Catcrafts/Crafter.Review
Watch
2
0
Fork
You've already forked Crafter.Review
 0
Code Issues 7 Pull requests Projects Releases 3 Packages Wiki Activity Actions

ci: the organisation's flatpak runner, a job per trust
Some checks failed
Flatpak / check (push) Has been skipped
Details
Flatpak / publish (push) Failing after 1m12s
Details

Browse source 
The workflow ran on `crafter-flatpak`, Crafter.Build's own runner, which
is registered to that repository alone, so it never ran here. It runs on
the Catcrafts organisation's privileged `flatpak` runner now, split by
trust the way imsd-messages' workflow is: `check` builds a pull request
or a run by hand on another branch cold, with no host volume, because
such a job runs as root in a privileged container; `publish` builds
master and releases it, mounting the crafter-build installation the
publish jobs share (crafter-flatpak-org-system), the published
repository and its signing key. flatpak-builder's state stays in the
workspace, so every run builds cold. AGENTS says so.
This commit is contained in:
Jorijn van der Graaf 2026-11-02 11:19:19 +01:00
commit 443b9ce960
Signed by: jorijnvdgraaf
GPG key ID: 2937E59CDCC1BCFB
2 changed files with 144 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

2
AGENTS.md
View file

@ -240,7 +240,7 @@ Runs and Commands drop every `REVIEW_GATES_*`, `CRAFTER_REVIEW_*`, `SEATS_ENV_FI
`.forgejo/workflows/ci.yaml` is Crafter.Build's workflow for this app.
- **Builds.** A pull request builds the Flatpak, runs the suite inside it and smoke-tests the app as it ships: the version and home, every library resolved and no RUNPATH outside `/app`, the bundled tools, and a freeze and a dry run on a scratch repository.
- **Publishing.** Every push to master is a release (2026-11-02, Jorijn: no rolling `beta` or `latest` builds): CI publishes `stable`, tags the pushed commit with the version of the metainfo's newest `<release>` and creates the release with its notes. A push to master therefore adds a new `<release>`; one whose version is released already fails the job before anything is built or published.
- **The runner.** It runs on the `crafter-flatpak` runner, registered to Crafter.Build alone today: until this repository has such a runner, the workflow does not run, and it is unverified on the forge. Its smoke test passes when run by hand against a local build.
- **The runner.** It runs on the Catcrafts organisation's privileged `flatpak` runner, in two jobs by trust, as imsd-messages' workflow does: `check` (a pull request, a run by hand on another branch) builds cold with no host volume; `publish` (master) mounts the crafter-build installation the publish jobs share (`crafter-flatpak-org-system`), the published repository and its signing key. flatpak-builder's state stays in the workspace, so every run builds cold. The workflow is unverified on the forge until its first run; its smoke test passes when run by hand against a local build.
- **The shared repo.** Both apps publish into one repo. The publish step holds `/srv/flatpak/.publish.lock`, which protects anything only once Crafter.Build's workflow takes the same lock. This one writes its own flatpakref and never the shared `catcrafts.flatpakrepo`.
Pins, moved together: