diff --git a/.gitea/workflows/project-ci.yml b/.gitea/workflows/project-ci.yml
index ff94fe2f6..304fd7c47 100644
--- a/.gitea/workflows/project-ci.yml
+++ b/.gitea/workflows/project-ci.yml
@@ -17,46 +17,30 @@ env:
CARGO_HTTP_MULTIPLEXING: 'false'
CARGO_NET_RETRY: '10'
CARGO_TERM_COLOR: always
- RUSTUP_MAX_RETRIES: '10'
+ NPM_CONFIG_AUDIT: 'false'
+ NPM_CONFIG_FETCH_RETRIES: '10'
+ NPM_CONFIG_FETCH_RETRY_FACTOR: '2'
+ NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: '60000'
+ NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: '2000'
+ NPM_CONFIG_FUND: 'false'
+ NPM_CONFIG_PREFER_OFFLINE: 'true'
+ RUSTUP_AUTO_INSTALL: '0'
RUSTC_WRAPPER: ''
CARGO_BUILD_RUSTC_WRAPPER: ''
jobs:
repository-checks:
name: Repository checks
- runs-on: ubuntu-latest
+ runs-on: genarrative-ci
steps:
- - name: Checkout full history
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- with:
- fetch-depth: 0
- persist-credentials: false
+ - name: Checkout full history from Gitea
+ env:
+ GENARRATIVE_GITEA_FETCH_DEPTH: '0'
+ GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+ run: genarrative-gitea-checkout
- - name: Install base tools
- shell: bash
- run: |
- set -euo pipefail
- command -v apt-get >/dev/null 2>&1 || {
- echo 'ubuntu-latest runner must provide an Ubuntu or Debian environment.' >&2
- exit 1
- }
- sudo_command=()
- if [[ "$(id -u)" -ne 0 ]]; then
- command -v sudo >/dev/null 2>&1 || {
- echo 'non-root runner user requires sudo for system dependencies.' >&2
- exit 1
- }
- sudo_command=(sudo -E)
- fi
- "${sudo_command[@]}" apt-get update
- "${sudo_command[@]}" env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
- ca-certificates \
- curl
-
- - name: Set up Node.js 22
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- with:
- node-version: '22'
+ - name: Validate preinstalled CI job image and sandbox
+ run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh
- name: Resolve comparison base
shell: bash
@@ -82,42 +66,6 @@ jobs:
fi
echo "SPACETIME_SCHEMA_BASE_REF=${base_ref}" >> "${GITHUB_ENV}"
- - name: Set up repository Rust toolchain
- shell: bash
- run: |
- set -euo pipefail
- if ! command -v rustup >/dev/null 2>&1; then
- for attempt in $(seq 1 10); do
- if curl --retry 3 --retry-all-errors --retry-delay 2 \
- --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
- | sh -s -- -y --profile minimal --default-toolchain none; then
- break
- fi
- if [[ "${attempt}" -eq 10 ]]; then
- echo 'rustup bootstrap failed after 10 attempts.' >&2
- exit 1
- fi
- sleep $((attempt * 2))
- done
- fi
- echo "${HOME}/.cargo/bin" >> "${GITHUB_PATH}"
- export PATH="${HOME}/.cargo/bin:${PATH}"
- toolchain="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' rust-toolchain.toml)"
- test -n "${toolchain}"
- for attempt in $(seq 1 10); do
- if rustup toolchain install "${toolchain}" --profile minimal --component rustfmt; then
- break
- fi
- if [[ "${attempt}" -eq 10 ]]; then
- echo 'Rust toolchain installation failed after 10 attempts.' >&2
- exit 1
- fi
- sleep $((attempt * 2))
- done
- rustc --version
- cargo --version
- rustfmt --version
-
- name: Install npm dependencies
run: npm ci
@@ -141,17 +89,16 @@ jobs:
frontend-tests:
name: Frontend tests
- runs-on: ubuntu-latest
+ runs-on: genarrative-ci
steps:
