ci: migrate to GitHub-hosted runners + attest release provenance#1
Merged
Conversation
Move CI/docs/release off the self-hosted fleet (`homeserver-pool` ARC pool + the `ghost` M2 Max) onto GitHub-hosted runners, and add build-provenance attestation to release assets. Runner migration: - Linux jobs: `homeserver-pool` -> `ubuntu-latest`, keeping the `rust-ci`/`rust-web-ci` containers for toolchain + prettier parity. - macOS jobs: `[self-hosted, macos, arm64]` -> `macos-14` (hosted Apple Silicon). - Drop the `ghost`-specific rustup-shim PATH hacks (`rustup which cargo` -> $GITHUB_PATH) in ci.yml and release.yml — hosted macOS has rustup + cargo on PATH already. - ci.yml macOS: add `npm install -g prettier@3.8.4` before `make check`, since `make check` -> lint runs `prettier --check .` as a global binary and the hosted macOS image has no global prettier. Pinned to the version baked into the rust-web-ci container to keep macOS in lockstep with Linux. - Refresh comments the runner swap made inaccurate. Release attestation: - Add `attestations: write` to release.yml's top-level permissions (reusing the existing `id-token: write`). - Add `actions/attest-build-provenance@v4` in the release job, after download-artifact and before action-gh-release, attesting `dist/themis-*.tar.gz` (the glob skips the `.tar.gz.sha256` sidecars). Out of scope (unchanged): crates.io publishing/OIDC, version-verify logic, artifact naming (downstream pkgbuilds/homebrew parse these), the Makefile, and the docs.yml private/public trigger comment block. Claude-Session: https://claude.ai/code/session_01U5qTPzFxSPun9VccwbLcCy
…ality The header claimed the repo was private, Pages disabled, and the workflow manual-only — but the push-to-main auto-deploy is live and Pages is enabled (Actions source, deploying from main). Update the comment to match; no behavior change. Claude-Session: https://claude.ai/code/session_01U5qTPzFxSPun9VccwbLcCy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates CI/docs/release off the self-hosted runner fleet (the
homeserver-poolARC pool and theghostM2 Max) onto GitHub-hosted runners, and adds build-provenance attestation to release assets.Runner migration
ci.yml#check,docs.yml#build,release.yml#verify/build/publish-crate/release):runs-on: homeserver-pool→ubuntu-latest. Therust-ci/rust-web-cicontainers are kept wherever they were used, for toolchain + prettier parity (theverifyandreleasejobs need no container, so none was added).ci.yml#check-macos,release.yml#buildmatrix):runs-on: [self-hosted, macos, arm64]→macos-14(hosted Apple Silicon).ghost-specific rustup-shim hacks inci.ymlandrelease.yml— the steps that ranrustup which cargoand appended its dir to$GITHUB_PATH. Hosted macOS already has rustup + cargo on PATH;rustup show(kept) still materializes the pinned toolchain.make check→lintrunsprettier --check .as a global binary (Makefile, no rootpackage.json). The hostedmacos-14image ships Node/npm but no global prettier, so without thismake checkwould fail. Pinned toprettier@3.8.4, the version baked into therust-web-cicontainer, to keep macOS in lockstep with Linux.ghost/ARC notes).Release attestation (
release.yml)attestations: writeto the top-levelpermissions:(the existingid-token: write, already present for crates.io Trusted Publishing, is reused).releasejob, afteractions/download-artifactand beforesoftprops/action-gh-release:@v4(the action's current major; latest release v4.1.0). The glob attests both platform tarballs and deliberately skips the.tar.gz.sha256sidecars (no value attesting checksum files). Both archives land indist/via the existingdownload-artifact … merge-multiple: truestep.Out of scope (deliberately unchanged)
release.yml"Release contract").pull_request/ fork-PR trigger added (separate tracked follow-up).docs.yml's private/public trigger comment block (see note below).Verification
ci.ymltriggers onpush(any branch), so pushing this branch runs CI on it — see the checks on this PR. Thecheckjob runs hosted in therust-web-cicontainer;check-macosruns on hostedmacos-14and exercises the new prettier-install +make checkpath.docs.yml(triggers:pushtomain+ dispatch) andrelease.yml(triggers:v*tags only) do not run on this PR branch — that's expected.docs.ymlfirst runs on merge tomain; the new attestation inrelease.ymlfirst runs on the nextv*tag. No tag is cut here.prettier --checkis clean; the repo's pre-commit hook (prettier + full test suite) passed at commit time.Note for the owner (pre-existing, unrelated to this change)
docs.ymlhas an activepush: branches: [main]trigger (lines ~22-25) despite the header comment block saying the workflow is "kept manual while the repo is PRIVATE" and that thepushblock should stay commented "TO ACTIVATE AT THE PUBLIC FLIP." This inconsistency predates this PR and was left untouched per scope — flagging it so you can reconcile the comment with reality (the repo is public now and the trigger is live).https://claude.ai/code/session_01U5qTPzFxSPun9VccwbLcCy