Import the codewhale-cnb-bridge GitHub App credentials from the CNB
KeyStore (codewhale.net/codewhale-ci-secrets, github-bridge.yml) via the
documented imports mechanism, and add an endStages bridge step to the
linux rust gates pipeline that mints an installation token and posts a
non-required 'linux rust gates -cnb' Check Run on the exact GitHub SHA
being built, with the conclusion mapped from CNB_PIPELINE_STATUS.
Per the shadow-parity protocol in the CNB-primary CI design: GitHub
Actions stays canonical and required, no GitHub gate flips, and the
bridge runs in endStages so a bridge outage can never fail the CNB
pipeline itself.
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
Co-authored-by: CodeWhale Bot <bot@codewhale.net>
GitHub's hosted macOS queue routinely takes 50+ minutes and is the slowest
gate on every PR. This adds scripts/ci/setup-mac-runner.sh to register this
machine as a runner, and routes the macOS test leg to it.
The routing is deliberately narrow. This repo is public with ~3.5k forks, and
a self-hosted runner that accepts fork PRs is arbitrary code execution on the
runner host. The macOS leg goes to the self-hosted runner only when all three
hold: the change is heavy, the event is trusted (a push, or a PR whose head
repo is this repo), and the CW_SELF_HOSTED_MAC repo variable is 'true'. Fork
PRs always stay on GitHub-hosted runners.
CW_SELF_HOSTED_MAC is the kill switch. Unset it and every leg falls back to
GitHub-hosted with no commit, which matters because an OFFLINE self-hosted
runner queues jobs forever — worse than a slow one. Until that variable is
set, this commit changes no behavior.
The runner registers --ephemeral (one job per registration, minted fresh each
time). That prevents a job from persisting a registration; it is NOT
filesystem isolation, and the script says so — real isolation needs a VM or a
dedicated user without access to the secret store.
Required contexts are unaffected: 'Test (macos-latest)' derives from job name
plus matrix.os, independent of runs-on.
Verified: actionlint findings identical before and after (12/12), none
referencing the new step or expression; python yaml.safe_load parses.
No-Issue: CI runner capacity
Signed-off-by: CodeWhale Bot <bot@codewhale.net>
