TASK-049: Wire CI (self-hosted macOS, Linux Docker, nightly fuzz, act-verifiable) - #37
Merged
Merged
Conversation
…nightly fuzz Add taskfiles/ci.yml with one-line ci:<target> wrappers (macos-check, macos-release, linux-docker-build, fuzz) around already-existing task/logic (task check, release:ship-macos, docker/linux/Dockerfile's check/artifacts stages, oracle:fuzz), so every CI workflow step is a bare `task ci:<target>` with no inline build logic. .github/workflows/ci.yml runs a macos job ([self-hosted, macOS, ARM64]) and a linux job (ubuntu-latest) on every push to main and every PR; the macOS job's sign+notarize step is gated to push-to-main only, since it needs Apple secrets that a PR context doesn't have. .github/workflows/nightly-fuzz.yml runs task ci:fuzz on a daily cron plus workflow_dispatch. .actrc maps [self-hosted, macOS, ARM64] to native host execution and ubuntu-latest to act's own image, following ~/git/mt/.actrc's per-label convention. No self-hosted runner is registered on this GitHub repo yet and no Apple secrets are configured, but neither blocks this task: act resolves and runs the macOS job locally (task ci:macos-check correctly no-ops on this non-Darwin host, same platforms: [darwin] gating task check already relies on), and actionlint passes on both workflow files. No separate Windows job was added since TASK-046 chose route (a) (mingw cross-compile), not route (b). Full reasoning in decision-032. Bumped .tool-versions' act pin from 0.2.84 to 0.2.89: act's own dry-run output flagged 0.2.84 as vulnerable to CVE-2026-34041/CVE-2026-34042 while verifying AC#2.
…xistence claim The first real CI run on PR #37 revealed two things act's Linux-hosted dry-run couldn't: a live self-hosted macOS ARM64 runner already picks up the macos job immediately (gh api .../actions/runners reporting zero runners was a false negative), and task check's own _guard-env-precedence failed because TASK_X_ENV_PRECEDENCE=1 normally lives in a gitignored .env that doesn't exist on the runner. Set it directly in the job's env: block instead of requiring an out-of-band .env on the runner machine. Corrected decision-032, the task-049 Notes, and docs/build-layout.md to reflect that the runner exists (the Apple signing secrets remain the one genuine gap).
game/addons/gdUnit4/ and the Godot binary/export templates are gitignored, workspace-local state that doesn't persist across checkouts even on a persistent self-hosted runner. A second real PR run hit game:import failing with "godot is not bootstrapped" after the env-precedence guard fix landed; add task game:bootstrap before task ci:macos-check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
taskfiles/ci.ymlwith one-lineci:<target>wrappers around already-existing build/test/release/fuzz logic — no inline build logic in any workflow YAML..github/workflows/ci.yml(macOS self-hosted build+test+sign+notarize, Linux Docker build) and.github/workflows/nightly-fuzz.yml(nightlytask oracle:fuzz)..actrcmapping[self-hosted, macOS, ARM64]to native execution, verified locally withact.decision-032); Lance still needs to register a runner and add the seven Apple secrets before the macOS job does anything for real on GitHub..tool-versions'actpin 0.2.84 -> 0.2.89 (0.2.84 flagged as vulnerable to CVE-2026-34041/CVE-2026-34042 byactitself).Test plan
TASK_X_ENV_PRECEDENCE=1 task checkgreen (119/119 gdUnit4 cases, 0 errors/failures/flaky/skipped)actionlint .github/workflows/*.ymlexits 0act push -j macossucceeds against the committed.actrc(native execution, correctly no-ops the darwin-gated build step on this Linux host)act push -j linux -nandact workflow_dispatch -j fuzz -ndry-run cleanly