| @@ -1,10 +1,8 @@ |
| | # Deploys main to knotless.dev once this commit's checks all pass, |
| | # with deploy/deploy.sh over SSH, as a deploy from one's own checkout |
| | # does. DEPLOY_SSH_KEY is granted to pushes to main alone, in the |
| | # runner's secrets file on the host; the settings below are what |
| | # deploy/local.env holds for a deploy by hand. The runner itself is |
| | # restarted last, once this run is filed, and only if what it runs |
| | # changed (deploy.sh). |
| | # trusted runner's secrets file on its host; the settings below are what |
| | # deploy/local.env holds for a deploy by hand. |
| | # |
| | # It starts only once the seven checks have passed at its commit |
| | # (`after`), and holds no job while it waits for them, so the checks it |
| @@ -28,10 +26,14 @@ |
| | # |
| | # Last, the runner host (deploy/runner-host) takes the same image, copied |
| | # from this host only when its runner's build differs, and is restarted |
| | # with the settings below, so the runner that lands other repositories' |
| | # merge queues reads their rules as main does. It is reached with |
| | # RUNNER_HOST_SSH_KEY, granted to pushes to main alone, which its root |
| | # takes only from this host's addresses. |
| | # with the settings below, so the runner that lands the merge queues reads |
| | # their rules as main does. It is reached with RUNNER_HOST_SSH_KEY, granted |
| | # to pushes to main alone, which its root takes only from the trusted |
| | # runner's box. |
| | |
| | # Its secrets are on ci.knotless.dev alone, the runner that runs no one |
| | # else's code (deploy/runner-host/README.md, The trusted runner). |
| | runners: [ci.knotless.dev] |
| | on: |
| | push: |
| | refs: [refs/heads/main] |
| @@ -51,25 +53,20 @@ env: |
| | KNOTLESS_APNS_KEY_ID: J53A95HDW7 |
| | KNOTLESS_APNS_TEAM: YN68LN9T7Z |
| | KNOTLESS_DATA: /mnt/data/knotless |
| | # Half the host's 8 cores for a build at most, which the host's other |
| | # sites share (deploy.sh). |
| | KNOTLESS_BUILD_CPUS: 4 |
| | KNOTLESS_ADMIN_DIDS: did:plc:bcgltzqazw5tb6k2g3ttenbj |
| | # The runner's account (ci.knotless.dev), the triager's |
| | # (triage.knotless.dev) and the reviewer's (review.knotless.dev), which |
| | # log in at /oauth/bot for an OAuth session that reads private |
| | # repositories. |
| | KNOTLESS_BOT_DIDS: did:plc:ejh2v3z5ieqhqgz3ybk6r35x,did:plc:hwfywp7r4cfumv54v2xk3jz7,did:plc:kqi2glvzerg4dt66k64co2sl |
| | # knotless, and the owner's deploys elsewhere, kept off the runner host |
| | # that runs anyone's code: each of their workflows given a secret names |
| | # ci.knotless.dev in `runners`, and its secrets are sealed to it alone. |
| | # Their other workflows name runner.knotless.dev, so this one runs none. |
| | KNOTLESS_RUN_REPOS: chadtmiller.com/knotless chadtmiller.com/pds.js chadtmiller.com/group-host grain.social/grain grain.social/grain-ios |
| | # Lands the merge queue in batches. Open pulls run on the runner host |
| | # (--pulls-only there, deploy/runner-host), off this one's CPU, but a |
| | # queued pull's pre-flights and each batch run here. Uncapped, one test |
| | # takes about 9 GiB and every core, and two stalled the host: two jobs |
| | # of 3 CPUs and 7 GiB leave serve 2 cores and some 2 GB, with swap the |
| | # margin, and a run past its memory fails its step rather than the host. |
| | # At 6 GiB, compiling knotless-serve for coverage was killed. |
| | KNOTLESS_RUN_ARGS: --queue --jobs 2 --cpus 3 --memory 7 |
| | # No runner here: knotless's checks and merge queue run on the runner |
| | # host (runner.knotless.dev), and the workflows that hold a secret, this |
| | # one among them, on the trusted runner (ci.knotless.dev), neither on |
| | # this host (deploy/runner-host/README.md). With no KNOTLESS_RUN_REPOS a |
| | # deploy removes any runner an earlier one left here. |
| | # The runner host's account (deploy/runner-host), which a new public |
| | # repository names unless its owner names others: it runs anyone's. |
| | KNOTLESS_DEFAULT_RUNNER_DID: did:plc:4bocpkn5zkwe4wuu4plrj5kt |
| @@ -80,9 +77,9 @@ env: |
| | KNOTLESS_RUNNER_HOST: root@runner.knotless.dev |
| | KNOTLESS_RUNNER_DOMAIN: runner.knotless.dev |
| | KNOTLESS_RUNNER_DID: did:plc:4bocpkn5zkwe4wuu4plrj5kt |
| | KNOTLESS_RUNNER_ARGS: --queue --pulls-only chadtmiller.com/knotless --unmetered did:plc:bcgltzqazw5tb6k2g3ttenbj --unmetered did:plc:e7rftrdyz5e2rw4y6ocszew2 --trust did:plc:bcgltzqazw5tb6k2g3ttenbj --trust did:plc:e7rftrdyz5e2rw4y6ocszew2 --pull-jobs 2 |
| | KNOTLESS_RUNNER_ARGS: --queue --unmetered did:plc:bcgltzqazw5tb6k2g3ttenbj --unmetered did:plc:e7rftrdyz5e2rw4y6ocszew2 --trust did:plc:bcgltzqazw5tb6k2g3ttenbj --trust did:plc:e7rftrdyz5e2rw4y6ocszew2 --pull-jobs 4 |
| | KNOTLESS_RUNNER_CPUS: "4" |
| | KNOTLESS_RUNNER_JOBS: "2" |
| | KNOTLESS_RUNNER_JOBS: "4" |
| | KNOTLESS_RUNNER_MEMORY: "7" |
| | # The oldest client this asks for: 0.6.0 deletes a deleted ref's record |
| | # and starts a new ref at the time, and an older client making a branch |
| |
chadtmiller.com/knotless