diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 9033d8ca..176115b6 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -1,5 +1,6 @@ -# The quick check on every push: each board's image builds, and the v4 tests pass. A pull -# request into master is gated by acceptance.yml, the full acceptance protocol. +# The quick check on every push to the working branch: each board's image builds, and the v4 +# tests pass. A pull request into master is gated by acceptance.yml, the full acceptance protocol; +# master itself is not checked again after a merge -- its content is what acceptance just passed. # Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots, # the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the # documents to Nexus). @@ -7,7 +8,7 @@ name: Build on: push: - branches: [master, StarForth-v4.0.0] + branches: [StarForth-v4.0.0] # not master: what reaches it has just passed acceptance (#119) workflow_dispatch: jobs: diff --git a/.gitea/workflows/runner-image.yml b/.gitea/workflows/runner-image.yml new file mode 100644 index 00000000..25690dbe --- /dev/null +++ b/.gitea/workflows/runner-image.yml @@ -0,0 +1,49 @@ +# Builds the CI runner image (ci/runner-image/Dockerfile, #120) and publishes it to this +# repository's package registry, tagged with the commit it was built from: +# +# gitea.starshipos-f18.org/rajames/lithosananke-runner: +# +# The workflows name that tag as their container once it is published and has passed acceptance. +# +# Needs the runner to give jobs its Docker daemon (act_runner config.yaml, container.docker_host: +# automount), and a secret PACKAGES_TOKEN -- a token with write:package -- unless the Actions +# token may publish packages here. +name: Runner image + +on: + push: + branches: [master] + paths: ['ci/runner-image/**', 'Makefile'] + workflow_dispatch: + +jobs: + image: + name: Build and publish the runner image + runs-on: ubuntu-latest + container: + image: gitea/runner-images:ubuntu-24.04-v26.11.03 + timeout-minutes: 60 + steps: + - uses: actions/checkout@v4 + with: + lfs: false + + - name: Docker is reachable + run: | + docker info >/dev/null 2>&1 || { + echo "::error::No Docker daemon in this job. Set container.docker_host: automount in the runner's config.yaml, or build the image on the server: see this file's header." + exit 1; } + + - name: Build and publish + env: + TOKEN: ${{ secrets.PACKAGES_TOKEN || secrets.GITEA_TOKEN }} + run: | + set -e + img=gitea.starshipos-f18.org/rajames/lithosananke-runner + tag=$(git rev-parse --short=12 HEAD) + ctx=$(mktemp -d) # not the repository: 7 GB of context + cp -r Makefile boards ci/runner-image/Dockerfile "$ctx/" + docker build -t "$img:$tag" "$ctx" + echo "$TOKEN" | docker login gitea.starshipos-f18.org -u rajames --password-stdin + docker push "$img:$tag" + echo "Published $img:$tag" diff --git a/Makefile b/Makefile index d9afdf7b..5cab3b9a 100644 --- a/Makefile +++ b/Makefile @@ -314,7 +314,8 @@ init: $(SUDO) env DEBIAN_FRONTEND=noninteractive apt-get update -qq $(SUDO) env DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \ $(INIT_COMMON) $(if $(filter 0,$(INIT_DOCS)),,$(INIT_DOCPKGS)) $(foreach a,$(INIT_ARCHES),$(INIT_$(a))) - git lfs install --local + @# the LFS hook for this checkout -- none when init runs outside one (the CI image, ci/runner-image) + if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then git lfs install --local; fi $(call fetch,$(SYFT_TGZ),$(SYFT_URL),$(SYFT_SHA_$(SYFT_ARCH))) @mkdir -p $(INIT_TOOLS)/syft-$(SYFT_VERSION) tar -xzf $(INIT_DL)/$(SYFT_TGZ) -C $(INIT_TOOLS)/syft-$(SYFT_VERSION) syft diff --git a/ci/runner-image/Dockerfile b/ci/runner-image/Dockerfile new file mode 100644 index 00000000..542b73de --- /dev/null +++ b/ci/runner-image/Dockerfile @@ -0,0 +1,14 @@ +# The CI runner