Skip to content

ci: bake custom ARC runner image and migrate CI off depot #321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Roasbeef merged 2 commits into from
Jun 1, 2026
Merged

ci: bake custom ARC runner image and migrate CI off depot #321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8b4d05a
ci: migrate CI jobs from depot to ARC self-hosted runners
Roasbeef May 16, 2026
916987f
multi: bump test timeouts for slower ARC runners
Roasbeef May 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 14 additions & 20 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ jobs:
########################
commit-message:
name: Commit Message
runs-on: depot-ubuntu-24.04
runs-on: [self-hosted]

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep untrusted pull requests off self-hosted runners

This workflow still runs on pull_request (lines 7-9), and after this change every job executes on self-hosted; that means PR code from contributors can run directly on your own runner infrastructure instead of isolated hosted workers. In repositories where fork PRs are enabled, this is a high-risk execution path because attacker-controlled workflow code can probe the runner host and any credentials available to it, so self-hosted should be limited to trusted events or tightly restricted runner groups.

Useful? React with 👍 / 👎.

steps:
- name: Git checkout
uses: actions/checkout@v5
Expand Down Expand Up @@ -67,7 +67,7 @@ jobs:
########################
static-checks:
name: Static Checks
runs-on: depot-ubuntu-24.04
runs-on: [self-hosted]
steps:
- name: Git checkout
uses: actions/checkout@v5
Expand Down Expand Up @@ -137,16 +137,13 @@ jobs:
########################
lint:
name: Lint code
runs-on: depot-ubuntu-24.04-8
runs-on: [self-hosted]
steps:
- name: git checkout
uses: actions/checkout@v5
with:
fetch-depth: 0

- name: Clean up runner space
uses: ./.github/actions/cleanup-space

- name: setup go ${{ env.GO_VERSION }}
uses: ./.github/actions/setup-go
with:
Expand All @@ -162,7 +159,7 @@ jobs:
########################
cross-compile:
name: Cross compilation
runs-on: depot-ubuntu-24.04-4
runs-on: [self-hosted]
strategy:
fail-fast: true
matrix:
Expand All @@ -183,9 +180,6 @@ jobs:
- name: Git checkout
uses: actions/checkout@v5

- name: Clean up runner space
uses: ./.github/actions/cleanup-space

- name: Setup go ${{ env.GO_VERSION }}
uses: ./.github/actions/setup-go
with:
Expand All @@ -201,7 +195,7 @@ jobs:
########################
unit-test:
name: Run unit tests
runs-on: depot-ubuntu-24.04-4
runs-on: [self-hosted]

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pin runner OS/arch labels for Linux-only jobs

Switching to runs-on: [self-hosted] removes OS/arch constraints, but these jobs invoke Linux-specific tooling (bash, sudo, make, Docker paths) and were previously pinned to Ubuntu-specific runners. If any non-Linux self-hosted runner becomes eligible for this repo/group, scheduling can become nondeterministic and fail at runtime; add explicit labels (for example Linux/x64 or a dedicated ARC label) to preserve the prior routing guarantees.

Useful? React with 👍 / 👎.

strategy:
# Allow other tests in the matrix to continue if one fails.
fail-fast: false
Expand All @@ -218,9 +212,6 @@ jobs:
with:
fetch-depth: 0

- name: Clean up runner space
uses: ./.github/actions/cleanup-space

- name: Fetch and rebase on ${{ github.base_ref }}
if: github.event_name == 'pull_request'
uses: ./.github/actions/rebase
Expand All @@ -234,7 +225,10 @@ jobs:
- name: Run ${{ matrix.unit_type }}
# Run with sudo as harness uses user 0:0 which needs extra permissions
# on the github runner in order for docker mounts to work correctly.
run: sudo env "PATH=$PATH" "GOPATH=$GOPATH" make ${{ matrix.unit_type }}
# Bump the per-package test timeout from Go's 10m default because the
# ARC runners boot the test harness slower than Depot/local; 30m is
# generous headroom while still failing on a real hang.
run: sudo env "PATH=$PATH" "GOPATH=$GOPATH" make ${{ matrix.unit_type }} timeout=30m

- name: Clean coverage
run: grep -Ev '(\.pb\.go|\.pb\.json\.go|\.pb\.gw\.go|db/sqlc/)' coverage.txt > coverage-norpc.txt
Expand Down Expand Up @@ -280,7 +274,7 @@ jobs:
########################
systest:
name: Run system tests
runs-on: depot-ubuntu-24.04-8
runs-on: [self-hosted]
strategy:
# Allow other tests in the matrix to continue if one fails.
fail-fast: false
Expand All @@ -295,9 +289,6 @@ jobs:
with:
fetch-depth: 0

- name: Clean up runner space
uses: ./.github/actions/cleanup-space

- name: Fetch and rebase on ${{ github.base_ref }}
if: github.event_name == 'pull_request'
uses: ./.github/actions/rebase
Expand All @@ -311,7 +302,10 @@ jobs:
- name: Run systest with ${{ matrix.db_backend }}
# Run with sudo as harness uses user 0:0 which needs extra permissions
# on the github runner in order for docker mounts to work correctly.
run: sudo env "PATH=$PATH" "GOPATH=$GOPATH" make systest-verbose db=${{ matrix.db_backend }}
# Bump per-package test timeout above the Makefile default for the
# same ARC-vs-Depot harness-boot speed reasons documented in the unit
# test job above.
run: sudo env "PATH=$PATH" "GOPATH=$GOPATH" make systest-verbose db=${{ matrix.db_backend }} SYSTEST_TIMEOUT=30m

- name: Fix artifact permissions
if: always()
Expand Down
9 changes: 7 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -396,13 +396,18 @@ unit-swapruntime: #? Run unit tests with the optional swap client runtime enable
SYSTEST_DB_TAG := $(if $(filter postgres,$(db)),test_postgres)
SYSTEST_TAGS := systest $(SYSTEST_DB_TAG)

# Per-package test timeout for systest. CI overrides this on ARC runners
# where the test harness boots slower than on local dev; locally 10m is
# typically plenty.
SYSTEST_TIMEOUT ?= 10m

systest: #? Run system integration tests. Use db=postgres for PostgreSQL.
@$(call print, "Running system integration tests (db=$(or $(db),sqlite)).")
$(GOTEST) -tags "$(SYSTEST_TAGS)" -v ./systest/... -timeout 10m
$(GOTEST) -tags "$(SYSTEST_TAGS)" -v ./systest/... -timeout $(SYSTEST_TIMEOUT)

systest-verbose: #? Run system integration tests with verbose logging. Use db=postgres for PostgreSQL.
@$(call print, "Running system integration tests with verbose logging (db=$(or $(db),sqlite)).")
$(GOTEST) -tags "$(SYSTEST_TAGS)" -v ./systest/... -timeout 10m -harness.logstdout
$(GOTEST) -tags "$(SYSTEST_TAGS)" -v ./systest/... -timeout $(SYSTEST_TIMEOUT) -harness.logstdout

# ============
# RPC GENERATION
Expand Down
Loading