Repository navigation
ci: land upstream's split CI workflows ahead of the upstream sync (#202) - #204
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+157
to
+210
| name: Mobile Swift (${{ matrix.name }}) | ||
| runs-on: macos-latest | ||
| timeout-minutes: 45 | ||
| if: ${{ github.repository != 'Kiingo/buzz' && (inputs.lane == 'mobile-swift' && inputs.mobile) }} | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - name: Native | ||
| lane: native | ||
| - name: Release | ||
| lane: release | ||
| steps: | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 | ||
| - name: Install Flutter dependencies | ||
| run: cd mobile && flutter pub get | ||
| - name: Build | ||
| if: matrix.lane == 'native' | ||
| run: swift build --package-path mobile/ios/BuzzPushKit | ||
| - name: Build release | ||
| if: matrix.lane == 'native' | ||
| run: swift build -c release --package-path mobile/ios/BuzzPushKit | ||
| - name: Test | ||
| if: matrix.lane == 'native' | ||
| run: swift test --package-path mobile/ios/BuzzPushKit | ||
| - name: Test native pagination geometry | ||
| if: matrix.lane == 'native' | ||
| run: /bin/bash scripts/test-mobile-pagination.sh | ||
| - name: Build complete iOS simulator app | ||
| if: matrix.lane == 'native' | ||
| run: cd mobile && flutter build ios --simulator --debug --no-pub | ||
| - name: Test native controls and push navigation bridge | ||
| if: matrix.lane == 'native' | ||
| run: | | ||
| device=$(xcrun simctl create "Pagination accessibility" "iPhone 16") | ||
| trap 'xcrun simctl shutdown "$device"; xcrun simctl delete "$device"' EXIT | ||
| xcrun simctl boot "$device" | ||
| xcrun simctl bootstatus "$device" -b | ||
| /bin/bash scripts/test-mobile-pagination-accessibility.sh "$device" | ||
| /bin/bash scripts/test-mobile-carousel.sh "$device" | ||
| /bin/bash scripts/test-mobile-member-picker.sh "$device" | ||
| xcodebuild -workspace mobile/ios/Runner.xcworkspace -scheme Runner \ | ||
| -configuration Debug -destination "platform=iOS Simulator,id=$device" \ | ||
| -parallel-testing-enabled NO \ | ||
| -only-testing:RunnerTests/BuzzPushNavigationBridgeTests \ | ||
| CODE_SIGNING_ALLOWED=NO test | ||
| - name: Build complete unsigned iOS release | ||
| if: matrix.lane == 'release' | ||
| run: | | ||
| /bin/bash scripts/test-mobile-gateway-recipes.sh | ||
| cd mobile && flutter build ios --release --no-codesign --no-pub | ||
|
|
||
| results: |
Comment on lines
+192
to
+201
| name: Rust | ||
| needs: [changes] | ||
| if: ${{ github.repository != 'Kiingo/buzz' && (github.event_name == 'push' || needs.changes.outputs.rust == 'true') }} | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1 | ||
| - uses: rui314/setup-mold@7e4f20ad28a2e8ca6fd0892ccf72e2abb706b9c3 # v1 | ||
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2.9.1 | ||
| with: | ||
| key: sherpa-cache-v1 | ||
| save-if: ${{ github.event_name != 'pull_request' }} | ||
| - name: Install cargo-nextest | ||
| uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15 | ||
| with: | ||
| tool: cargo-nextest@0.9.136 | ||
| - name: Unit tests | ||
| if: ${{ github.repository != 'Kiingo/buzz' }} | ||
| run: just test-unit | ||
| if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true' | ||
| uses: ./.github/workflows/_ci-rust.yml | ||
| with: | ||
| rust: ${{ needs.changes.outputs.rust == 'true' }} | ||
| desktop_rust: ${{ needs.changes.outputs.desktop-rust == 'true' }} | ||
| lane: required | ||
|
|
||
| desktop-core: | ||
| name: Desktop Core | ||
| runs-on: ${{ fromJSON(github.repository == 'Kiingo/buzz' && '["self-hosted","linux","x64","kiingo-azure","untrusted-test","d4ads-v6","docker","kiingo-buzz-public"]' || '["ubuntu-latest"]') }} | ||
| timeout-minutes: 45 | ||
| rust-cross-compile-domain: |
Comment on lines
+202
to
+211
| name: Rust Cross-Compile | ||
| needs: [changes] | ||
| if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' | ||
| uses: ./.github/workflows/_ci-rust.yml | ||
| with: | ||
| rust: ${{ needs.changes.outputs.rust == 'true' }} | ||
| desktop_rust: ${{ needs.changes.outputs.desktop-rust == 'true' }} | ||
| lane: cross-compile | ||
|
|
||
| desktop-domain: |
Comment on lines
+212
to
+221
| name: Desktop Domain | ||
| needs: [changes] | ||
| if: github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true' | ||
| permissions: | ||
| contents: read | ||
| uses: ./.github/workflows/_ci-desktop.yml | ||
| with: | ||
| rust: ${{ needs.changes.outputs.rust == 'true' }} | ||
| desktop: ${{ needs.changes.outputs.desktop == 'true' }} | ||
| desktop_rust: ${{ needs.changes.outputs.desktop-rust == 'true' }} | ||
|
|
||
| relay-artifacts-domain: |
Comment on lines
+222
to
+232
| name: Relay Artifact Producer | ||
| needs: [changes] | ||
| if: ${{ github.repository != 'Kiingo/buzz' && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true') }} | ||
| uses: ./.github/workflows/_ci-relay.yml | ||
| with: | ||
| rust: ${{ needs.changes.outputs.rust == 'true' }} | ||
| desktop: ${{ needs.changes.outputs.desktop == 'true' }} | ||
| desktop_rust: ${{ needs.changes.outputs.desktop-rust == 'true' }} | ||
| lane: artifacts | ||
|
|
||
| postgres-domain: |
Comment on lines
+244
to
+253
| name: Desktop macOS Domain | ||
| needs: [changes] | ||
| if: ${{ github.repository != 'Kiingo/buzz' && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true') }} | ||
| uses: ./.github/workflows/_ci-desktop-macos.yml | ||
| with: | ||
| rust: ${{ needs.changes.outputs.rust == 'true' }} | ||
| desktop: ${{ needs.changes.outputs.desktop == 'true' }} | ||
| desktop_rust: ${{ needs.changes.outputs.desktop-rust == 'true' }} | ||
|
|
||
| relay-domain: |
Comment on lines
+254
to
+264
| name: Relay and PostgreSQL | ||
| needs: [changes, relay-artifacts-domain] | ||
| if: ${{ github.repository != 'Kiingo/buzz' && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true') }} | ||
| uses: ./.github/workflows/_ci-relay.yml | ||
| with: | ||
| rust: ${{ needs.changes.outputs.rust == 'true' }} | ||
| desktop: ${{ needs.changes.outputs.desktop == 'true' }} | ||
| desktop_rust: ${{ needs.changes.outputs.desktop-rust == 'true' }} | ||
| lane: required | ||
|
|
||
| clients: |
Comment on lines
+265
to
+274
| name: Clients | ||
| needs: [changes] | ||
| if: github.event_name == 'push' || needs.changes.outputs.web == 'true' || needs.changes.outputs.mobile == 'true' | ||
| uses: ./.github/workflows/_ci-clients.yml | ||
| with: | ||
| web: ${{ needs.changes.outputs.web == 'true' }} | ||
| mobile: ${{ needs.changes.outputs.mobile == 'true' }} | ||
| lane: required | ||
|
|
||
| mobile-swift-domain: |
Comment on lines
+275
to
+284
| name: Mobile Swift Domain | ||
| needs: [changes] | ||
| if: ${{ github.repository != 'Kiingo/buzz' && (needs.changes.outputs.mobile == 'true') }} | ||
| uses: ./.github/workflows/_ci-clients.yml | ||
| with: | ||
| web: ${{ needs.changes.outputs.web == 'true' }} | ||
| mobile: ${{ needs.changes.outputs.mobile == 'true' }} | ||
| lane: mobile-swift | ||
|
|
||
| security-domain: |
Comment on lines
+285
to
+292
| name: Security Domain | ||
| needs: [changes] | ||
| if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' | ||
| uses: ./.github/workflows/_ci-security.yml | ||
| with: | ||
| rust: ${{ needs.changes.outputs.rust == 'true' }} | ||
|
|
||
| rust-lint: |
RossHartmann
force-pushed
the
ci/upstream-sync-workflows
branch
from
October 17, 2026 19:39
3edefb3 to
3024128
Compare
Author
|
Taken over by C (2026-10-17). This is still a draft, sequenced with #202. Rebased onto main f5e365e (#205–#209).
