huskies: merge 1189 story Gitea Actions workflow: build the sled artifact on master merges and publish to the dev channel

2026-07-17 13:32:30 +00:00
parent 3ed3fdd6b0
commit bb5d7879ff
8 changed files with 538 additions and 0 deletions
@@ -0,0 +1,53 @@
+# Gitea Actions workflows
+
+## `release-artifact.yml`
+
+Triggers on every push to `master`. Builds the `linux-arm64` sled binary and
+publishes it to the "dev" release channel via `script/ci-publish-artifact`.
+
+### Runner registration
+
+The job targets the `arm64-mac` runner label. Register an `act_runner` on an
+Apple Silicon macOS host that has `cargo`/`rustc` and `curl` on `PATH`:
+
+```sh
+act_runner register \
+  --instance https://code.crashlabs.io \
+  --token <runner-registration-token> \
+  --labels arm64-mac
+act_runner daemon
+```
+
+The registration token comes from the repo's **Settings → Actions →
+Runners → Create new Runner** page in Gitea. Without a runner carrying the
+`arm64-mac` label, jobs from this workflow queue indefinitely.
+
+### Secrets
+
+Configure these under the repo's **Settings → Actions → Secrets**. Never
+commit credentials — the workflow only ever references them via
+`${{ secrets.* }}`.
+
+| Secret | Purpose |
+| --- | --- |
+| `HUSKIES_CHANNEL_URL` | Base URL of the dev release channel host. |
+| `HUSKIES_CHANNEL_TOKEN` | Bearer token authorised to publish artifacts to that channel. |
+
+### Channel host contract
+
+`script/ci-publish-artifact` expects the channel host at
+`HUSKIES_CHANNEL_URL` to implement:
+
+- `POST {HUSKIES_CHANNEL_URL}/<artifact-name>` — accepts the raw artifact
+  bytes as the request body. Requires `Authorization: Bearer <token>` and
+  `X-Git-Hash: <short-git-hash>` headers. Non-2xx responses in the 4xx range
+  (including 401/403) are treated as permanent failures; 5xx responses and
+  network errors are retried with backoff.
+- `GET {HUSKIES_CHANNEL_URL}/manifest.json` — returns a JSON object with a
+  `git_hash` field reflecting the most recently published artifact.
+  Requires `Authorization: Bearer <token>`.
+
+This is a separate, unsigned channel distinct from the Ed25519-signed
+release channels the `pull <channel>` gateway command consumes (see
+`server/src/service/gateway/release_manifest.rs`) — CI has no safe place to
+hold a channel signing key, so the dev channel trusts the bearer token alone.