# Gitea Actions workflows

## `release-artifact.yml`

Triggers on every push to `master`. Builds the `linux-arm64` sled binary and
publishes it to the "dev" release channel via `script/ci-publish-artifact`.

### Runner registration

The job targets the `arm64-mac` runner label. Register an `act_runner` on an
Apple Silicon macOS host that has `cargo`/`rustc` and `curl` on `PATH`:

```sh
act_runner register \
  --instance https://code.crashlabs.io \
  --token <runner-registration-token> \
  --labels arm64-mac
act_runner daemon
```

The registration token comes from the repo's **Settings → Actions →
Runners → Create new Runner** page in Gitea. Without a runner carrying the
`arm64-mac` label, jobs from this workflow queue indefinitely.

### Secrets

Configure these under the repo's **Settings → Actions → Secrets**. Never
commit credentials — the workflow only ever references them via
`${{ secrets.* }}`.

| Secret | Purpose |
| --- | --- |
| `HUSKIES_CHANNEL_URL` | Base URL of the dev release channel host. |
| `HUSKIES_CHANNEL_TOKEN` | Bearer token authorised to publish artifacts to that channel. |

### Channel host contract

`script/ci-publish-artifact` expects the channel host at
`HUSKIES_CHANNEL_URL` to implement:

- `POST {HUSKIES_CHANNEL_URL}/<artifact-name>` — accepts the raw artifact
  bytes as the request body. Requires `Authorization: Bearer <token>` and
  `X-Git-Hash: <short-git-hash>` headers. Non-2xx responses in the 4xx range
  (including 401/403) are treated as permanent failures; 5xx responses and
  network errors are retried with backoff.
- `GET {HUSKIES_CHANNEL_URL}/manifest.json` — returns a JSON object with a
  `git_hash` field reflecting the most recently published artifact.
  Requires `Authorization: Bearer <token>`.

This is a separate, unsigned channel distinct from the Ed25519-signed
release channels the `pull <channel>` gateway command consumes (see
`server/src/service/gateway/release_manifest.rs`) — CI has no safe place to
hold a channel signing key, so the dev channel trusts the bearer token alone.