| A runner that builds nothing, and an AppImage anyway 41bcb21 nandi 10h ago | 1 | # The build, on rickub. GitLab CI next door reads source and no more — |
| 2 | # check-common on every push, the flake.lock nightly — and deliberately builds |
| 3 | # nothing. This is the other half: the AppImage, actually realised, on a |
| 4 | # machine that can hold libjoltcosmic's dependency tree. |
| 5 | # |
| 6 | # It does not realise it *here*. rickub runners are Linux x86-64 containers, |
| 7 | # and `nix build .#appimage` on one is the same laptop-shaped death CLAUDE.md |
| 8 | # warns about — so this job is a client. It hands the build to Modal, exactly |
| 9 | # as a person at a terminal would, and the Sandbox on its real VM does the |
| 10 | # work against the nix-cache volume. What a runner contributes is a checkout, |
| 11 | # a python, and somewhere to put the result afterwards. |
| 12 | # |
| 13 | # Lives in .rickub/workflows/ rather than .github/workflows/ because rickub |
| 14 | # reads one or the other and never both: with this directory present, a |
| 15 | # .github/workflows/ added later would be silently ignored. There is none |
| 16 | # today, so nothing is being shadowed — see |
| 17 | # https://rickub.com/docs/actions and https://rickub.com/docs/migrating-from-github |
| 18 | name: build |
| 19 | |
| 20 | on: |
| 21 | push: |
| 22 | workflow_dispatch: |
| 23 | |
| 24 | jobs: |
| 25 | # The same read-only check GitLab runs, for the same reason: common/ compiles |
| 26 | # twice and only the jolt half is on the way to anything anyone runs, so a |
| 27 | # JVM call in shared code breaks the phone at a namespace nobody touched. |
| 28 | # Seconds, no toolchain. Worth having on both hosts rather than depending on |
| 29 | # which one a given push reaches. |
| 30 | check-common: |
| 31 | runs-on: ubuntu-latest |
| 32 | steps: |
| 33 | - uses: actions/checkout@v4 |
| 34 | - run: python3 tools/check-common.py common |
| 35 | |
| 36 | appimage: |
| 37 | runs-on: ubuntu-latest |
| 38 | needs: check-common |
| 39 | # The Modal side is an hour at its worst (a cold libjoltcosmic); this side |
| 40 | # is waiting on it, plus the upload of the tree. |
| 41 | timeout-minutes: 90 |
| 42 | steps: |
| 43 | # The container copies `.` — the whole working tree, uncommitted edits |
| 44 | # included. On a runner that is whatever the checkout left, so it wants |
| 45 | # to be the commit and not a shallow surprise. |
| 46 | - uses: actions/checkout@v4 |
| 47 | |
| 48 | - uses: actions/setup-python@v5 |
| 49 | with: |
| 50 | python-version: "3.12" |
| 51 | |
| 52 | - run: pip install --disable-pip-version-check modal |
| 53 | |
| 54 | # Two secrets, set under Settings -> Secrets and variables. A Modal |
| 55 | # token is the whole of this job's configuration: no nix, no builder, |
| 56 | # no cache of its own. |
| 57 | - name: nix build .#appimage, on Modal |
| 58 | env: |
| 59 | MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }} |
| 60 | MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }} |
| 61 | # Unpiped on purpose. The image build streams to this client and |
| 62 | # nowhere else, and `modal app logs` cannot reach an ephemeral run — |
| 63 | # so this terminal is the only place the build is visible. tee, not |
| 64 | # tail: a run killed mid-pipe through tail takes its output with it. |
| 65 | run: modal run .modal/frq/container.py 2>&1 | tee /tmp/frq-build.log |
| 66 | |
| 67 | # The Sandbox leaves the AppImage in the nix-cache volume rather than |
| 68 | # anywhere a runner can see, so fetch it back out. Same one file the |
| 69 | # build copied there — a squashed closure, not a store path needing an |
| 70 | # import on the other end. |
| 71 | - name: Fetch the AppImage out of the volume |
| 72 | env: |
| 73 | MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }} |
| 74 | MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }} |
| 75 | run: modal volume get --force nix-cache artifacts/frq.AppImage frq.AppImage |
| 76 | |
| 77 | - uses: actions/upload-artifact@v4 |
| 78 | with: |
| 79 | name: frq-AppImage-${{ github.sha }} |
| 80 | path: frq.AppImage |
| 81 | if-no-files-found: error |
| 82 | |
| 83 | # Kept whether or not the build succeeded: a failed run's log is the |
| 84 | # one most worth reading, and it is gone with the runner otherwise. |
| 85 | - uses: actions/upload-artifact@v4 |
| 86 | if: always() |
| 87 | with: |
| 88 | name: build-log |
| 89 | path: /tmp/frq-build.log |
| 90 | if-no-files-found: ignore |