c4799dcc13
Non-secret inputs git-ignored in windy-pro (models, linux-x64 portable bundle, enter-monitor build) that build-desktop needs. Mounted :ro into dind; valid_volumes allows only /ci-inputs/windy-pro; refresh-ci-inputs.sh copies them from the frozen release clone (read-only on the source). Invariant I-5 narrowed, not dropped: exactly that one path, read-only in dind, no other service mounts it, still no docker socket (proven to fail on :rw). Orchestrator-approved (option a). Applied in an idle window. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
63 lines
2.7 KiB
YAML
63 lines
2.7 KiB
YAML
# act_runner configuration (G7.1).
|
|
#
|
|
# Labels are EXPLICIT and PINNED. `ubuntu-latest` is banned (G7.5): all four
|
|
# windy-registry workflows use it and every single run fails, because a
|
|
# self-hosted runner has no such label unless you invent one. A workflow that
|
|
# names a label nobody provides queues forever and looks like a hung CI system
|
|
# rather than a typo.
|
|
|
|
log:
|
|
level: info
|
|
|
|
runner:
|
|
file: /data/.runner
|
|
capacity: 1 # per runner; parallelism = number of runner services (6). See docker-compose.yml
|
|
timeout: 90m # hard ceiling per job. eternitas's serial pytest is ~50 min; keep
|
|
# timeout-minutes in each workflow — a hang still reads as a hang
|
|
shutdown_timeout: 3m
|
|
insecure: false
|
|
fetch_timeout: 5s
|
|
fetch_interval: 2s
|
|
labels:
|
|
# windy-git's own workflows.
|
|
- "veron-1:docker://catthehacker/ubuntu:act-22.04"
|
|
- "linux-x64:docker://catthehacker/ubuntu:act-22.04"
|
|
# THE FLEET'S EXISTING CONVENTION. Surveyed 2026-08-12 across ten repos:
|
|
# 36 of 36 active workflows say `runs-on: [self-hosted, linux, x64]`.
|
|
# They were written for the self-hosted runners that died when the repos
|
|
# went private, so advertising these three labels makes every one of them
|
|
# runnable AS-IS — no workflow edits, no rewrites.
|
|
#
|
|
# A job asking for [self-hosted, linux, x64] matches only if the runner
|
|
# advertises ALL THREE, so all three are declared separately.
|
|
- "self-hosted:docker://catthehacker/ubuntu:act-22.04"
|
|
- "linux:docker://catthehacker/ubuntu:act-22.04"
|
|
- "x64:docker://catthehacker/ubuntu:act-22.04"
|
|
|
|
cache:
|
|
enabled: true
|
|
dir: /data/cache
|
|
|
|
container:
|
|
# Empty = act creates a NETWORK PER JOB and removes it afterwards.
|
|
#
|
|
# This started as `bridge` for isolation, which was a mistake in both
|
|
# directions. It broke service containers — Postgres came up healthy but the
|
|
# job could not resolve the name `postgres`, because service DNS aliases only
|
|
# exist on a per-job network — and it was *weaker* isolation, since every
|
|
# concurrent job shared one flat bridge and could see its neighbours.
|
|
#
|
|
# A per-job network is both correct and stricter. Still no route to the forge:
|
|
# these networks live inside the dind daemon, which has no forge attachment
|
|
# at all.
|
|
network: ""
|
|
privileged: false
|
|
options:
|
|
workdir_parent: /workspace
|
|
# A job may bind-mount exactly ONE daemon path: the read-only windy-pro build
|
|
# inputs (mounted :ro into dind itself). Per-runner, not per-repo (act_runner
|
|
# limit): any windyadmin repo could mount it; it is non-secret and read-only.
|
|
valid_volumes: ["/ci-inputs/windy-pro"]
|
|
docker_host: "-" # do NOT expose the runner's own docker socket to jobs
|
|
force_pull: false
|