From 672d275f5c35fd8d3cdd06c530d4ae629912e4f3 Mon Sep 17 00:00:00 2001 From: rajames Date: Fri, 6 Nov 2026 20:43:42 +0000 Subject: [PATCH] ci: no quick check on master after a merge (#119); the runner image's recipe (#120) Captain Bob, 2026-11-06: a small server, a little sluggish. Each change cost about an hour of runner time; the gate itself is about 15 minutes. #119 -- build.yml runs on pushes to the working branch only. What reaches master arrives through a PR whose content just passed acceptance; checking it again cost ~23 minutes after every merge. #120, first step -- ci/runner-image/Dockerfile: gitea/runner-images' Ubuntu 24.04 (with Node, for the actions) plus what make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0 installs -- run from the Makefile itself, not a copied list -- and Maven for publishing. .gitea/workflows/runner-image.yml builds it and publishes it to the package registry as lithosananke-runner:. The workflows switch to it in a later change, once it is published and has passed acceptance. It needs the runner to lend jobs its Docker daemon (container.docker_host: automount) and a PACKAGES_TOKEN secret, unless the Actions token may publish packages. make init does git lfs install --local only inside a checkout: the image build is not one. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2 --- .gitea/workflows/build.yml | 7 +++-- .gitea/workflows/runner-image.yml | 49 +++++++++++++++++++++++++++++++ Makefile | 3 +- ci/runner-image/Dockerfile | 14 +++++++++ 4 files changed, 69 insertions(+), 4 deletions(-) create mode 100644 .gitea/workflows/runner-image.yml create mode 100644 ci/runner-image/Dockerfile diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 9033d8ca..176115b6 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -1,5 +1,6 @@ -# The quick check on every push: each board's image builds, and the v4 tests pass. A pull -# request into master is gated by acceptance.yml, the full acceptance protocol. +# The quick check on every push to the working branch: each board's image builds, and the v4 +# tests pass. A pull request into master is gated by acceptance.yml, the full acceptance protocol; +# master itself is not checked again after a merge -- its content is what acceptance just passed. # Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots, # the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the # documents to Nexus). @@ -7,7 +8,7 @@ name: Build on: push: - branches: [master, StarForth-v4.0.0] + branches: [StarForth-v4.0.0] # not master: what reaches it has just passed acceptance (#119) workflow_dispatch: jobs: diff --git a/.gitea/workflows/runner-image.yml b/.gitea/workflows/runner-image.yml new file mode 100644 index 00000000..25690dbe --- /dev/null +++ b/.gitea/workflows/runner-image.yml @@ -0,0 +1,49 @@ +# Builds the CI runner image (ci/runner-image/Dockerfile, #120) and publishes it to this +# repository's package registry, tagged with the commit it was built from: +# +# gitea.starshipos-f18.org/rajames/lithosananke-runner: +# +# The workflows name that tag as their container once it is published and has passed acceptance. +# +# Needs the runner to give jobs its Docker daemon (act_runner config.yaml, container.docker_host: +# automount), and a secret PACKAGES_TOKEN -- a token with write:package -- unless the Actions +# token may publish packages here. +name: Runner image + +on: + push: + branches: [master] + paths: ['ci/runner-image/**', 'Makefile'] + workflow_dispatch: + +jobs: + image: + name: Build and publish the runner image + runs-on: ubuntu-latest + container: + image: gitea/runner-images:ubuntu-24.04-v26.11.03 + timeout-minutes: 60 + steps: + - uses: actions/checkout@v4 + with: + lfs: false + + - name: Docker is reachable + run: | + docker info >/dev/null 2>&1 || { + echo "::error::No Docker daemon in this job. Set container.docker_host: automount in the runner's config.yaml, or build the image on the server: see this file's header." + exit 1; } + + - name: Build and publish + env: + TOKEN: ${{ secrets.PACKAGES_TOKEN || secrets.GITEA_TOKEN }} + run: | + set -e + img=gitea.starshipos-f18.org/rajames/lithosananke-runner + tag=$(git rev-parse --short=12 HEAD) + ctx=$(mktemp -d) # not the repository: 7 GB of context + cp -r Makefile boards ci/runner-image/Dockerfile "$ctx/" + docker build -t "$img:$tag" "$ctx" + echo "$TOKEN" | docker login gitea.starshipos-f18.org -u rajames --password-stdin + docker push "$img:$tag" + echo "Published $img:$tag" diff --git a/Makefile b/Makefile index d9afdf7b..5cab3b9a 100644 --- a/Makefile +++ b/Makefile @@ -314,7 +314,8 @@ init: $(SUDO) env DEBIAN_FRONTEND=noninteractive apt-get update -qq $(SUDO) env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \ $(INIT_COMMON) $(if $(filter 0,$(INIT_DOCS)),,$(INIT_DOCPKGS)) $(foreach a,$(INIT_ARCHES),$(INIT_$(a))) - git lfs install --local + @# the LFS hook for this checkout -- none when init runs outside one (the CI image, ci/runner-image) + if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then git lfs install --local; fi $(call fetch,$(SYFT_TGZ),$(SYFT_URL),$(SYFT_SHA_$(SYFT_ARCH))) @mkdir -p $(INIT_TOOLS)/syft-$(SYFT_VERSION) tar -xzf $(INIT_DL)/$(SYFT_TGZ) -C $(INIT_TOOLS)/syft-$(SYFT_VERSION) syft diff --git a/ci/runner-image/Dockerfile b/ci/runner-image/Dockerfile new file mode 100644 index 00000000..542b73de --- /dev/null +++ b/ci/runner-image/Dockerfile @@ -0,0 +1,14 @@ +# The CI runner image (#120): gitea/runner-images' Ubuntu 24.04 with Node -- which +# actions/checkout and upload-artifact run on -- plus everything the jobs install at their start: +# what `make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0` installs (taken from the Makefile +# itself, not copied, so the two cannot drift), and Maven and a JRE for the publish steps. +# +# Built by .gitea/workflows/runner-image.yml, from a context of the Makefile, boards/ and this file. +FROM gitea/runner-images:ubuntu-24.04-v26.11.03 +COPY Makefile /opt/starship-init/Makefile +COPY boards /opt/starship-init/boards +WORKDIR /opt/starship-init +RUN make --no-print-directory ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0 \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless \ + && rm -rf /var/lib/apt/lists/* /opt/starship-init/build/cache/downloads +WORKDIR /