josh/Vetting
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
28 Commits 1 Branch 0 Tags
3dc0ca0bc2cbacc77fa86dff502c4ed05525fa01
Commit Graph
6 Commits
Author SHA1 Message Date
joshandClaude Opus 4.7 3dc0ca0bc2 ci: install debian-archive-keyring for mkosi bootstrap
CI / Lint + build + test (push) Successful in 1m34s
Details
Release / release (push) Failing after 1m29s
Details 
mkosi's apt-get (inside the mkosi workspace) couldn't verify Debian's
InRelease signatures because the act_runner's Ubuntu base image ships
Ubuntu's keyring, not Debian's. Adding `debian-archive-keyring` to the
apt install list exposes /usr/share/keyrings/debian-archive-keyring.gpg
which debootstrap and apt need for the bookworm repos.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 02:54:04 -04:00
joshandClaude Opus 4.7 a427640608 ci: install systemd-ukify so mkosi's Bootable=yes step succeeds
CI / Lint + build + test (push) Successful in 1m35s
Details
Release / release (push) Failing after 1m1s
Details 
mkosi refused with "Could not find 'ukify'". The live image's mkosi.conf
sets Bootable=yes, and mkosi invokes ukify to package the Unified
Kernel Image alongside vmlinuz+initrd.img. On Debian/Ubuntu, ukify
ships in the `systemd-ukify` apt package (not in `systemd`).

Added to both release.yml and e2e.yml's live-image dep lists.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 02:50:39 -04:00
joshandClaude Opus 4.7 74c09e9596 ci: disable setup-go cache to skip 4m Gitea cache server timeout
CI / Lint + build + test (push) Failing after 32s
Details
Release / release (push) Has been cancelled
Details 
The action tries to restore from 172.18.0.2:36061 (Gitea's cache
server), times out, falls through to a fresh download anyway. Pure
waste since the runner already has the toolchain in
/opt/hostedtoolcache. Turn cache off.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 02:37:16 -04:00
joshandClaude Opus 4.7 869cd78d0b ci: quote e2e.yml input description so Gitea's YAML parser accepts it
CI / Lint + build + test (push) Has been cancelled
Details
Release / release (push) Has been cancelled
Details 
Unquoted `(default: main)` trips Gitea Actions' strict YAML parser
with "mapping values are not allowed in this context" because the
inline colon reads as a nested mapping. GitHub Actions' parser was
lenient about this; Gitea's isn't.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 02:34:35 -04:00
joshandClaude Opus 4.7 03dcf33686 ci: switch runs-on to ubuntu-latest to match runner label
CI / Lint + build + test (push) Failing after 8m44s
Details
Release / release (push) Has been cancelled
Details 
The self-hosted Gitea runner advertises itself as `ubuntu-latest`,
not `self-hosted`, so the jobs were never getting picked up.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 02:25:22 -04:00
joshandClaude Opus 4.7 609ad2e383 ci: migrate to Gitea Actions + publish release bundle to package registry
CI / Lint + build + test (push) Has been cancelled
Details
Release / release (push) Has been cancelled
Details 
Adds `.gitea/workflows/{ci,e2e,release}.yml` and removes the old
`.github/workflows/` counterparts. Gitea reads both paths, so keeping
them would double-run every job on every push.

- ci.yml / e2e.yml are 1:1 ports of the GitHub versions, just with
  `runs-on: self-hosted` (Gitea has no hosted runners).
- release.yml is new: fires on push to main, runs `make release`, then
  publishes `vetting-bundle.tar.gz` to the Gitea generic package
  registry under two versions — `sha-<short-sha>` (immutable, pinnable)
  and `latest` (rolling alias, DELETE+PUT on each run). Auth via a
  REGISTRY_TOKEN secret + REGISTRY_URL variable configured on the Gitea
  side.

The runner is being reconfigured to privileged so `mkosi` + `debootstrap`
can build the live image inside CI.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-18 02:14:08 -04:00