Skip to content

ci: migrate 2 of 9 ci jobs to smithy self-hosted runners#32

Open
avrabe wants to merge 1 commit intomainfrom
smithy-migration
Open

ci: migrate 2 of 9 ci jobs to smithy self-hosted runners#32
avrabe wants to merge 1 commit intomainfrom
smithy-migration

Conversation

@avrabe
Copy link
Copy Markdown
Contributor

@avrabe avrabe commented May 3, 2026

Summary

This is a Bazel rules repo bridging Rocq (Coq) and Rust. Per the
smithy migration playbook,
neither Bazel nor Coq/Rocq are installed on the smithy fleet, so the
migrable surface is small: every job that compiles or queries Bazel
targets stays on ubuntu-latest, and the macOS matrix entry stays
on macos-latest (smithy is Linux-only). Following the same
per-job approach as pulseengine/spar#201, pulseengine/rivet#262, and
pulseengine/kiln#247.

Coverage

Class Jobs
light buildifier (ci.yml), docs (docs.yml)
(hosted) 7 others (Bazel/Nix/Rocq/macOS/reusable)

Stays on hosted (each commented in-place)

Job (file) Reason
verify-rules (ci.yml) runs bazel query; Bazel not on smithy
build (ci.yml) needs Nix + Bazel + Rocq toolchain
build-macos (ci.yml) smithy is Linux-only
verify-multiplatform (ci_comprehensive.yml) Bazel + macOS matrix
quick-test (quick_test.yml) runs bazel query
release (release.yml) release step runs bazel build
publish (publish.yml) reusable workflow from bazel-contrib

Workarounds applied

None. The two migrated jobs are clean drop-ins:

  • buildifier: curls a static buildifier-linux-amd64 binary and
    runs --mode=check -r .. No sudo, no apt, no Bazel invocation
    (the setup-bazelisk step is harmless on smithy and is left
    in-place to keep the diff minimal).
  • docs: shell grep checks on README plus
    npm install -g markdown-link-check. Smithy ships Node LTS via
    nvm with a writable global prefix, so the global install needs no
    sudo.

Test plan

  • CI run completes; buildifier and docs jobs land on light smithy runners
  • No EACCES events in smithy's journalctl -u smithy-trace-eacces.service during the run
  • Hosted jobs (verify-rules, build, build-macos, verify-multiplatform, quick-test) continue to pass as before
  • npm install -g markdown-link-check resolves to nvm's prefix (no permission error)

Rollback

Revert this commit. Every job's runs-on: flips back to
ubuntu-latest / macos-latest and the next run uses GitHub-hosted
compute.

Follow-ups (out of scope here)

  • Bazel, Coq/Rocq, and Nix are tracked as open items in the
    smithy playbook's "out of scope" table. When smithy's toolchains
    role grows them, the seven hosted jobs above become candidates
    for migration in a follow-up PR.

  light       buildifier (ci.yml), docs (docs.yml)

Stays on hosted:
  - verify-rules (ci.yml)             needs Bazel (not on smithy)
  - build (ci.yml)                    needs Nix + Bazel + Rocq toolchain
  - build-macos (ci.yml)              smithy is Linux-only
  - verify-multiplatform              Bazel + macOS matrix
    (ci_comprehensive.yml)
  - quick-test (quick_test.yml)       needs Bazel
  - release (release.yml)             runs bazel build
  - publish (publish.yml)             reusable bazel-contrib workflow

This is a Bazel rules repo bridging Rocq (Coq) and Rust. Per the
smithy migration playbook, neither Bazel nor Coq/Rocq are installed
on the smithy fleet, so every job that compiles or queries Bazel
targets stays on ubuntu-latest, and the macOS matrix entry stays on
macos-latest (smithy is Linux-only).

The two migrable jobs are pure Linux non-Bazel checks: buildifier
just curls a static binary and runs it on the tree; docs runs a
README structure check + `npm install -g markdown-link-check` (Node
LTS via nvm is preinstalled on smithy, no sudo needed).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant