From 12b78453cfcb03a861ce107b609f4a86751bca2c Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Wed, 1 Jul 2026 13:35:33 +0800
Subject: [PATCH] fix(runner): prioritize harbor ssh root cause in queue status

---
 ops/runner/read-public-gitea-actions-queue.py | 16 ++++-----
 .../test_read_public_gitea_actions_queue.py   | 36 +++++++++++++++++++
 2 files changed, 44 insertions(+), 8 deletions(-)

diff --git a/ops/runner/read-public-gitea-actions-queue.py b/ops/runner/read-public-gitea-actions-queue.py
index 78a9f550..1ce0eef1 100644
--- a/ops/runner/read-public-gitea-actions-queue.py
+++ b/ops/runner/read-public-gitea-actions-queue.py
@@ -776,6 +776,14 @@ def build_readback(
             if no_matching
             else "blocked_latest_visible_cd_run"
             if latest_cd_visible_blocked
+            else "blocked_harbor_110_remote_ssh_publickey_auth_stalled"
+            if harbor_110_repair_log_classifier["remote_ssh_publickey_auth_stalled"]
+            else "blocked_harbor_110_remote_control_channel_unavailable"
+            if harbor_110_repair_log_classifier["remote_control_channel_unavailable"]
+            else "blocked_harbor_110_remote_local_registry_v2_unavailable"
+            if harbor_110_repair_log_classifier["local_registry_v2_unavailable"]
+            else "blocked_harbor_public_registry_v2_unavailable_after_remote_repair"
+            if harbor_110_repair_log_classifier["public_registry_v2_unavailable"]
             else "blocked_current_cd_waiting_behind_stale_harbor_110_repair_readback"
             if (
                 latest_cd_waiting
@@ -785,14 +793,6 @@ def build_readback(
             if current_cd_waiting_behind_harbor_110_repair_running
             else "blocked_current_cd_workflow_waiting_for_runner_or_queue"
             if latest_cd_waiting
-            else "blocked_harbor_110_remote_ssh_publickey_auth_stalled"
-            if harbor_110_repair_log_classifier["remote_ssh_publickey_auth_stalled"]
-            else "blocked_harbor_110_remote_control_channel_unavailable"
-            if harbor_110_repair_log_classifier["remote_control_channel_unavailable"]
-            else "blocked_harbor_110_remote_local_registry_v2_unavailable"
-            if harbor_110_repair_log_classifier["local_registry_v2_unavailable"]
-            else "blocked_harbor_public_registry_v2_unavailable_after_remote_repair"
-            if harbor_110_repair_log_classifier["public_registry_v2_unavailable"]
             else "blocked_harbor_110_repair_failed"
             if (
                 build_log_classifier["harbor_public_route_blocked_or_retrying"]
diff --git a/ops/runner/test_read_public_gitea_actions_queue.py b/ops/runner/test_read_public_gitea_actions_queue.py
index 68aca759..a6fab864 100644
--- a/ops/runner/test_read_public_gitea_actions_queue.py
+++ b/ops/runner/test_read_public_gitea_actions_queue.py
@@ -623,6 +623,42 @@ def test_build_readback_blocks_cd_waiting_behind_stale_harbor_running_readback()
     assert "CURRENT_CD_WAITING_BEHIND_HARBOR_110_REPAIR_RUNNING=1" in summary
 
 
+def test_harbor_ssh_blocker_takes_precedence_over_current_cd_waiting() -> None:
+    module = _load_module()
+    payload = module.build_readback(
+        actions_html=_actions_html_cd_waiting_with_non110_no_matching(),
+        actions_list_http_status=401,
+        actions_list_payload={"message": "token is required"},
+        cd_jobs_http_status=200,
+        cd_jobs_payload={"jobs": [], "total_count": 0},
+        harbor_110_repair_jobs_http_status=200,
+        harbor_110_repair_jobs_payload={"jobs": [], "total_count": 0},
+        latest_harbor_110_repair_log_http_status=200,
+        latest_harbor_110_repair_log_text=(
+            _harbor_110_repair_publickey_auth_stalled_log()
+        ),
+    )
+
+    assert payload["status"] == "blocked_harbor_110_remote_ssh_publickey_auth_stalled"
+    assert payload["readback"]["latest_visible_cd_run_waiting"] is True
+    assert (
+        payload["readback"][
+            "latest_visible_harbor_110_repair_remote_ssh_publickey_auth_stalled"
+        ]
+        is True
+    )
+    assert (
+        payload["readback"][
+            "latest_visible_harbor_110_repair_remote_ssh_publickey_offer_timeout"
+        ]
+        is True
+    )
+    assert (
+        payload["rollups"]["harbor_110_repair_remote_ssh_publickey_auth_stalled"]
+        is True
+    )
+
+
 def test_build_readback_classifies_harbor_502_after_110_repair_jobs_success() -> None:
     module = _load_module()
     payload = module.build_readback(