- - name: Checkout source
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- with:
- persist-credentials: false
+ - name: Checkout source from Gitea
+ env:
+ GENARRATIVE_GITEA_FETCH_DEPTH: '1'
+ GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+ run: genarrative-gitea-checkout
- - name: Set up Node.js 22
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- with:
- node-version: '22'
+ - name: Validate preinstalled CI job image and sandbox
+ run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh
- name: Install npm dependencies
run: npm ci
@@ -164,48 +111,16 @@ jobs:
backend-tests:
name: Backend tests
- runs-on: ubuntu-latest
+ runs-on: genarrative-ci
steps:
- - name: Checkout full history
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- with:
- fetch-depth: 0
- persist-credentials: false
+ - name: Checkout full history from Gitea
+ env:
+ GENARRATIVE_GITEA_FETCH_DEPTH: '0'
+ GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+ run: genarrative-gitea-checkout
- - name: Install backend build dependencies
- shell: bash
- run: |
- set -euo pipefail
- command -v apt-get >/dev/null 2>&1 || {
- echo 'ubuntu-latest runner must provide an Ubuntu or Debian environment.' >&2
- exit 1
- }
- sudo_command=()
- if [[ "$(id -u)" -ne 0 ]]; then
- command -v sudo >/dev/null 2>&1 || {
- echo 'non-root runner user requires sudo for system dependencies.' >&2
- exit 1
- }
- sudo_command=(sudo -E)
- fi
- "${sudo_command[@]}" apt-get update
- "${sudo_command[@]}" env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
- build-essential \
- ca-certificates \
- clang \
- cmake \
- curl \
- ffmpeg \
- libclang-dev \
- libcurl4-openssl-dev \
- libssl-dev \
- lld \
- pkg-config
-
- - name: Set up Node.js 22
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- with:
- node-version: '22'
+ - name: Validate preinstalled CI job image and sandbox
+ run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh
- name: Resolve comparison base
shell: bash
@@ -231,42 +146,6 @@ jobs:
fi
echo "SPACETIME_SCHEMA_BASE_REF=${base_ref}" >> "${GITHUB_ENV}"
- - name: Set up repository Rust toolchain
- shell: bash
- run: |
- set -euo pipefail
- if ! command -v rustup >/dev/null 2>&1; then
- for attempt in $(seq 1 10); do
- if curl --retry 3 --retry-all-errors --retry-delay 2 \
- --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
- | sh -s -- -y --profile minimal --default-toolchain none; then
- break
- fi
- if [[ "${attempt}" -eq 10 ]]; then
- echo 'rustup bootstrap failed after 10 attempts.' >&2
- exit 1
- fi
- sleep $((attempt * 2))
- done
- fi
- echo "${HOME}/.cargo/bin" >> "${GITHUB_PATH}"
- export PATH="${HOME}/.cargo/bin:${PATH}"
- toolchain="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' rust-toolchain.toml)"
- test -n "${toolchain}"
- for attempt in $(seq 1 10); do
- if rustup toolchain install "${toolchain}" --profile minimal --component rustfmt; then
- break
- fi
- if [[ "${attempt}" -eq 10 ]]; then
- echo 'Rust toolchain installation failed after 10 attempts.' >&2
- exit 1
- fi
- sleep $((attempt * 2))
- done
- rustc --version
- cargo --version
- rustfmt --version
-
- name: Install npm dependencies
run: npm ci
@@ -284,181 +163,16 @@ jobs:
native-shell-tests:
name: Native shell tests
- runs-on: ubuntu-latest
