|
|
# 100% branch coverage, no omits. Runs on every commit: coverage is the
|
|
# whole point of the suite, and a partial run cannot prove it.
|
|
- id: pytest
|
|
name: pytest (100% branch coverage)
|
|
entry: .venv/bin/python -m pytest -q
|
|
language: system
|
|
pass_filenames: false
|
|
always_run: true
|