1.6 Story 1.6: Configure MR Blocking and Scheduled Jobs

Story 1-6: Configure MR Blocking and Scheduled Jobs

Sprint key: 1-6-configure-mr-blocking-and-scheduled-jobs

Related to #658 (closed)

CI Pipeline Configuration

MR Pipeline Blocking (quality gate):

• workflow:rules prevents duplicate branch+MR pipelines
• Mandatory jobs (lint, test, contract, config) block MRs — no allow_failure
• Non-blocking jobs have allow_failure: true (safety net)

Scheduled Jobs (nightly via pipeline schedule):

• scheduled:integration — starts full Docker Compose stack, health checks, collects logs
• scheduled:e2e-mobile — starts Android emulator with KVM, runs Patrol E2E tests
• Dynamic env injection from env template — CI variables auto-injected
• Early fail validation for required CI variables

Manual Jobs:

• manual:rag-quality — on-demand GPU job (placeholder for Epic 8)

Mutual Exclusion:

• resource_group: e2e-runner — prevents schedule and merge-train E2E from running concurrently

Flutter Mobile Fixes

• Settings component — loading/error states now show header + account management buttons (no blank screen)
• E2E config — dart-define support for E2E_KEYCLOAK_URL and E2E_BACKEND_URL (CI)
• Patrol tests — robust waits (30s), backend-unreachable fallback, admin API delete fallback, pressBack after logout
• Type fixes — _Map<dynamic, dynamic> in AppTokens/i18n, DsModal Row overflow, InsecureHttpClient timeout

patrol-wrapper.sh CI Support

• Environment variable fallback (CI or .env file)
• ADB keepalive with disconnect/reconnect pattern
• Keycloak URL helper (CI nginx vs local)
• SSL certificate setup for CI emulator

Runner Infrastructure (Ansible)

• KVM device passthrough (devices = ["/dev/kvm"]) — no privileged mode
• Udev rule 99-kvm-permissions.rules — chmod 666 /dev/kvm for userns-remap compatibility (replaces --userns host)
• Socket proxy: BUILD API enabled, userns_mode: host on proxy container, DOCKER_HOST=172.17.0.1
• Runner: 4g memory, tags [docker, genie-ai, kvm], run_untagged=true
• Documented in deploy/ansible/GITLAB-RUNNER.md

Configuration Fixes

• config-and-sleep.sh — aligned to KEYCLOAK_PASSWORD variable
• docker-compose.yaml — password policy quoting fix
• env — password policy uncommented

CI Variables (13 total)

Required in Settings → CI/CD → Variables (all raw, protected=false):

ARANGO_PASSWORD, POSTGRES_PASSWORD, KONG_DB_PASSWORD,
KEYCLOAK_DB_PASSWORD, KEYCLOAK_ADMIN_PASSWORD,
KEYCLOAK_CLIENT_SECRET, GENIE_ADMIN_PASSWORD,
GENIE_ADMIN_EMAIL, KEYCLOAK_PROXY_CLIENT_SECRET,
KC_DATAPREP_CLIENT_SECRET, TRANSLATION_CACHE_PASSWORD,
KC_MOBILE_CLIENT_ID, KC_MOBILE_REDIRECT_SCHEME

Known Limitations

• Emulator OOM on 15 GB host — QEMU 2048 MB container uses ~5 GB actual; infrastructure needs more RAM
• Socket proxy cannot filter UsernsMode in container creation requests — defense-in-depth gap accepted

Post-Merge Steps

1. Enable "Pipelines must succeed" in Settings → Merge Requests
2. Create nightly pipeline schedule (e.g., 0 2 * * *)
3. Mark CI variables as protected=true after merge to main