+ runs-on: genarrative-ci
steps:
- - name: Checkout full history
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- with:
- fetch-depth: 0
- persist-credentials: false
+ - name: Checkout full history from Gitea
+ env:
+ GENARRATIVE_GITEA_FETCH_DEPTH: '0'
+ GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+ run: genarrative-gitea-checkout
- - name: Install native shell build dependencies
- shell: bash
- run: |
- set -euo pipefail
- command -v apt-get >/dev/null 2>&1 || {
- echo 'ubuntu-latest runner must provide an Ubuntu or Debian environment.' >&2
- exit 1
- }
- sudo_command=()
- if [[ "$(id -u)" -ne 0 ]]; then
- command -v sudo >/dev/null 2>&1 || {
- echo 'non-root runner user requires sudo for system dependencies.' >&2
- exit 1
- }
- sudo_command=(sudo -E)
- fi
- "${sudo_command[@]}" apt-get update
- "${sudo_command[@]}" env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
- build-essential \
- bubblewrap \
- ca-certificates \
- clang \
- cmake \
- curl \
- file \
- libayatana-appindicator3-dev \
- libssl-dev \
- libwebkit2gtk-4.1-dev \
- libxdo-dev \
- librsvg2-dev \
- lld \
- patchelf \
- pkg-config \
- ripgrep \
- wget
- google_key="$(mktemp)"
- curl --retry 3 --retry-all-errors --retry-delay 2 \
- --proto '=https' --tlsv1.2 -fsSL \
- https://dl.google.com/linux/linux_signing_key.pub \
- -o "${google_key}"
- "${sudo_command[@]}" install -d -m 0755 /etc/apt/keyrings
- "${sudo_command[@]}" install -m 0644 "${google_key}" \
- /etc/apt/keyrings/google-chrome.asc
- printf '%s\n' \
- 'deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.asc] https://dl.google.com/linux/chrome/deb/ stable main' \
- | "${sudo_command[@]}" tee /etc/apt/sources.list.d/google-chrome.list >/dev/null
- "${sudo_command[@]}" apt-get update
- "${sudo_command[@]}" env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
- google-chrome-stable
- google-chrome --version
- bwrap_args=(
- --die-with-parent
- --unshare-all
- --unshare-user
- --disable-userns
- --assert-userns-disabled
- --cap-drop ALL
- --clearenv
- --ro-bind /usr /usr
- )
- for merged_path in /bin /sbin /lib /lib64; do
- if [[ -L "${merged_path}" ]]; then
- bwrap_args+=(--symlink "$(readlink "${merged_path}")" "${merged_path}")
- fi
- done
- bwrap_args+=(
- --proc /proc
- --dev /dev
- --tmpfs /tmp
- --
- /usr/bin/true
- )
- bwrap "${bwrap_args[@]}"
-
- - name: Set up Node.js 22
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- with:
- node-version: '22'
-
- - name: Expose trusted Node.js command paths
- shell: bash
- run: |
- set -euo pipefail
- node_path="$(command -v node)"
- npm_path="$(command -v npm)"
- test -x "${node_path}"
- test -x "${npm_path}"
- node_root="$(cd "$(dirname "${node_path}")/.." && pwd -P)"
- test -d "${node_root}/lib/node_modules/npm"
- sudo_command=()
- if [[ "$(id -u)" -ne 0 ]]; then
- command -v sudo >/dev/null 2>&1 || {
- echo 'non-root runner user requires sudo to expose trusted Node.js paths.' >&2
- exit 1
- }
- sudo_command=(sudo -E)
- fi
- trusted_node_root='/usr/local/lib/genarrative-node'
- "${sudo_command[@]}" install -d -m 0755 "${trusted_node_root}"
- "${sudo_command[@]}" cp -a "${node_root}/." "${trusted_node_root}/"
- "${sudo_command[@]}" ln -sfn "${trusted_node_root}/bin/node" /usr/local/bin/node
