timka123andClaude Opus 5
bc6ff3c489
Four workflows, none of which existed: * `tests.yml` — backend, desktop, `:core` and the web app's typecheck+build, in parallel. `:core` needs no Android SDK at all, because settings.gradle.kts leaves `:app` out when there is none; `:app`'s Robolectric suite therefore lives in the APK workflow, where the SDK is installed anyway. Nothing needs a running backend — the suites feed on committed fixtures, which is the whole reason they were written that way. * `lint.yml` — ruff, which the repo had been configured for and never run. * `docker.yml` — builds the image, *starts* it against SQLite and waits for /api/health before pushing, then publishes `:latest` and `:<short-sha>` to git.timka.su. A tag nobody can run is worse than no tag. * `android-release.yml` — the release APK on every push to master, signed from secrets, with `apksigner verify --print-certs` reporting which key was really used and failing if it was the debug one. Three things the repo needed before any of that could work: `versionCode` was pinned at 1, so every APK looked like the same version to the phone and would not install over its predecessor. It now comes from the run number, with `versionName` from a property, both via one `setting()` helper that reads a Gradle property or an environment variable. The release build fell back to the *debug* signing key whenever the keystore was missing — silently. That is a trap: the APK installs, looks fine, and can never be upgraded by a properly signed build. `KADENCE_REQUIRE_SIGNING=1` makes that case fail the build instead, and the release job sets it whenever a keystore secret is present. The compose files built an image with no name, so there was nothing to pull. `image:` now names the registry tag while `up --build` still builds locally. Also: `android/ci/install-sdk.sh` (idempotent, cacheable, and the one place that knows `platforms;android-37.0` is spelled with the minor version), the runner as a compose service with its config and a setup checklist, six make targets, and a README section. No runner is registered yet — `make ci-runner` is step two of that checklist. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
49 lines
2.4 KiB
YAML
49 lines
2.4 KiB
YAML
# The Gitea Actions runner, for a single-machine Gitea.
|
|
#
|
|
# Nothing in .gitea/workflows runs until a runner is registered, and this is the
|
|
# whole of it. Two settings do the work:
|
|
#
|
|
# * the **label map** decides what `runs-on: ubuntu-latest` means. It is pinned
|
|
# to catthehacker/ubuntu:act-24.04 because the workflows need two things from
|
|
# the image: a node (Gitea's javascript actions — checkout, cache,
|
|
# upload-artifact — run *inside* the job container) and Python 3.12, which
|
|
# the backend's `requires-python` insists on. Ubuntu 24.04 ships 3.12.
|
|
# * the **docker socket**, mounted into job containers so the `docker` workflow
|
|
# can build and push an image. That is a real privilege handed to CI; it is
|
|
# also the normal arrangement when Gitea and its runner are the same box as
|
|
# the deployment.
|
|
#
|
|
# Setting it up:
|
|
#
|
|
# 1. Gitea → Settings → Actions → Runners → "Create new runner", copy the token.
|
|
# 2. GITEA_RUNNER_REGISTRATION_TOKEN=<token> docker compose -f docker-compose.ci.yml up -d
|
|
# 3. Repository → Settings → Actions → Secrets, add:
|
|
# REGISTRY_USER, REGISTRY_TOKEN — a Gitea user and token with
|
|
# package:write, for the registry
|
|
# KADENCE_KEYSTORE_BASE64 — base64 -w0 of your keystore
|
|
# KADENCE_KEYSTORE_PASSWORD, KADENCE_KEY_ALIAS, KADENCE_KEY_PASSWORD
|
|
# Without the keystore secrets the APK job still runs and produces an
|
|
# unsigned-for-release (debug-signed) artifact rather than failing.
|
|
#
|
|
# Gitea itself needs `[actions] ENABLED = true` in app.ini, and
|
|
# `DEFAULT_ACTIONS_URL = github` so `actions/checkout@v4` can be resolved.
|
|
services:
|
|
runner:
|
|
image: gitea/act_runner:0.2.11
|
|
restart: unless-stopped
|
|
environment:
|
|
GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:-https://git.timka.su}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:?set this to the token from Gitea}
|
|
GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-kadence-runner}
|
|
GITEA_RUNNER_LABELS: ubuntu-latest:docker://catthehacker/ubuntu:act-24.04
|
|
# Mounted into every job container, which is what lets the docker workflow
|
|
# build an image. `valid_volumes` has to allow it explicitly.
|
|
CONFIG_FILE: /config/config.yaml
|
|
volumes:
|
|
- runner-data:/data
|
|
- ./deploy/act-runner.yaml:/config/config.yaml:ro
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
|
|
volumes:
|
|
runner-data:
|