|
Kiingo's Spot runner admission only runs a job whose workflow file matches main (public_workflow_not_current), so the upstream sync PR (#202), which replaces ci.yml with upstream's split _ci-*.yml, cannot run its own CI. Land the workflow files and their CI-support scripts, hermit pins and nextest config first, unchanged from the sync branch: Kiingo's Spot-only, no-test policy is re-applied and upstream-only GitHub-hosted jobs are skipped on Kiingo/buzz. Inventory: a temporary drop/upstream-present delta and a four-file budget amendment, both removed by the sync. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Ross Hartmann <1750494+RossHartmann@users.noreply.github.com>
RossHartmann
force-pushed
the
ci/upstream-sync-workflows
branch
from
October 17, 2026 20:59
3024128 to
fc0c5f3
Compare
Author
RossHartmann
marked this pull request as ready for review
October 17, 2026 21:49
RossHartmann
pushed a commit
that referenced
this pull request
Oct 17, 2026
Workflow files already match; the temporary upstream-ci-prelanding delta is dropped because the sync moves upstreamSnapshot past those files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Kiingo's Spot runner admission (
gha-runner-controllerpublic-buzz.cjs) only admits a job whose workflow file is byte-identical to the file on fork main; otherwise it rejects the job withpublic_workflow_not_current. The upstream sync, #202, replacesci.ymlwith upstream's split_ci-*.ymland changesdocker.ymland a few others. As a result most of #202's CI can't run. This PR lands those workflow files on main first, so #202's workflows match main and its full CI can run.What
sync/upstream-60de1db0:ci.yml, the new_ci-clients.yml,_ci-desktop.yml,_ci-desktop-macos.yml,_ci-relay.yml,_ci-rust.ymland_ci-security.yml, plusdocker.yml,sprig.yml,mesh-lifecycle.yml,push-gateway-helm-chart.yml,codex-security-review.yml,minio-image.yml, and.github/ci/minio,.github/scriptsandCODEOWNERS.scripts/ci-runtime-selection.mjs,ci-apt-retry.sh,postgres-test-*.sh,check-postgres-test-discovery.py,macos-icon.shandgenerate-macos-icon.py;actionlintanduv, plushermit.hcl;.config/nextest.toml.upstream-ci-prelandingdelta (drop/upstream-present), covering three newly modified upstream files (codex-security-review script and test, hermit.hcl). No budget amendment is needed: Ross's 2026-10-17 ceilings (fix(dm): make DM membership a privacy boundary and pin relay-signed metadata (Kiingo M-4017) #210) cover it. Sync upstream block/buzz main (97e1f6a0) into the Kiingo fork — DO NOT MERGE until main's go #202 removes both.Policy review (Spot only, no tests, no hosted runners)
kiingo-buzz-publicSpot labels._ci-relay,_ci-desktop-macosand mobile-swift are all guarded withgithub.repository != 'Kiingo/buzz'). The others are skipped at the job:minio-image;push-gateway-personal-devindocker.yml. Upstream had no guard on this one, and it ran on a GitHub-hosted runner in Sync upstream block/buzz main (97e1f6a0) into the Kiingo fork — DO NOT MERGE until main's go #202's CI. Fixed here and in Sync upstream block/buzz main (97e1f6a0) into the Kiingo fork — DO NOT MERGE until main's go #202 (4ddc672).cargo nextest/cargo test, playwright,flutter test,swift test) are only in jobs that are skipped on Kiingo/buzz..github/kiingo-spot-ci.json(the policy file that admission validates) is unchanged.actionlint1.7.12 passes on all workflows. The fork boundary guard passes.Can this PR run CI itself?
No, by design. Admission compares each job's workflow file with main, and this PR changes those files, so the changed workflows' jobs are rejected here too. Only workflows that are unchanged (Desktop Release Candidate,
helm chart, CodeQL) can run. There is no way around this without weakening the admission rule that stops PR-authored workflow code from running on self-hosted runners, and I don't recommend that.Risk: these workflows assume the post-sync tree
justrecipes that differ on the sync branch (the Justfile changed in the merge), and reference scripts or paths that only exist after the sync. For example,just desktop-tauri-test-meshisn't in main's Justfile, though it sits behind a lane input.🤖 Generated with Claude Code