nordisk/dwarves

pipelines/ci-master.runa.ron

// ci-master.runa.ron — a repository's own CI, `cargo xtask ci --quick`, on every new head of
// `master`. One file for every repository whose default branch is `master`: the dwarves forge
// runs it IN the repository's checkout (a project's `[[pipelines]]` names `repo`, and
// `file_in = "dwarves"` names this checkout as the file's home; crates/dwarves/src/forge_ci.rs).
//
// The step runs in a FRESH container of the forge's runa image (DWARVES_RUNA_IMAGE: the
// ci4 CI image, pinned by digest) as the forge's own user (DWARVES_RUNA_USER=keep-id on a
// keep-id podman service), with the checkouts' parent mounted at its own path: inside it
// `cargo xtask ci` sees /run/.containerenv and runs its toolchain steps right there.
// The repository's verb holds all the logic; the forge only says when and where.
//
// CI runs carry NO release provenance. A release is `dwarves release-build` (builder
// .../slsa/builders/dwarves-server/v1, YubiKey-signed, SLSA L3); a CI build's provenance,
// when one is written, names .../slsa/builders/dwarves-ci/v1 (software key, L2 at most).
Pipeline(
    name: "ci-master",
    triggers: [
        Push(branch: "master"),
        Manual,
    ],
    stages: [
        Stage(
            name: "ci",
            steps: [
                Xtask(cmd: "ci", args: ["--quick"]),
            ],
        ),
    ],
)