From 2441e473904b8b31150007f99225e32ce4c0dc70 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sun, 20 Sep 2026 20:00:31 -0700 Subject: [PATCH] Give CI jobs IPv6 rather than a Node flag that did not help The proxy test failed with ECONNREFUSED on 127.0.0.1 for a server bound to ::1. That is not resolution order, so --dns-result-order was treating the wrong cause and is removed: with no non-loopback IPv6 address on the container, getaddrinfo's AI_ADDRCONFIG drops ::1 from the results altogether and localhost can only ever come back IPv4. The runner now puts jobs on a docker network created with --ipv6, which is where the fix belongs. Verified by reproducing the failure on the old network and watching it pass on the new one. --- .gitlab-ci.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index dcb0a54..3c87f2a 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -32,14 +32,6 @@ node: image: node:26-bookworm-slim@sha256:582460f614631b59b824ac6020533b9bf339c7fdf3a6d7db31abb6b4065f0212 # 26-bookworm-slim variables: NPM_CONFIG_CACHE: "$CI_PROJECT_DIR/.npm" - # imageproxy.test.ts binds its "reached by name" server to ::1 and then - # asks for localhost, on the assumption that localhost resolves to IPv6 - # first. That holds on a workstation and on GitHub's ubuntu-latest; inside - # this container /etc/hosts answers 127.0.0.1 first, the request lands on - # the pinned server instead and the control case fails. Node 17 onwards - # returns getaddrinfo order verbatim, so ask for the order the test - # expects rather than rewriting the test around the runner. - NODE_OPTIONS: "--dns-result-order=ipv6first" cache: key: files: [package-lock.json] @@ -52,7 +44,16 @@ node: # config.test.ts chmods a directory to 0555 and expects the write to be # refused. Root ignores the permission bits, so as root that assertion can # never hold. The tests run as the image's unprivileged `node` user for - # that reason; -p keeps the environment, including NODE_OPTIONS above. + # that reason; -p keeps the environment. + # + # imageproxy.test.ts needs IPv6 as well, which is not set here but on the + # runner: jobs run on the `ci-net` docker network, created with --ipv6. + # Without a non-loopback IPv6 address on the container, getaddrinfo's + # AI_ADDRCONFIG drops ::1 from the results entirely, localhost resolves to + # IPv4 only, and the test's control case connects to a port nothing is + # listening on. That is a runner property, so it cannot be fixed from this + # file -- if these tests ever fail again with ECONNREFUSED on 127.0.0.1, + # check that the runner still puts jobs on an IPv6-enabled network. - chown -R node:node "$CI_PROJECT_DIR" script: - su node -p -c "npm ci --ignore-scripts"