Claude
9710bd1779
Captain Bob, 2026-11-13: "I merge master in". PR 164 could not merge: master's six comment-only commits of 2026-11-11 (751bfe26..268e5593, "record runner.capacity: 1 decision ... (FABRIC-3, #140)") edit the concurrency blocks the branch deletes for #140 ("It should be global"). Resolved in every workflow for the branch -- no concurrency group -- with master's fact kept as a line of the #140 comment: the capacity is explicit in the runner's config.yaml, runner.capacity: 1. Each file parses; scripts/test_acceptance_signing.sh passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm
99 lines
4.3 KiB
YAML
99 lines
4.3 KiB
YAML
# The quick check on every push to the working branch: each board's image builds, and the v4
|
|
# tests pass. A pull request into master is gated by acceptance.yml, the full acceptance protocol;
|
|
# master itself is not checked again after a merge -- its content is what acceptance just passed.
|
|
# Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots,
|
|
# the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the
|
|
# documents to Nexus).
|
|
name: Build
|
|
|
|
on:
|
|
push:
|
|
branches: [StarForth-v4.0.0] # not master: what reaches it has just passed acceptance (#119)
|
|
paths-ignore: ['site/**'] # the websites (site/) build nothing here; each run is ~17 min on
|
|
# the server the wikis share (Captain Bob, 2026-11-07)
|
|
workflow_dispatch:
|
|
|
|
# No concurrency group (Captain Bob, 2026-11-11, #140: "It should be global"). The one runner
|
|
# (starshipos-vps) has capacity 1, so every job of every workflow waits its turn in Gitea's queue
|
|
# and none is cancelled; a runner-image rebuild still blocks the rest (2026-11-07). A shared
|
|
# concurrency group kept only one waiting run, and each run that joined cancelled it.
|
|
# The capacity is explicit in the runner's config.yaml: runner.capacity: 1 (FABRIC-3, 2026-11-11).
|
|
|
|
jobs:
|
|
image:
|
|
name: Image ${{ matrix.board }}
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2 # ci/runner-image (#120)
|
|
credentials: # the registry refuses anonymous pulls
|
|
username: rajames
|
|
password: ${{ secrets.PACKAGES_TOKEN }}
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include: # boards/<dir>/board.mk; Pi 4 has no port yet (#26)
|
|
- { board: PC, arch: amd64, dir: pc, image: lithos-pc.img }
|
|
- { board: RASPI, arch: aarch64, dir: raspi, image: lithos-raspi.img }
|
|
- { board: MILKV, arch: riscv64, dir: milkv, image: lithos-milkv.img }
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # the SBOM's version is git describe
|
|
lfs: false # only the logs and DoE CSVs are in LFS; the build needs neither
|
|
|
|
- name: The capsule-signing key
|
|
env:
|
|
KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
|
|
run: | # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
|
|
if [ -n "$KEY" ]; then
|
|
f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
|
|
(umask 077; printf '%s\n' "$KEY" > "$f")
|
|
echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
|
|
else
|
|
echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
|
|
fi
|
|
|
|
- name: Boot image
|
|
run: make boot_image TARGET=${{ matrix.board }}
|
|
|
|
- name: Compress # the PC image is a 2 GiB stick, nearly all empty
|
|
run: xz -T0 -6 build/boards/${{ matrix.dir }}/${{ matrix.image }}
|
|
|
|
- name: Keep the image and its SBOM
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: image-${{ matrix.dir }}-${{ github.run_number }}
|
|
path: |
|
|
build/boards/${{ matrix.dir }}/${{ matrix.image }}.xz
|
|
build/boards/${{ matrix.dir }}/*.spdx*
|
|
|
|
v4-tests:
|
|
name: v4 tests (32- and 64-bit cells)
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2 # ci/runner-image (#120)
|
|
credentials: # the registry refuses anonymous pulls
|
|
username: rajames
|
|
password: ${{ secrets.PACKAGES_TOKEN }}
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
lfs: false
|
|
|
|
- name: The capsule-signing key
|
|
env:
|
|
KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
|
|
run: | # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
|
|
if [ -n "$KEY" ]; then
|
|
f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
|
|
(umask 077; printf '%s\n' "$KEY" > "$f")
|
|
echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
|
|
else
|
|
echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
|
|
fi
|
|
|
|
- name: make -C v4 test
|
|
run: make -C v4 test
|