From c73a79a2435b05cc166a6ca042d7976522eb57e4 Mon Sep 17 00:00:00 2001 From: jenkins Date: Thu, 6 Aug 2026 21:16:17 -0300 Subject: [PATCH] feat(ariadne): allowlist clear_stuck_agent_pods A build whose agent never started is a distinct failure from one that lost a connection mid-run, and a plain retry queues behind the same stuck pods. The remediation clears pods that have already succeeded or failed - Ariadne's existing scheduled cleanup - and only then rebuilds. Mapping jenkins_agent_provisioning_failure to it keeps the one-classification- one-action rule: a diagnosis asking for this action under any other classification is still refused before anything runs. Co-Authored-By: Claude Opus 5 --- services/maintenance/apps/ariadne-deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml index 1251a1c7b..896f8cd1c 100644 --- a/services/maintenance/apps/ariadne-deployment.yaml +++ b/services/maintenance/apps/ariadne-deployment.yaml @@ -465,13 +465,13 @@ spec: - name: ARIADNE_HERMES_AUTOREMEDIATION_ENABLED value: "true" - name: ARIADNE_HERMES_ALLOWED_ACTIONS - value: repair_demo_fixture,retry_transient_infra,reclaim_workspace_storage + value: repair_demo_fixture,retry_transient_infra,reclaim_workspace_storage,clear_stuck_agent_pods # Each classification maps to exactly one action id. A diagnosis # whose classification is absent here can never reach an action, # and a diagnosis asking for an action that is not its # classification's own is refused before anything runs. - name: ARIADNE_HERMES_ACTION_CLASSIFICATIONS - value: known_demo_fixture_failure=repair_demo_fixture,transient_infra_failure=retry_transient_infra,workspace_storage_exhausted=reclaim_workspace_storage + value: known_demo_fixture_failure=repair_demo_fixture,transient_infra_failure=retry_transient_infra,workspace_storage_exhausted=reclaim_workspace_storage,jenkins_agent_provisioning_failure=clear_stuck_agent_pods # Adds a service's own namespace to log evidence alongside # jenkins, so a build failure that coincides with the service being # unhealthy carries some trace of the service. Only mapped jobs are