image (#120): gitea/runner-images' Ubuntu 24.04 with Node -- which +# actions/checkout and upload-artifact run on -- plus everything the jobs install at their start: +# what `make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0` installs (taken from the Makefile +# itself, not copied, so the two cannot drift), and Maven and a JRE for the publish steps. +# +# Built by .gitea/workflows/runner-image.yml, from a context of the Makefile, boards/ and this file. +FROM gitea/runner-images:ubuntu-24.04-v26.11.03 +COPY Makefile /opt/starship-init/Makefile +COPY boards /opt/starship-init/boards +WORKDIR /opt/starship-init +RUN make --no-print-directory ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0 \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless \ + && rm -rf /var/lib/apt/lists/* /opt/starship-init/build/cache/downloads +WORKDIR / diff --git a/demo/README.md b/demo/README.md index e04128c4..02df67a1 100644 --- a/demo/README.md +++ b/demo/README.md @@ -21,8 +21,8 @@ XWiki "Try it" page (iframe) -> Apache: TLS, websocket -> ttyd -> start-session. | `console.py` | Joins the visitor's terminal to the machine only once it runs, discarding keys typed while it loads | | `qemu-args.sh` | The machine, shared by the two above: a resumed machine must match the saved one exactly | | `starshipos-demo.service` | ttyd as a systemd service, on localhost, at most 3 sessions (#114) | -| `apache-demo.conf` | Example vhost: TLS, the websocket, framing allowed for the XWiki only (#115) | -| `xwiki-try-it.xwiki` | The XWiki "Try it" page, with the console embedded (XWiki 2.1 syntax) | +| `apache-demo.conf` | Example vhost: TLS, the websocket, framing allowed for the `.com` only (#115) | +| `xwiki-try-it.xwiki` | The "Try it" page, its own page on the `.com` XWiki (`TryIt`), in the landing page's style | ## What a visitor cannot do @@ -45,7 +45,7 @@ DEMO_PROMPT='[zuse@Hera]' demo/make-snapshot.sh /tmp/StarshipOS.iso /var/lib/sta ``` Then install `starshipos-demo.service` and `apache-demo.conf` (their headers say how), and paste -`xwiki-try-it.xwiki` into a page on the XWiki. The `{{html}}` macro there needs a page author +`xwiki-try-it.xwiki` into the page `TryIt` on the `.com` XWiki. The `{{html}}` macro there needs a page author with script rights. A new image means re-running `build-iso.sh` and `make-snapshot.sh`: the saved machine belongs to diff --git a/demo/apache-demo.conf b/demo/apache-demo.conf index 7392b3b9..000f14e4 100644 --- a/demo/apache-demo.conf +++ b/demo/apache-demo.conf @@ -2,14 +2,14 @@ # name, the certificate paths and the XWiki allowed to embed it are Captain Bob's to set. # a2enmod proxy proxy_http proxy_wstunnel headers ssl rewrite - ServerName try.strshipos.com + ServerName try.starshipos-f18.com SSLEngine on - SSLCertificateFile /etc/letsencrypt/live/try.strshipos.com/fullchain.pem - SSLCertificateKeyFile /etc/letsencrypt/live/try.strshipos.com/privkey.pem + SSLCertificateFile /etc/letsencrypt/live/try.starshipos-f18.com/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/try.starshipos-f18.com/privkey.pem - # The terminal may be framed by the XWiki's "Try it" page, and by nothing else. + # The terminal may be framed by the "Try it" page on the .com (TryIt), and by nothing else. Header always unset X-Frame-Options - Header always set Content-Security-Policy "frame-ancestors https://www.starshipos-f18.org https://starshipos-f18.org" + Header always set Content-Security-Policy "frame-ancestors https://starshipos-f18.com https://www.starshipos-f18.com" ProxyPreserveHost On RewriteEngine On diff --git a/demo/xwiki-try-it.xwiki b/demo/xwiki-try-it.xwiki index 45f0c280..73e9183d 100644 --- a/demo/xwiki-try-it.xwiki +++ b/demo/xwiki-try-it.xwiki @@ -1,28 +1,71 @@ -= Try StarshipOS = +{{box