- "${sudo_command[@]}" ln -sfn "${trusted_node_root}/bin/npm" /usr/local/bin/npm
- /usr/local/bin/node --version
- /usr/local/bin/npm --version
-
- - name: Set up repository Rust toolchain
- shell: bash
- run: |
- set -euo pipefail
- if ! command -v rustup >/dev/null 2>&1; then
- for attempt in $(seq 1 10); do
- if curl --retry 3 --retry-all-errors --retry-delay 2 \
- --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
- | sh -s -- -y --profile minimal --default-toolchain none; then
- break
- fi
- if [[ "${attempt}" -eq 10 ]]; then
- echo 'rustup bootstrap failed after 10 attempts.' >&2
- exit 1
- fi
- sleep $((attempt * 2))
- done
- fi
- echo "${HOME}/.cargo/bin" >> "${GITHUB_PATH}"
- export PATH="${HOME}/.cargo/bin:${PATH}"
- toolchain="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' rust-toolchain.toml)"
- test -n "${toolchain}"
- for attempt in $(seq 1 10); do
- if rustup toolchain install "${toolchain}" --profile minimal --component rustfmt; then
- break
- fi
- if [[ "${attempt}" -eq 10 ]]; then
- echo 'Rust toolchain installation failed after 10 attempts.' >&2
- exit 1
- fi
- sleep $((attempt * 2))
- done
- rustc --version
- cargo --version
- rustfmt --version
-
- - name: Expose trusted Rust command paths
- shell: bash
- run: |
- set -euo pipefail
- rustup_path="$(command -v rustup)"
- test -x "${rustup_path}"
- rustup_home="$(rustup show home)"
- test -d "${rustup_home}"
- sudo_command=()
- if [[ "$(id -u)" -ne 0 ]]; then
- command -v sudo >/dev/null 2>&1 || {
- echo 'non-root runner user requires sudo to expose trusted Rust paths.' >&2
- exit 1
- }
- sudo_command=(sudo -E)
- fi
- if [[ "$(readlink -f "${rustup_path}")" != '/usr/local/bin/rustup' ]]; then
- "${sudo_command[@]}" install -m 0755 "${rustup_path}" /usr/local/bin/rustup
- fi
- for command_name in cargo rustc rustdoc rustfmt; do
- "${sudo_command[@]}" ln -sfn rustup "/usr/local/bin/${command_name}"
- done
- echo "RUSTUP_HOME=${rustup_home}" >> "${GITHUB_ENV}"
- /usr/local/bin/cargo --version
- /usr/local/bin/rustc --version
- /usr/local/bin/rustfmt --version
+ - name: Validate preinstalled CI job image and sandbox
+ run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh
- name: Install npm dependencies
run: npm ci
diff --git a/scripts/check-gitea-ci-job-image.sh b/scripts/check-gitea-ci-job-image.sh
new file mode 100644
index 000000000..88753b32d
--- /dev/null
+++ b/scripts/check-gitea-ci-job-image.sh
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+expected_toolchain="$(
+ sed -n 's/^channel = "\([^"]*\)"/\1/p' "${repo_root}/rust-toolchain.toml"
+)"
+
+test -n "${expected_toolchain}"
+[[ "$(node --version)" == v22.* ]]
+rustup toolchain list | rg -q "^${expected_toolchain}(-[^ ]+)?( |$)"
+[[ "$(rustup run "${expected_toolchain}" rustc --version)" == "rustc ${expected_toolchain} "* ]]
+test "$(readlink -f "$(command -v node)")" = "/usr/local/lib/genarrative-node/bin/node"
+test "$(rustup show home)" = "/usr/local/rustup"
+for trusted_command in cargo rustc rustdoc rustfmt rustup; do
+ test "$(command -v "${trusted_command}")" = "/usr/local/bin/${trusted_command}"
+done
+test "$(command -v genarrative-gitea-checkout)" = "/usr/local/bin/genarrative-gitea-checkout"
+bash -n /usr/local/bin/genarrative-gitea-checkout
