sjgandClaude Opus 5
2f4973ed70
CI / test (pull_request) Successful in 13m51s
CI / frontend (pull_request) Successful in 5m1s
CI / test (push) Successful in 7m43s
CI / frontend (push) Successful in 2m18s
CI / reuse (pull_request) Successful in 4s
CI / lint (pull_request) Successful in 4m22s
CI / lint (push) Successful in 2m23s
CI / reuse (push) Successful in 1m18s
act_runner validates every bind mount against `valid_volumes`, which defaults to an empty allowlist, so the `-v /var/cache/sccache:/sccache` in `container.options` was dropped on every job. The only trace is one line in the job log — "[/var/cache/sccache] is not a valid volume, will be ignored" — after which SCCACHE_DIR points at a path that does not outlive the container, so the shared compilation cache never persisted. Allow that one path rather than the `**` wildcard: the runner is the only thing mounting host directories here, and a narrow allowlist keeps a workflow from mounting arbitrary host paths into a job container. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GdyUjuXejCEfiub675z6cz Signed-off-by: Stan Grams <sjg@haxx.space>
48 lines
2.0 KiB
YAML
48 lines
2.0 KiB
YAML
# SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
|
|
#
|
|
# SPDX-License-Identifier: GPL-2.0-or-later
|
|
#
|
|
# Example act_runner config for the Docker-executor runner that lives in the
|
|
# CI VM. This is NOT the SDK image — it configures the runner that launches
|
|
# per-job containers (including the trx-rs SDK image referenced by the
|
|
# workflow's `container:` key). Copy to the VM and pass with
|
|
# `act_runner daemon --config`.
|
|
|
|
log:
|
|
level: info
|
|
|
|
runner:
|
|
file: .runner
|
|
# One concurrent job. With one runner per project on a 2-vCPU VM this keeps
|
|
# total CI usage at ~2 threads.
|
|
capacity: 1
|
|
timeout: 3h
|
|
# Docker executor: no ":host" suffix. Maps runs-on labels to base images
|
|
# (the workflow overrides these per job via `container:`).
|
|
labels:
|
|
- "ubuntu-latest:docker://catthehacker/ubuntu:act-latest"
|
|
|
|
cache:
|
|
enabled: true
|
|
|
|
container:
|
|
# Cap every job container's CPU so CI stays within the 2-thread budget even
|
|
# if capacity is raised later. The -v mount persists the sccache cache on the
|
|
# host (create it first: `mkdir -p /var/cache/sccache`), matching SCCACHE_DIR
|
|
# in the workflow.
|
|
options: "--cpus=2 -v /var/cache/sccache:/sccache"
|
|
# act_runner rejects every bind mount unless it is listed here — the default
|
|
# is an empty allowlist, so the -v above is dropped with only a
|
|
# "[...] is not a valid volume, will be ignored" line in the job log, and
|
|
# SCCACHE_DIR then points at a directory that does not outlive the job.
|
|
valid_volumes:
|
|
- /var/cache/sccache
|
|
# Reuse the host VM's Docker network for the built-in cache/artifact server.
|
|
network: "host"
|
|
# The workflow pulls the SDK image by the moving `:latest` tag. Without this
|
|
# the runner logs "Image exists? true" and reuses whatever it cached the
|
|
# first time, so pushing a rebuilt image has no effect until someone pulls
|
|
# on the VM by hand — which looks like the image is missing a tool it in
|
|
# fact has. The extra registry round-trip per job is nothing next to a build.
|
|
force_pull: true
|