The runner now reads a config file with a fixed cache proxy port (28100),
and ufw lets the Docker job networks (10.0.0.0/8) reach that port only.
Refs #234
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The runner starts `shell: bash` steps as `bash -e -o pipefail`, so run 453
stopped at the first TIMEOUT instead of probing the other addresses. Each
probe now swallows its own exit code, and the env listing and the forge
lookup no longer abort the step when they come back empty.
Refs #234
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diagnostic only, never to be merged. Since #232 no workflow calls the
Actions cache, so nothing has shown whether a job container can reach the
cache server today. This job prints the cache address the runner
advertises (path redacted, since job logs are public), probes it over TCP
next to other ports and host addresses, and round-trips a tiny payload
through actions/cache. It is green only if the payload comes back.
Refs #234
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
