huskies: merge 1189 story Gitea Actions workflow: build the sled artifact on master merges and publish to the dev channel

2026-07-17 13:32:30 +00:00
parent 3ed3fdd6b0
commit bb5d7879ff
8 changed files with 538 additions and 0 deletions
@@ -0,0 +1,53 @@
+# Gitea Actions workflows
+
+## `release-artifact.yml`
+
+Triggers on every push to `master`. Builds the `linux-arm64` sled binary and
+publishes it to the "dev" release channel via `script/ci-publish-artifact`.
+
+### Runner registration
+
+The job targets the `arm64-mac` runner label. Register an `act_runner` on an
+Apple Silicon macOS host that has `cargo`/`rustc` and `curl` on `PATH`:
+
+```sh
+act_runner register \
+  --instance https://code.crashlabs.io \
+  --token <runner-registration-token> \
+  --labels arm64-mac
+act_runner daemon
+```
+
+The registration token comes from the repo's **Settings → Actions →
+Runners → Create new Runner** page in Gitea. Without a runner carrying the
+`arm64-mac` label, jobs from this workflow queue indefinitely.
+
+### Secrets
+
+Configure these under the repo's **Settings → Actions → Secrets**. Never
+commit credentials — the workflow only ever references them via
+`${{ secrets.* }}`.
+
+| Secret | Purpose |
+| --- | --- |
+| `HUSKIES_CHANNEL_URL` | Base URL of the dev release channel host. |
+| `HUSKIES_CHANNEL_TOKEN` | Bearer token authorised to publish artifacts to that channel. |
+
+### Channel host contract
+
+`script/ci-publish-artifact` expects the channel host at
+`HUSKIES_CHANNEL_URL` to implement:
+
+- `POST {HUSKIES_CHANNEL_URL}/<artifact-name>` — accepts the raw artifact
+  bytes as the request body. Requires `Authorization: Bearer <token>` and
+  `X-Git-Hash: <short-git-hash>` headers. Non-2xx responses in the 4xx range
+  (including 401/403) are treated as permanent failures; 5xx responses and
+  network errors are retried with backoff.
+- `GET {HUSKIES_CHANNEL_URL}/manifest.json` — returns a JSON object with a
+  `git_hash` field reflecting the most recently published artifact.
+  Requires `Authorization: Bearer <token>`.
+
+This is a separate, unsigned channel distinct from the Ed25519-signed
+release channels the `pull <channel>` gateway command consumes (see
+`server/src/service/gateway/release_manifest.rs`) — CI has no safe place to
+hold a channel signing key, so the dev channel trusts the bearer token alone.
@@ -0,0 +1,33 @@
+name: Publish sled artifact
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  publish-dev-artifact:
+    # Registered on an arm64 macOS act_runner host — see
+    # .gitea/workflows/README.md for registration instructions.
+    runs-on: [arm64-mac]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build linux-arm64 sled binary
+        env:
+          # Dedicated target dir so this CI build never clobbers a developer's
+          # incremental target/release build on the shared runner host, mirroring
+          # SLED_TARGET_DIR in server/src/chat/transport/matrix/release.rs.
+          CARGO_TARGET_DIR: target/ci-release
+        run: cargo build --release -p huskies
+
+      - name: Stage artifact
+        run: cp target/ci-release/release/huskies target/ci-release/release/huskies-linux-arm64
+
+      - name: Publish to dev channel
+        env:
+          HUSKIES_CHANNEL_URL: ${{ secrets.HUSKIES_CHANNEL_URL }}
+          HUSKIES_CHANNEL_TOKEN: ${{ secrets.HUSKIES_CHANNEL_TOKEN }}
+        run: script/ci-publish-artifact target/ci-release/release/huskies-linux-arm64 "$(git rev-parse --short HEAD)"