cssClass="floatinginfobox" title="**Your Machine**"}} +* **System**: StarshipOS -- LithosAnanke v2.1.0, StarForth v4 (the F18 engine) +* **Architecture**: amd64, emulated +* **Build**: the latest that passed acceptance on all three architectures +* **Logged in as**: Zuse, the superuser -- of this machine only +* **Network**: none +* **Lasts**: up to 30 minutes, then it is gone +{{/box}} -This is StarshipOS, running. Below is the console of a real StarshipOS machine -- the amd64 build -from the latest version that passed its acceptance tests -- started just for you. You are logged -in as Zuse, the superuser, of a machine that exists only for your session: there is nothing to += [[Try StarshipOS>>https://starshipos-f18.com/bin/view/TryIt/]] = + +This is a real StarshipOS machine, started just for you and already at its prompt. It is not a +simulation of StarshipOS and not a recording: the console below is the serial console of an +amd64 machine running the same image the project publishes every night. You are logged in as +**Zuse**, the superuser -- of a machine that exists only for your session. There is nothing to break, and nothing you do is kept. Close the page and it is gone. {{html clean="false"}} - {{/html}} -== Things to try == +{{info}} +If the console does not connect, every machine we run is in use -- try again in a few minutes. +{{/info}} -StarshipOS speaks FORTH. Type a line and press Enter; ##ok## means it was done. +---- -|=You type|=It answers -|##3 4 + .##|##7 ok## -- numbers go on a stack, ##+## adds the top two, ##.## prints the result -|##: SQUARE DUP * ;##|##ok## -- you have just defined a new word -|##7 SQUARE .##|##49 ok## -- and used it +== Things to Try == -== What you are looking at == +StarshipOS speaks **FORTH**. Type a line and press Enter; ##ok## means it was done. -* A machine of your own, booted from the same image the project publishes every night, resumed at - its prompt so you do not wait for it to boot. -* It runs in an emulator on our server. It has no network, and it lasts at most 30 minutes. -* If the console does not connect, the few machines we run are all in use -- try again in a few - minutes. +|=You type|=It answers|=What happened +|##3 4 + .##|##7 ok##|Numbers go on a stack; ##+## adds the top two; ##.## prints the result +|##: SQUARE DUP * ;##|##ok##|You defined a new word, ##SQUARE## +|##7 SQUARE .##|##49 ok##|...and used it, as if it had always been there + +---- + +== What You Are Looking At == + +=== A Machine of Your Own === + +Each visitor gets a separate machine, resumed at its prompt from one that booted, passed its +power-on self-test (538 checks) and logged Zuse in -- so you do not wait for it to boot. When you +leave, or after 30 minutes, it is stopped and discarded; the next visitor starts from the same +clean state. + +=== The Build === + +The demo always runs the most recent build that passed the project's **acceptance protocol**: +booting on amd64, aarch64 and riscv64, the PC stick loaded the way a PC loads it, and the 32-bit +build's tests -- the same checks every change must pass before it reaches the main line. + +=== Zuse === + +**Zuse** is StarshipOS's superuser: whoever holds Zuse's identity drive. Here that drive is a +demo Zuse minted for this page alone, attached to every session with its writes thrown away -- +not anyone's real identity. + +{{warning}} +The demo runs in an emulator on a small server: it is slower than StarshipOS on real hardware, +and only a few people can use it at once. +{{/warning}} + +---- + +== Find Out More == + +* [[StarshipOS>>https://starshipos-f18.com/bin/view/Main/]] -- what StarshipOS is, and how it is built +* [[The source>>https://gitea.starshipos-f18.org/rajames/LithosAnanke]] -- the kernel, StarForth, and this demo (##demo/##)