1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Build
on:
push:
branches:
- master
- main
- 'release/**'
paths-ignore:
- "**.md"
- "docs/**"
pull_request:
paths-ignore:
- "**.md"
- "docs/**"
# Cancel in-flight Build for the same branch when a new push lands.
# Feature-branch pushes self-cancel; master / main / release pushes
# don't (they must finish what they start because tagging + deploy
# chains off a successful run).
concurrency:
group: build-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ !startsWith(github.ref, 'refs/heads/master') && !startsWith(github.ref, 'refs/heads/main') && !startsWith(github.ref, 'refs/heads/release/') }}
jobs:
build:
# Self-hosted ARC runner pool (`cpu` scale set, autoscales 1..8 on the
# 20-core gha-runner-cpu node via actions-runner-controller). The earlier
# single-online-host bottleneck that pushed this to ubuntu-latest is gone:
# the scale set spins up an ephemeral dind runner per queued job.
runs-on: cpu
timeout-minutes: 10
env:
HOME: /home/runner
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
# zakuro-client is a git dep on the private zakuro-ai/zakuro-drive repo.
# Auth is a read-only deploy key on zakuro-drive (DRIVE_DEPLOY_KEY holds
# the private half): rewrite the dep URL to SSH and point git at the key.
# cargo shells out to the git CLI (.cargo/config.toml: git-fetch-with-cli).
- name: Git auth for private zakuro-drive dependency (read-only deploy key)
shell: bash
run: |
mkdir -p ~/.ssh && chmod 700 ~/.ssh
printf '%s\n' "${{ secrets.DRIVE_DEPLOY_KEY }}" > ~/.ssh/zakuro_drive_deploy
chmod 600 ~/.ssh/zakuro_drive_deploy
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
git config --global core.sshCommand "ssh -i ~/.ssh/zakuro_drive_deploy -o IdentitiesOnly=yes"
git config --global url."ssh://git@github.com/zakuro-ai/".insteadOf "https://github.com/zakuro-ai/"
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
with:
toolchain: "stable"
components: rustfmt,clippy
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: cargo fmt --check
run: cargo fmt --check
# Scoped to zc2 on purpose: this is the guard that the publishable,
# private-dep-free crate compiles on its own. The workspace build below
# covers zc-hooks. See #104.
- name: cargo clippy (zc2 only — OSS build guard)
run: cargo clippy -p zc2 -- -D warnings
# The whole workspace: zc2 plus the zc-hooks sidecar, which owns the
# private zakuro-client git dep (the runner has deploy-key access).
# `--features hooks` is gone -- hooks moved out of zc2 into its own
# publish = false crate so zc2's manifest has no git sources.
- name: cargo build --release (workspace)
run: cargo build --release --workspace
- name: cargo test (zc)
run: cargo test --release --bin zc
- name: cargo test (zc-hooks)
run: cargo test --release -p zc-hooks
- name: Cleanup git SSH config (runner hygiene)
if: always()
run: |
# Remove the SSH deploy-key config so subsequent jobs on the same
# ARC runner (e.g. sakura-internal CI) are not affected by this
# job's private-repo URL rewrite.
git config --global --remove-section 'url.ssh://git@github.com/zakuro-ai/' 2>/dev/null || true
git config --global --unset-all 'core.sshCommand' 2>/dev/null || true