+test -d /root/.npm/_cacache
+test -d /usr/local/cargo/registry/cache
+
+verify_cache_lock() {
+ local cache_name="$1"
+ local expected_sha256="$2"
+ local lock_path="$3"
+ local actual_sha256
+
+ test -n "${expected_sha256}"
+ actual_sha256="$(sha256sum "${lock_path}")"
+ actual_sha256="${actual_sha256%% *}"
+ if [[ "${actual_sha256}" == "${expected_sha256}" ]]; then
+ printf '%s_cache_lock=hit\n' "${cache_name}"
+ return
+ fi
+ if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
+ printf '%s_cache_lock=partial\n' "${cache_name}"
+ return
+ fi
+ echo "${cache_name} cache lock does not match the verification checkout." >&2
+ exit 1
+}
+
+npm_lock_path="${repo_root}/package-lock.json"
+server_rust_lock_path="${repo_root}/server-rs/Cargo.lock"
+desktop_rust_lock_path="${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock"
+if [[ ! -f "${npm_lock_path}" ]]; then
+ npm_lock_path='/usr/local/share/genarrative-ci/npm/package-lock.json'
+fi
+if [[ ! -f "${server_rust_lock_path}" ]]; then
+ server_rust_lock_path='/usr/local/share/genarrative-ci/locks/server-rs.Cargo.lock'
+fi
+if [[ ! -f "${desktop_rust_lock_path}" ]]; then
+ desktop_rust_lock_path='/usr/local/share/genarrative-ci/locks/desktop-shell.Cargo.lock'
+fi
+
+verify_cache_lock \
+ npm \
+ "${GENARRATIVE_GITEA_CI_NPM_LOCK_SHA256:-}" \
+ "${npm_lock_path}"
+verify_cache_lock \
+ server_rust \
+ "${GENARRATIVE_GITEA_CI_SERVER_RUST_LOCK_SHA256:-}" \
+ "${server_rust_lock_path}"
+verify_cache_lock \
+ desktop_rust \
+ "${GENARRATIVE_GITEA_CI_DESKTOP_RUST_LOCK_SHA256:-}" \
+ "${desktop_rust_lock_path}"
+
+for command_name in \
+ bwrap \
+ cargo \
+ clang \
+ cmake \
+ curl \
+ ffmpeg \
+ file \
+ google-chrome \
+ lld \
+ npm \
+ patchelf \
+ pkg-config \
+ rg \
+ rustfmt \
+ rustup \
+ wget; do
+ command -v "${command_name}" >/dev/null
+done
+
+pkg-config --exists \
+ ayatana-appindicator3-0.1 \
+ libcurl \
+ openssl \
+ webkit2gtk-4.1
+
+node --version
+npm --version
+rustup run "${expected_toolchain}" rustc --version
+rustup run "${expected_toolchain}" cargo --version
+rustup run "${expected_toolchain}" rustfmt --version
+google-chrome --version
+bwrap --version
+ffmpeg -version | head -n 1
+
+if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
+ bash "${repo_root}/scripts/check-gitea-ci-job-runtime.sh"
+fi
diff --git a/scripts/check-gitea-ci-job-runtime.sh b/scripts/check-gitea-ci-job-runtime.sh
new file mode 100644
index 000000000..1a10d033b
--- /dev/null
+++ b/scripts/check-gitea-ci-job-runtime.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+bwrap_args=(
+ --die-with-parent
+ --unshare-all
+ --unshare-user
+ --disable-userns
+ --assert-userns-disabled
+ --cap-drop ALL
+ --clearenv
+ --ro-bind /usr /usr
+)
+for merged_path in /bin /sbin /lib /lib64; do
+ if [[ -L "${merged_path}" ]]; then
+ bwrap_args+=(--symlink "$(readlink "${merged_path}")" "${merged_path}")
+ fi
+done
+bwrap_args+=(
+ --proc /proc
+ --dev /dev
+ --tmpfs /tmp
+ --
+ /usr/bin/true
+)
+bwrap "${bwrap_args[@]}"
+
+chrome_output="$(
+ timeout 30 google-chrome \
+ --headless=new \
+ --no-sandbox \
+ --disable-dev-shm-usage \
+ --disable-gpu \
+ --dump-dom \
+ 'data:text/html,genarrative-ci' \
+ 2>/dev/null
+)"
+rg -q 'genarrative-ci' <<< "${chrome_output}"