From 8e24b86b7d17f4cf3d1f6a7a3a465384fd865eda Mon Sep 17 00:00:00 2001 From: theBlanketBaron Date: Wed, 11 Nov 2026 13:48:44 -0500 Subject: [PATCH 1/2] CI on Murph (rally RAL-144): .ci/local.toml; workflows run by hand only ci-local runs tests, conformance, windows-cross-check and dependency-audit on Murph and posts local/; local/check passes when tests and conformance both pass, as the workflow's check did. macos stays in the workflow, by hand. The release workflow loses its tag trigger: a dispatch on a v* tag with draft_release=true makes the draft release the tag push used to. Co-Authored-By: Claude Opus 5.5 --- .ci/local.toml | 90 +++++++++++++++++++++++++++++++++++ .github/workflows/ci.yml | 7 ++- .github/workflows/release.yml | 18 ++++--- 3 files changed, 105 insertions(+), 10 deletions(-) create mode 100644 .ci/local.toml diff --git a/.ci/local.toml b/.ci/local.toml new file mode 100644 index 00000000..fe9c2398 --- /dev/null +++ b/.ci/local.toml @@ -0,0 +1,90 @@ +# Muster's CI, run on Murph by ci-local (Castor-o7/rally RAL-144, docs/ci-local.md there). +# One entry per job in .github/workflows/ci.yml, which now runs only by hand. Each posts +# `local/`; `check` is the one main's ruleset requires. + +workflows = ["ci.yml"] + +# The workspace checks and the end-to-end scripts. +[jobs.tests] +mem = "12G" +cpu = "600%" +timeout_min = 45 +postgres = true +env = { CARGO_PROFILE_DEV_DEBUG = "line-tables-only" } +run = """ +# Each published crate ships its own copy of the licences; they must match the root files exactly. +status=0 +for crate in entities daemon shim tui; do + for f in LICENSE-MIT LICENSE-APACHE; do + if ! cmp -s "$f" "crates/$crate/$f"; then echo "crates/$crate/$f differs from the root $f (or is missing)"; status=1; fi + done +done +test $status = 0 +command -v nc >/dev/null || { echo "the end-to-end scripts need nc (openbsd-netcat), which this machine doesn't have"; exit 1; } +cargo fmt --all -- --check +cargo clippy --workspace --all-targets -- -D warnings +cargo test --workspace +cargo build --workspace && ./scripts/test-gate-e2e.sh +./scripts/test-links-e2e.sh +sh scripts/test-install-codex.sh +RESTART_E2E_POSTGRES_URL="$CI_POSTGRES_URL" ./scripts/test-restart-e2e.sh +./scripts/test-restart-file-e2e.sh +python3 -m unittest discover -s scripts/sandbox -v +""" + +# MUS-69's delivery conformance grid. +[jobs.conformance] +mem = "12G" +cpu = "600%" +timeout_min = 45 +postgres = true +env = { CARGO_PROFILE_DEV_DEBUG = "line-tables-only" } +run = """ +# bun, pinned and checked as the workflow does, kept between runs under ~/.cache/ci/tools. +BUN_VERSION=1.3.14 +BUN_SHA256=951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f +bun_dir="$HOME/.cache/ci/tools/bun-$BUN_VERSION" +if [ ! -x "$bun_dir/bun-linux-x64/bun" ]; then + curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -o "$TMPDIR/bun.zip" "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" + echo "${BUN_SHA256} $TMPDIR/bun.zip" | sha256sum -c - + mkdir -p "$bun_dir" && python3 -m zipfile -e "$TMPDIR/bun.zip" "$bun_dir" && chmod +x "$bun_dir/bun-linux-x64/bun" +fi +export MUSTER_BUN="$bun_dir/bun-linux-x64/bun" +"$MUSTER_BUN" --version +for plugin in muster-pi muster-opencode muster-prime-agent; do + (cd "plugins/$plugin" && npm ci --workspaces=false --no-audit --no-fund --ignore-scripts) +done +(cd plugins/muster-pi && "$MUSTER_BUN" test) +export CONFORMANCE_REQUIRE_BUN=1 +export CONFORMANCE_POSTGRES_URL="$CI_POSTGRES_URL" +export CONFORMANCE_REQUIRE_POSTGRES=1 +cargo build --workspace && cargo test -p muster-shim --test conformance -- --ignored --nocapture +""" + +# What main's ruleset requires: passes only when `tests` and `conformance` both passed. +[jobs.check] +needs = ["tests", "conformance"] + +[jobs.macos] +manual = "macOS (MUS-13): run the workflow by hand; hosted macOS bills nothing on a public repo" + +# muster-shim's #[cfg(windows)] code, cross-compiled. +[jobs.windows-cross-check] +mem = "6G" +cpu = "400%" +timeout_min = 25 +run = """ +command -v x86_64-w64-mingw32-gcc >/dev/null || { echo "needs the mingw C cross-compiler (mingw-w64-gcc), which this machine doesn't have"; exit 1; } +rustup target list --installed | grep -qx x86_64-pc-windows-gnu || rustup target add x86_64-pc-windows-gnu +cargo check -p muster-shim --target x86_64-pc-windows-gnu +""" + +# Dependency audit (MUS-11), with cargo-deny at the workflow's pinned version. +[jobs.dependency-audit] +mem = "4G" +cpu = "200%" +timeout_min = 20 +run = """ +test "$(cargo deny --version)" = "cargo-deny 0.20.2" || cargo install --locked cargo-deny --version 0.20.2 +cargo deny check +""" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 928a9f90..b0385e86 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,10 +1,9 @@ name: CI +# CI runs on Murph now (Castor-o7/rally RAL-144): ci-local runs these jobs from .ci/local.toml +# and posts `local/`. This workflow stays only to be run by hand (the macOS job above all). on: - push: - branches: [main] - pull_request: - branches: [main] + workflow_dispatch: env: CARGO_TERM_COLOR: always diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b167464f..9e171c7d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,14 +4,20 @@ name: Release # needs a Rust toolchain to