p24-infra-issue-pipeline-cron

p24-infra Issue-Pipeline Cron — Operations

Autonomous nightly that processes p24-infra’s own GitHub issue pipeline (triage → Design → Review) via the /process-issues skill. This is the p24-infra analogue of the et-operational-platform claude-nightly cron.

At a glance

Field	Value
Host	IONOS vps-i1 (217.154.82.162)
Schedule	0 23 * * * — 23:00 UTC daily
Cron file	/etc/cron.d/p24-infra-nightly
Wrapper	/root/p24-infra-nightly.sh (server-local, not in repo)
Runs as	claude-runner (root cron drops privileges via runuser)
Working clone	/home/claude-runner/p24-infra (branch main) — dedicated, NOT the live /opt/p24-infra deployment checkout
Skill	/process-issues (--allowedTools Bash,Read,Edit,Write,Glob,Grep)
Log	/var/log/p24-infra-nightly.log
Repo	radieu/p24-infra (PRs target main)

✅ Server-side wrapper verified & corrected (#5362, 2026-08-04). The dev→main corrections in this doc were made after the 2026-07-08 gitflow simplification (#2513); the actual wrapper /root/p24-infra-nightly.sh on vps-i1 is server-local and not in this repo, so the doc change alone could not verify or fix it. An infra-task worker SSH’d to vps-i1 and found the live wrapper still doing git checkout dev / git reset --hard origin/dev / git pull origin dev against a dedicated clone that was 1830 commits behind origin/main — the exact stale-tree risk. The wrapper was corrected to origin/main (backup /root/p24-infra-nightly.sh.bak-5362, bash -n clean) and the dedicated clone /home/claude-runner/p24-infra was refreshed onto main at origin/main (0 commits behind). The stored remote is tokenless. No further action needed.

Scheduled at 23:00 UTC to stay clear of the et-app claude-nightly (02:07 UTC Mon–Fri) and the 02:00–04:00 UTC GitHub-Actions backup window.

What it does each run

1. Refreshes the dedicated clone to origin/main (reset --hard + pull), injecting the GitHub token at runtime and storing the remote tokenless.
2. Runs claude -p "/process-issues" as claude-runner. The skill triages new issues, posts Code-change-design comments, implements Design-ready issues, and opens PRs to main — all via gh.
3. Logs start/finish to /var/log/p24-infra-nightly.log. Does not commit anything into the repo itself; the skill creates its own branches/PRs.

Design rationale

• Dedicated clone, not /opt/p24-infra — the /opt checkout is the live deployment copy (carries uncommitted local state); issue processing must not switch branches or commit there.
• Everything runs as claude-runner — Claude Code refuses --dangerously-skip-permissions as root, and running git as root would leave root-owned objects in .git that block later claude-runner commits (the exact failure that broke the et-app nightly — see that cron’s history).

Prerequisites (already satisfied on vps-i1)

• claude-runner OAuth creds valid at /home/claude-runner/.claude/.credentials.json (with a refresh token, so they self-renew).
• /home/claude-runner/.claude-env exports GITHUB_TOKEN.
• gh CLI present; token has push/admin on radieu/p24-infra.

Caveat — no PowerShell

The /process-issues skill is written with PowerShell helper snippets, but pwsh is not installed on vps-i1. Claude adapts these to gh/bash at runtime (the same as the et-app nightly), so this is not a blocker. Set-PipelineState is a single gh issue edit --milestone call (milestone-only — the old GitHub Projects v2 board sync was removed), so the bash equivalent is trivial to reproduce if needed.

Run manually / test

# Full run (as cron does)
/root/p24-infra-nightly.sh >> /var/log/p24-infra-nightly.log 2>&1
 
# Watch
tail -f /var/log/p24-infra-nightly.log

Troubleshooting

Symptom	Likely cause / fix
Failed to authenticate. API Error: 401	claude-runner OAuth expired with empty refresh token. Copy a valid .credentials.json from /root/.claude/ → /home/claude-runner/.claude/, chown claude-runner, chmod 600.
detected dubious ownership	A git op ran as the wrong user. The wrapper runs everything as claude-runner; ensure nobody runs git in the clone as root.
insufficient permission for adding an object in .git/objects	Root-owned objects in the clone. chown -R claude-runner:claude-runner /home/claude-runner/p24-infra/.git.
Nothing processed	Check gh issue list --repo radieu/p24-infra --state open; confirm token still valid.