e2da5509ae
The CI runner was a hive deploy module: hive-ci.nix ran it beside the forge, and hive-c0re registered it through the forge's admin API with the `core` token, writing the registration token through hive-priv. It could only run on the forge's host, and it kept an admin-scoped forge token on a hive. Now the runner is a swarm service: - swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the host that sets deploy.ci-runner.enable, reaching the forge by name. It needs neither the forge nor a hive there. - swarm-controller reads the forge's runner registration token with its own admin token and writes it to swarm/services/ci-runner/ registration-token whenever it differs from what it last wrote. Its grant on that path is create/update only. - The runner's own leaf (CN swarm-ci-runner, role and policy of the same name) reads that one path. swarm-bao-ci-runner.service fetches it into the runner's EnvironmentFile and restarts the runner on a change. - A pre-start step removes .runner when the daemon's journal since its last start holds Forgejo's "unregistered runner" refusal (the daemon exits 1 when its startup Declare gets it), or when .runner names another forge address; upstream's pre-start step then registers again. Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*, forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner. The forge's half of the old ci.enable, the actions/checkout mirror and DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf. Closes #4954
61 lines
2.4 KiB
YAML
61 lines
2.4 KiB
YAML
name: flake update
|
|
|
|
# Daily `nix flake update`; opens a PR only if the lock changed, never
|
|
# merges (mara does, by hand - branch protection requires it anyway).
|
|
# Separate file from ci.yml/coverage.yml for the same reason coverage.yml
|
|
# is: a workflow_dispatch in ci.yml fires every job there.
|
|
#
|
|
# Plain branch + curl POST (not AGit), mirroring mara's own
|
|
# nixos-configuration:.forgejo/workflows/flake-update.yaml - a daily lock
|
|
# bump never updates an existing PR, so AGit's advantage there doesn't
|
|
# apply. Stale PRs just stack; newest lock wins.
|
|
#
|
|
# `PR_BOT_TOKEN` (repo secret) is the `flake-bot` account's write token.
|
|
# Self-signed forge cert: not worked around with `curl -k` - swarm-ci-runner.nix
|
|
# already sets SSL_CERT_FILE to a bundle with the hive CA (wiring
|
|
# confirmed; anchor coverage for the swarm forge specifically isn't).
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 3 * * *"
|
|
|
|
jobs:
|
|
update:
|
|
name: nix flake update
|
|
if: vars.PUBLIC_FORGE != 'true'
|
|
runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: update and open a PR if the lock changed
|
|
env:
|
|
PR_BOT_TOKEN: ${{ secrets.PR_BOT_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
nix flake update
|
|
|
|
if git diff --quiet -- flake.lock; then
|
|
echo "flake.lock unchanged, nothing to do"
|
|
exit 0
|
|
fi
|
|
|
|
# origin's scheme+host, not a hardcoded forge URL - checkout
|
|
# already resolved an address this runner can reach.
|
|
origin_url="$(git remote get-url origin)"
|
|
scheme="${origin_url%%://*}"
|
|
host="$(printf '%s\n' "$origin_url" | sed -E 's#^[a-z]+://([^/]+)/.*#\1#')"
|
|
|
|
branch="flake-update-$(date +%F)"
|
|
git checkout -b "$branch"
|
|
git -c user.name="flake-bot" \
|
|
-c user.email="git+flake-bot@darkest.space" \
|
|
commit -am "nix flake update"
|
|
git push "${scheme}://flake-bot:${PR_BOT_TOKEN}@${host}/hyperhive/hyperhive.git" "$branch"
|
|
|
|
printf '{"title":"nix flake update","head":"%s","base":"main"}' \
|
|
"$branch" > /tmp/flake-update-pr.json
|
|
curl -sf -X POST \
|
|
-H "Authorization: token ${PR_BOT_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
-d @/tmp/flake-update-pr.json \
|
|
"${scheme}://${host}/api/v1/repos/hyperhive/hyperhive/pulls"
|