install. scripts/install-codex.sh fetches # releases/latest/download/muster-shim-, so the assets are raw binaries with those names. # -# - workflow_dispatch builds everything and uploads it as a workflow artifact only: a dry run that -# touches no release and no tag. -# - Pushing a `v*` tag does the same, then creates a DRAFT release with the files attached. Nothing +# Run by hand only (Castor-o7/rally RAL-144: no workflow runs on its own; hosted runners bill +# nothing on this public repository): +# - `gh workflow run release.yml --ref ` builds everything and uploads it as a +# workflow artifact only: a dry run that touches no release and no tag. +# - `gh workflow run release.yml --ref v1.2.3 -f draft_release=true`, on a `v*` tag, does the same, +# then creates a DRAFT release with the files attached (what pushing the tag used to do). Nothing # is public until someone publishes the draft by hand. on: - push: - tags: ["v*"] workflow_dispatch: + inputs: + draft_release: + description: "On a v* tag: also create a draft release with the files" + type: boolean + default: false permissions: contents: read @@ -115,7 +121,7 @@ jobs: release: needs: package - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') + if: inputs.draft_release && startsWith(github.ref, 'refs/tags/v') runs-on: ubuntu-latest timeout-minutes: 10 permissions: From c6ee9b7576d5c5b1a954372a280f0d56dcc5dc86 Mon Sep 17 00:00:00 2001 From: theBlanketBaron Date: Wed, 11 Nov 2026 17:32:51 -0500 Subject: [PATCH 2/2] CI on Murph (rally RAL-144): run both; hosted workflows keep their triggers Josh (2026-11-11, directly): muster is public, so GitHub's standard hosted runners bill nothing. ci.yml and release.yml are restored as on main; .ci/local.toml declares `hosted_runs`, so ci-local runs alongside Actions and Actions' `check` stays the required check. Co-Authored-By: Claude Opus 5.5 --- .ci/local.toml | 8 +++++--- .github/workflows/ci.yml | 7 ++++--- .github/workflows/release.yml | 18 ++++++------------ 3 files changed, 15 insertions(+), 18 deletions(-) diff --git a/.ci/local.toml b/.ci/local.toml index fe9c2398..c3c32ec0 100644 --- a/.ci/local.toml +++ b/.ci/local.toml @@ -1,8 +1,10 @@ # Muster's CI, run on Murph by ci-local (Castor-o7/rally RAL-144, docs/ci-local.md there). -# One entry per job in .github/workflows/ci.yml, which now runs only by hand. Each posts -# `local/`; `check` is the one main's ruleset requires. +# One entry per job in .github/workflows/ci.yml, which still runs on GitHub too. Each posts +# `local/`, alongside Actions' `check`, which stays the one main's ruleset requires. workflows = ["ci.yml"] +# Josh, 2026-11-11: run both. Muster is public, so GitHub's standard runners bill nothing. +hosted_runs = "public repository: GitHub's standard hosted runners bill nothing" # The workspace checks and the end-to-end scripts. [jobs.tests] @@ -66,7 +68,7 @@ cargo build --workspace && cargo test -p muster-shim --test conformance -- --ign needs = ["tests", "conformance"] [jobs.macos] -manual = "macOS (MUS-13): run the workflow by hand; hosted macOS bills nothing on a public repo" +manual = "macOS (MUS-13): runs on GitHub's hosted macOS, which bills nothing on a public repo" # muster-shim's #[cfg(windows)] code, cross-compiled. [jobs.windows-cross-check] diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b0385e86..928a9f90 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,9 +1,10 @@ name: CI -# CI runs on Murph now (Castor-o7/rally RAL-144): ci-local runs these jobs from .ci/local.toml -# and posts `local/`. This workflow stays only to be run by hand (the macOS job above all). on: - workflow_dispatch: + push: + branches: [main] + pull_request: + branches: [main] env: CARGO_TERM_COLOR: always diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9e171c7d..b167464f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,20 +4,14 @@ name: Release # needs a Rust toolchain to install. scripts/install-codex.sh fetches # releases/latest/download/muster-shim-, so the assets are raw binaries with those names. # -# Run by hand only (Castor-o7/rally RAL-144: no workflow runs on its own; hosted runners bill -# nothing on this public repository): -# - `gh workflow run release.yml --ref ` builds everything and uploads it as a -# workflow artifact only: a dry run that touches no release and no tag. -# - `gh workflow run release.yml --ref v1.2.3 -f draft_release=true`, on a `v*` tag, does the same, -# then creates a DRAFT release with the files attached (what pushing the tag used to do). Nothing +# - workflow_dispatch builds everything and uploads it as a workflow artifact only: a dry run that +# touches no release and no tag. +# - Pushing a `v*` tag does the same, then creates a DRAFT release with the files attached. Nothing # is public until someone publishes the draft by hand. on: + push: + tags: ["v*"] workflow_dispatch: - inputs: - draft_release: - description: "On a v* tag: also create a draft release with the files" - type: boolean - default: false permissions: contents: read @@ -121,7 +115,7 @@ jobs: release: needs: package - if: inputs.draft_release && startsWith(github.ref, 'refs/tags/v') + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') runs-on: ubuntu-latest timeout-minutes: 10 permissions: