ci(openemr-cmd): add arm64-smoke-e2e on ubuntu-24.04-arm (daily-cron + workflow_dispatch)

[bradymiller]

Summary

Replaces the abandoned macOS smoke attempt (#844, closed) with an arm64 Linux runner. Adds one nonworktree-style stack on ubuntu-24.04-arm to validate the openemr image's arm64 manifest works end-to-end.

Why arm64 Linux instead of macOS

Free GH-hosted macos-14 (Apple Silicon arm64) fundamentally can't run Linux VMs reliably on the free pool — VZ driver needs nested virtualization (not available), QEMU panics in Lima's host agent with abort traps. After 4 iterations trying colima/Lima, abandoned the macOS path.

ubuntu-24.04-arm gives us the same signal we actually wanted: arm64-specific image regressions. The openemr image is multi-arch (amd64 + arm64). Docker auto-selects the arm64 manifest on arm64 hosts. Apple Silicon Mac developers pull the arm64 variant via Docker Desktop's Linux VM, so catching arm64-only image bugs here within 24h saves them from finding them first.

Linux arm64 runners use native cgroups/namespaces on an arm64 host kernel — same fast/supported path as ubuntu-22.04 for amd64, just on arm64. Zero virtualization, no colima brittleness.

Scope (intentionally narrow vs the amd64 jobs)

Job	amd64 (existing)	arm64 (new)
worktree lifecycle	✓	—
multi-concurrent (4 stacks)	✓	—
nonworktree lifecycle	✓	✓ (this job)
functional round-trip	✓	—
prek install + real commit	✓	—

One stack, one health check, one HTTP smoke, one bind-mount ownership assertion, one teardown. Heavier arm64 coverage can be filed if this smoke ever catches a real regression.

What this catches that amd64-only doesn't

• arm64-specific image regressions in openemr/openemr:flex (missing arm64 deps, arm64-only segfaults, etc.)
• HOST_UID entrypoint adoption working in the arm64 image variant (verified by the bind-mount ownership assertion — same probe as the amd64 nonworktree job, but exercises the arm64 entrypoint specifically)

What this does NOT catch (out of scope)

• macOS-specific concerns: HFS+/APFS case-insensitivity, BSD coreutils edges, Docker Desktop bind-mount semantics. Most are covered at the script level by the bats portability memory note; the rest are "would be nice if a contributor reports a bug" rather than CI requirements.

Cost

~25 min outer timeout. Public-repo arm64 runners are free as of mid-2024.

Test plan

• Workflow YAML validates (verified locally)
• arm64 runner picks up the job within reasonable time (free arm64 Linux pool is much larger than macOS)
• Image pull succeeds (arm64 manifest selected automatically)
• Container reaches healthy
• HTTP smoke passes
• Bind-mount-ownership assertion passes (HOST_UID adoption working on arm64 entrypoint)
• Teardown leaves no orphans

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Added a new arm64 smoke test job to better validate the app on ARM Linux by exercising the arm64 image manifest end-to-end.
  • Includes pre-flight checks, service readiness verification, basic HTTP smoke testing, and validation of correct file ownership behavior.
  • Improved failure diagnostics to simplify troubleshooting when the job fails.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a21163a8-ef0f-4419-982a-04d7b61ff6bc

📥 Commits

Reviewing files that changed from the base of the PR and between e701435 and 605a352.

📒 Files selected for processing (1)

• .github/workflows/test-bats-openemr-cmd-real-docker.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/test-bats-openemr-cmd-real-docker.yml

---

📝 Walkthrough

Walkthrough

Adds an arm64-smoke-e2e job to the real-docker workflow, with arm64 runner selection, stack startup and health polling, an HTTP smoke check, host ownership validation, teardown, and failure diagnostics.

Changes

Arm64 smoke workflow

Layer / File(s)	Summary
Comment and job setup .github/workflows/test-bats-openemr-cmd-real-docker.yml	The workflow intro comments gain an arm64-smoke-e2e entry, and the new job is defined with the arm64 runner plus initial checkout and clone steps.
Stack startup and health wait .github/workflows/test-bats-openemr-cmd-real-docker.yml	The job brings up openemr/docker/development-easy with openemr-cmd up and waits for development-easy-openemr-1 to report healthy.
Smoke checks and teardown .github/workflows/test-bats-openemr-cmd-real-docker.yml	The job checks http://localhost:8300/, verifies sites/default/sqlconf.php ownership against the runner UID, and shuts the stack down with openemr-cmd down.
Failure diagnostics .github/workflows/test-bats-openemr-cmd-real-docker.yml	On failure, the job gathers system, container, volume, and container log diagnostics for the arm64 run.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• openemr/openemr-devops#818: Modifies the same workflow file and extends the openemr-cmd real-docker e2e setup with another job variant.
• openemr/openemr-devops#831: Also changes the test-bats-openemr-cmd-real-docker.yml workflow around development-easy, port 8300 readiness, and teardown behavior.
• openemr/openemr-devops#843: Shares the same development-easy startup path and sites/default/sqlconf.php ownership validation in the workflow area.

Poem

A bunny tapped the CI drum,
On arm64, the stack came up hum.
Port 8300 gave a cheerful squeak,
Then logs and volumes came down tidy and meek.
🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding the arm64-smoke-e2e CI job on ubuntu-24.04-arm.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test-bats-openemr-cmd-real-docker.yml:
- Around line 43-48: The workflow comments/docs are out of sync with the actual
trigger behavior: the ARM smoke job is no longer PR-skipped because
`pull_request` is intentionally enabled in the workflow definition. Update the
descriptive comments and any related job names/labels around `arm64-smoke-e2e`
and the workflow trigger section to match the temporary PR trigger, and remove
or reword any “daily-cron only” / PR-skipped wording so it reflects the current
`pull_request` + scheduled/manual behavior.
- Around line 1737-1748: Both checkout steps are using the floating
actions/checkout@v7 tag, which violates the workflow pinning policy. Update each
actions/checkout reference in this job to a specific full commit SHA so the
openemr-devops checkout and the later openemr/openemr checkout are both
immutable and not affected by tag retargeting.
- Around line 1833-1835: The cleanup step for openemr-cmd is not actually
running the volume-removal path it advertises, so update the teardown command in
the workflow step named openemr-cmd down -v (cleanup) to include the -v flag.
Make the change in the openemr-cmd down invocation so the job genuinely
exercises the full down -v cleanup contract.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a5626ae-0a49-490c-979a-dbaac4840167

📥 Commits

Reviewing files that changed from the base of the PR and between 8168856 and e701435.

📒 Files selected for processing (1)

• .github/workflows/test-bats-openemr-cmd-real-docker.yml