SHA256
ci: target Gitea Ubuntu and native Apple Silicon runners
Move workflows into Gitea's workflow directory and use the supplied ubuntu-latest and macos-arm64 labels. Provision the Android SDK, require KVM without changing host permissions, support SHA-256 checkout and Gitea artifact uploads, and isolate scratch output on persistent runners. Skip untrusted fork PRs and keep release builds unsigned because Gitea ignores GitHub environment approval gates. Local workflow lint, repository invariants, ten preflight regressions, eight evidence-verifier tests, inline shell checks, scratch cleanup and SHA-256 fetch checks pass; remote runner execution remains unverified.
This commit is contained in:
Yuvomi Mobile Contributors committed
1 parent
2d12491516
commit
11bf4ca620
16 files changed
+442
-192
No files matched your search
@@ -0,0 +1,80 @@
|
||||
# Gitea CI runners
|
||||
|
||||
Workflows live in `.gitea/workflows/` for `git.nesterovic.cc`. Enable repository
|
||||
Actions in Gitea settings. Scheduling uses the labels supplied by the maintainer:
|
||||
|
||||
| Job | `runs-on` | Eligible runners |
|
||||
| --- | --- | --- |
|
||||
| Android builds, JVM/lint checks | `ubuntu-latest` | `ubuntu-runner-1` through `ubuntu-runner-6` |
|
||||
| Android emulator matrix (API 35 / 37.0) | `ubuntu-latest` | Same Ubuntu pool, with KVM access |
|
||||
| Manual unsigned Android release build | `ubuntu-latest` | Same Ubuntu pool |
|
||||
| iOS simulator, XCTest and unsigned archive | `macos-arm64` | `macos-m4pro` |
|
||||
|
||||
Runner names are informational; Gitea matches labels. The Mac's additional
|
||||
`macos` label is not needed. No `self-hosted` label is requested because it is not
|
||||
present in the supplied configuration. No runner registration or host settings
|
||||
are changed by these workflows.
|
||||
|
||||
## Ubuntu prerequisites
|
||||
|
||||
The job environment must be Linux x86_64 with Bash, Git (SHA-256 capable), curl,
|
||||
unzip, Python 3 and the shared libraries needed by the Android SDK/emulator and
|
||||
Node's native build tools. Use a maintained Ubuntu runner image with compiler,
|
||||
make, SQLite build prerequisites and emulator runtime libraries available. The
|
||||
pinned setup actions provision Temurin 17, Android SDK packages and Node 22 for
|
||||
the upstream fixture. SDK installation accepts the Android SDK licenses.
|
||||
|
||||
Emulator jobs require virtualization and readable/writable `/dev/kvm` **inside
|
||||
the job environment**. For container-backed runners, the administrator must pass
|
||||
the device through (for example `--device=/dev/kvm`) and configure group access.
|
||||
VM hosts need nested virtualization. The preflight fails with a clear message
|
||||
instead of attempting privileged host changes or silently using slow emulation.
|
||||
All runners sharing `ubuntu-latest` must meet these prerequisites. Run each
|
||||
emulator job in its own container; if using host execution, do not share an ADB
|
||||
server/AVD directory with simultaneous jobs on that host.
|
||||
|
||||
## Apple Silicon prerequisites
|
||||
|
||||
Map `macos-arm64` to native host execution on the M4 Pro (not a Linux container or
|
||||
Rosetta shell). Use a dedicated unprivileged CI account with Bash, SHA-256-capable Git, curl,
|
||||
unzip and Python 3 available to the runner service's PATH. Install/select full
|
||||
Xcode 16.4+ (or a current release supporting this project), accept its license and
|
||||
complete first-launch setup. Install an iOS 18.4+ simulator runtime and create an
|
||||
available iPhone simulator; `select-simulator.py` chooses the newest eligible one.
|
||||
|
||||
XcodeGen's pinned, checksum-verified binary includes native arm64 and x86_64
|
||||
slices; Rosetta/Homebrew installation is not required by the workflow. Build,
|
||||
archive and Swift package scratch outputs use `RUNNER_TEMP`. Scratch directories
|
||||
and the upstream clone are uniquely allocated per job and removed after artifact
|
||||
upload to avoid collisions and buildup on persistent hosts. No Apple signing
|
||||
credentials are required or provisioned. Avoid concurrent native jobs on the same
|
||||
Mac user/simulator; configure runner capacity accordingly.
|
||||
|
||||
## Forge compatibility and security
|
||||
|
||||
- External actions use explicit HTTPS hosts and full commit pins. The Node 20
|
||||
Gitea-compatible artifact action uses the v3 protocol, not GitHub's v4 backend.
|
||||
- Checkout sets `GIT_DEFAULT_HASH=sha256` for this repository and does not persist
|
||||
its token. Upstream remains a separate, unmodified SHA-1 clone.
|
||||
- Fork pull requests are skipped on these private runners. Same-repository PRs,
|
||||
pushes and manual runs are trusted code: restrict repository write access,
|
||||
require review, isolate runner accounts and keep unrelated credentials away.
|
||||
Do not enable `pull_request_target` to bypass this restriction.
|
||||
- Gitea ignores GitHub `environment` approval gates. Consequently the manual
|
||||
release workflow only emits **unsigned** APK/AAB files and never loads signing
|
||||
secrets or publishes. Signing remains an owner-controlled external operation.
|
||||
|
||||
Local checks for workflow changes:
|
||||
|
||||
```sh
|
||||
python3 scripts/check-repository.py
|
||||
python3 scripts/test-ci-runner.py
|
||||
python3 scripts/test-verifier.py
|
||||
python3 scripts/lint-workflows.py /path/to/actionlint
|
||||
bash -n scripts/check-ci-runner.sh
|
||||
```
|
||||
|
||||
The actionlint adapter normalizes Gitea's absolute action URLs only for parsing;
|
||||
repository checks validate the actual hosts, pins, checkout settings and labels.
|
||||
These checks do not prove a remote job ran. Inspect the first Gitea Actions runs
|
||||
and their artifacts before claiming hosted Android or Apple-platform validation.
|
||||
Reference in new issue
Block a user