54 lines
2.0 KiB
Markdown
54 lines
2.0 KiB
Markdown
# Gitea Actions workflows
|
|
|
|
## `release-artifact.yml`
|
|
|
|
Triggers on every push to `master`. Builds the `linux-arm64` sled binary and
|
|
publishes it to the "dev" release channel via `script/ci-publish-artifact`.
|
|
|
|
### Runner registration
|
|
|
|
The job targets the `arm64-mac` runner label. Register an `act_runner` on an
|
|
Apple Silicon macOS host that has `cargo`/`rustc` and `curl` on `PATH`:
|
|
|
|
```sh
|
|
act_runner register \
|
|
--instance https://code.crashlabs.io \
|
|
--token <runner-registration-token> \
|
|
--labels arm64-mac
|
|
act_runner daemon
|
|
```
|
|
|
|
The registration token comes from the repo's **Settings → Actions →
|
|
Runners → Create new Runner** page in Gitea. Without a runner carrying the
|
|
`arm64-mac` label, jobs from this workflow queue indefinitely.
|
|
|
|
### Secrets
|
|
|
|
Configure these under the repo's **Settings → Actions → Secrets**. Never
|
|
commit credentials — the workflow only ever references them via
|
|
`${{ secrets.* }}`.
|
|
|
|
| Secret | Purpose |
|
|
| --- | --- |
|
|
| `HUSKIES_CHANNEL_URL` | Base URL of the dev release channel host. |
|
|
| `HUSKIES_CHANNEL_TOKEN` | Bearer token authorised to publish artifacts to that channel. |
|
|
|
|
### Channel host contract
|
|
|
|
`script/ci-publish-artifact` expects the channel host at
|
|
`HUSKIES_CHANNEL_URL` to implement:
|
|
|
|
- `POST {HUSKIES_CHANNEL_URL}/<artifact-name>` — accepts the raw artifact
|
|
bytes as the request body. Requires `Authorization: Bearer <token>` and
|
|
`X-Git-Hash: <short-git-hash>` headers. Non-2xx responses in the 4xx range
|
|
(including 401/403) are treated as permanent failures; 5xx responses and
|
|
network errors are retried with backoff.
|
|
- `GET {HUSKIES_CHANNEL_URL}/manifest.json` — returns a JSON object with a
|
|
`git_hash` field reflecting the most recently published artifact.
|
|
Requires `Authorization: Bearer <token>`.
|
|
|
|
This is a separate, unsigned channel distinct from the Ed25519-signed
|
|
release channels the `pull <channel>` gateway command consumes (see
|
|
`server/src/service/gateway/release_manifest.rs`) — CI has no safe place to
|
|
hold a channel signing key, so the dev channel trusts the bearer token alone.
|