From fb24d3f482f233660480419ff2ca5a809e1426ce Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Nov 2026 00:57:35 +0000 Subject: [PATCH] ci: run the jobs in the runner image (#120) The workflows' containers are now lithosananke-runner:72b6cf370db1, built and published by runner-image.yml, with everything init installs and Maven already in it; the install steps are gone, except the documents' packages in nightly-docs.yml and release.yml. The registry refuses anonymous pulls, so each job pulls with PACKAGES_TOKEN. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2 --- .gitea/workflows/acceptance.yml | 8 ++++---- .gitea/workflows/build.yml | 16 ++++++++-------- .gitea/workflows/nightly-docs.yml | 9 +++++---- .gitea/workflows/nightly.yml | 10 ++++------ .gitea/workflows/release.yml | 9 +++++---- .gitea/workflows/runner-image.yml | 3 ++- CHANGELOG.md | 8 ++++++++ 7 files changed, 36 insertions(+), 27 deletions(-) diff --git a/.gitea/workflows/acceptance.yml b/.gitea/workflows/acceptance.yml index 2d5b7b36..592adb28 100644 --- a/.gitea/workflows/acceptance.yml +++ b/.gitea/workflows/acceptance.yml @@ -26,7 +26,10 @@ jobs: name: Acceptance runs-on: ubuntu-latest container: - image: gitea/runner-images:ubuntu-24.04-v26.11.03 # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye) + image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1 # ci/runner-image (#120) + credentials: # the registry refuses anonymous pulls + username: rajames + password: ${{ secrets.PACKAGES_TOKEN }} timeout-minutes: 120 steps: - uses: actions/checkout@v4 @@ -34,9 +37,6 @@ jobs: fetch-depth: 0 # the SBOM's version is git describe lfs: false # only the logs and DoE CSVs are in LFS; the build needs neither - - name: Install the build's dependencies - run: make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0 - - name: Acceptance amd64 run: scripts/nightly.sh accept amd64 - name: Acceptance aarch64 diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 176115b6..1b8fc6aa 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -16,7 +16,10 @@ jobs: name: Image ${{ matrix.board }} runs-on: ubuntu-latest container: - image: gitea/runner-images:ubuntu-24.04-v26.11.03 # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye) + image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1 # ci/runner-image (#120) + credentials: # the registry refuses anonymous pulls + username: rajames + password: ${{ secrets.PACKAGES_TOKEN }} timeout-minutes: 45 strategy: fail-fast: false @@ -31,9 +34,6 @@ jobs: fetch-depth: 0 # the SBOM's version is git describe lfs: false # only the logs and DoE CSVs are in LFS; the build needs neither - - name: Install the build's dependencies - run: make ARCH=${{ matrix.arch }} init INIT_DOCS=0 - - name: Boot image run: make boot_image TARGET=${{ matrix.board }} @@ -52,15 +52,15 @@ jobs: name: v4 tests (32- and 64-bit cells) runs-on: ubuntu-latest container: - image: gitea/runner-images:ubuntu-24.04-v26.11.03 # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye) + image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1 # ci/runner-image (#120) + credentials: # the registry refuses anonymous pulls + username: rajames + password: ${{ secrets.PACKAGES_TOKEN }} timeout-minutes: 60 steps: - uses: actions/checkout@v4 with: lfs: false - - name: Install the build's dependencies - run: make ARCH=amd64 init INIT_DOCS=0 - - name: make -C v4 test run: make -C v4 test diff --git a/.gitea/workflows/nightly-docs.yml b/.gitea/workflows/nightly-docs.yml index 00d38c46..ef75f63f 100644 --- a/.gitea/workflows/nightly-docs.yml +++ b/.gitea/workflows/nightly-docs.yml @@ -19,7 +19,10 @@ jobs: name: Book, volumes, API reference runs-on: ubuntu-latest container: - image: gitea/runner-images:ubuntu-24.04-v26.11.03 # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye) + image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1 # ci/runner-image (#120) + credentials: # the registry refuses anonymous pulls + username: rajames + password: ${{ secrets.PACKAGES_TOKEN }} timeout-minutes: 90 steps: - uses: actions/checkout@v4 @@ -28,9 +31,7 @@ jobs: lfs: false - name: Install the documents' dependencies - run: | - make ARCH=amd64 init INIT_PROOFS=0 - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless + run: make ARCH=amd64 init INIT_PROOFS=0 # the image has all but the documents' packages - name: Documents run: scripts/nightly.sh docs diff --git a/.gitea/workflows/nightly.yml b/.gitea/workflows/nightly.yml index addaaedf..709694d4 100644 --- a/.gitea/workflows/nightly.yml +++ b/.gitea/workflows/nightly.yml @@ -25,7 +25,10 @@ jobs: name: Acceptance, proofs, images runs-on: ubuntu-latest container: - image: gitea/runner-images:ubuntu-24.04-v26.11.03 # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye) + image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1 # ci/runner-image (#120) + credentials: # the registry refuses anonymous pulls + username: rajames + password: ${{ secrets.PACKAGES_TOKEN }} timeout-minutes: 150 steps: - uses: actions/checkout@v4 @@ -33,11 +36,6 @@ jobs: fetch-depth: 0 # the SBOM's version is git describe lfs: false # only the logs and DoE CSVs are in LFS; the build needs neither - - name: Install the build's dependencies - run: | - make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0 - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless - - name: Acceptance amd64 run: scripts/nightly.sh accept amd64 - name: Acceptance aarch64 diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index b8f3a763..141ae3ae 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -22,7 +22,10 @@ jobs: name: Release ${{ github.ref_name }} runs-on: ubuntu-latest container: - image: gitea/runner-images:ubuntu-24.04-v26.11.03 # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye) + image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1 # ci/runner-image (#120) + credentials: # the registry refuses anonymous pulls + username: rajames + password: ${{ secrets.PACKAGES_TOKEN }} timeout-minutes: 240 steps: - uses: actions/checkout@v4 @@ -38,9 +41,7 @@ jobs: echo "NIGHTLY_VERSION=${tree#v}" >> "$GITHUB_ENV" - name: Install the dependencies - run: | - make ARCH=amd64,aarch64,riscv64 init - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless + run: make ARCH=amd64,aarch64,riscv64 init # the image has all but the documents' packages - name: Acceptance amd64 run: scripts/nightly.sh accept amd64 diff --git a/.gitea/workflows/runner-image.yml b/.gitea/workflows/runner-image.yml index 25690dbe..9987174e 100644 --- a/.gitea/workflows/runner-image.yml +++ b/.gitea/workflows/runner-image.yml @@ -3,7 +3,8 @@ # # gitea.starshipos-f18.org/rajames/lithosananke-runner: # -# The workflows name that tag as their container once it is published and has passed acceptance. +# The workflows name that tag as their container. A new tag -- after a change to init in the +# Makefile, or to the Dockerfile -- reaches them by a pull request, which acceptance runs on it. # # Needs the runner to give jobs its Docker daemon (act_runner config.yaml, container.docker_host: # automount), and a secret PACKAGES_TOKEN -- a token with write:package -- unless the Actions diff --git a/CHANGELOG.md b/CHANGELOG.md index 9d569aff..881f49fc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## 2026-11-07 — CI jobs start ready: the runner image + +The CI jobs now run in `lithosananke-runner` (`ci/runner-image`, #120), an image with everything +`make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0` installs and Maven already in it, so they no +longer install the toolchain at their start; only the document jobs still install the documents' +packages. `runner-image.yml` builds and publishes it, tagged with its commit; the workflows name +that tag, and a new one reaches them like any change: by a pull request that passed acceptance. + ## 2026-11-06 — One process from developer to master: the acceptance gate, the nightlies to Nexus, one repository Every pull request into `master` now runs the acceptance protocol (`acceptance.yml`): the three