ci-log-publish.mjs

Publishes a CI job's captured log to a ci-logs/<run> branch the token API can read back.

Contributor tooling › ci-log-publish.mjs

What it does

Scrubs the job's tee'd gate.log — the secret-scan patterns plus the runner's own token — and pushes it as an orphan single-file commit on branch ci-logs/<run-number>. The push rides the checkout's persisted credential, because the runner token cannot create refs over the API. It then prunes those branches to the newest 50, by push-delete over the same channel. Every workflow job runs it as its last step, green or red, because no HTTP route serves this Forge's job logs after the fact.

Usage

Every workflow's final step, if: always() and continue-on-error, runs it bare:

node tools/ci-log-publish.mjs

Replace the following: nothing — the script takes no arguments. It reads gate.log from the working directory and GITHUB_TOKEN, GITHUB_API_URL, GITHUB_REPOSITORY and GITHUB_RUN_NUMBER from the runner's environment. GW_CI_LOG_FORCE_FAIL forces the failure path, for verifying that a publish failure leaves a green run green.

Options

No options.

Inputs and outputs

On success the log is readable with the repository token and the step prints the branch it published. On any failure the script prints one warning and exits 0 — publishing is best-effort by contract, and the job's own log keeps the only copy.

Examples

Read a published log back — the after-the-fact read this Forge otherwise refuses to serve. Auth comes from the git credential store, so the line survives PowerShell's curl alias:

node tools/forge.mjs ci-log <run-number> --out run.log

Notes

Capture is the workflows' own set -o pipefail; ... 2>&1 | tee -a gate.log — pipefail keeps a failing step's exit code, so this script never decides whether a run is red. Retention is hard: the newest 50 ci-logs/* branches survive a publish, older ones are deleted, and a branch whose name is not ci-logs/<digits> is never touched. A run killed before its final step publishes nothing — the same hole the digest path has always had.

Source

tools/ci-log-publish.mjs — part of Contributor tooling