mirror of
https://github.com/Hmbown/DeepSeek-TUI.git
synced 2026-09-03 06:50:13 +08:00
e42094427e
GitHub's hosted macOS queue routinely takes 50+ minutes and is the slowest gate on every PR. This adds scripts/ci/setup-mac-runner.sh to register this machine as a runner, and routes the macOS test leg to it. The routing is deliberately narrow. This repo is public with ~3.5k forks, and a self-hosted runner that accepts fork PRs is arbitrary code execution on the runner host. The macOS leg goes to the self-hosted runner only when all three hold: the change is heavy, the event is trusted (a push, or a PR whose head repo is this repo), and the CW_SELF_HOSTED_MAC repo variable is 'true'. Fork PRs always stay on GitHub-hosted runners. CW_SELF_HOSTED_MAC is the kill switch. Unset it and every leg falls back to GitHub-hosted with no commit, which matters because an OFFLINE self-hosted runner queues jobs forever — worse than a slow one. Until that variable is set, this commit changes no behavior. The runner registers --ephemeral (one job per registration, minted fresh each time). That prevents a job from persisting a registration; it is NOT filesystem isolation, and the script says so — real isolation needs a VM or a dedicated user without access to the secret store. Required contexts are unaffected: 'Test (macos-latest)' derives from job name plus matrix.os, independent of runs-on. Verified: actionlint findings identical before and after (12/12), none referencing the new step or expression; python yaml.safe_load parses. No-Issue: CI runner capacity Signed-off-by: CodeWhale Bot <bot@codewhale.net>
90 lines
3.5 KiB
Bash
Executable File
90 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Register this Mac as a self-hosted GitHub Actions runner for the macOS legs.
|
|
#
|
|
# WHY: GitHub's hosted macOS queue routinely takes 50+ minutes, which is the
|
|
# single slowest gate on every PR. This machine finishes the same work in a
|
|
# fraction of that.
|
|
#
|
|
# SAFETY — read this before running it.
|
|
#
|
|
# Hmbown/CodeWhale is a PUBLIC repository with thousands of forks. A
|
|
# self-hosted runner that accepts pull requests from forks lets anyone who
|
|
# opens a PR execute arbitrary code on this machine, as this user. That is the
|
|
# one CI configuration GitHub explicitly warns against, and on this machine it
|
|
# would expose ~/.codewhale/secrets.json, the gh token, and the whole CW
|
|
# workspace.
|
|
#
|
|
# The companion change in .github/workflows/ci.yml therefore routes jobs to
|
|
# this runner ONLY for same-repository events (pushes and PRs whose head repo
|
|
# is Hmbown/CodeWhale). Fork PRs keep running on GitHub-hosted runners. Do not
|
|
# remove that guard; without it this script is a remote-code-execution hole.
|
|
#
|
|
# Each job gets a freshly registered --ephemeral runner: the registration is
|
|
# consumed by one job and then discarded, so a job cannot persist a runner
|
|
# registration for later use. Note this is NOT filesystem isolation — an
|
|
# ephemeral runner still runs as this user on this disk. For real isolation,
|
|
# run this inside a throwaway VM (Tart, UTM, or a dedicated macOS user with no
|
|
# access to the secrets above).
|
|
#
|
|
# Usage: scripts/ci/setup-mac-runner.sh [--once]
|
|
# Requires: gh, authenticated with admin rights on the repo.
|
|
|
|
set -euo pipefail
|
|
|
|
REPO="${RUNNER_REPO:-Hmbown/CodeWhale}"
|
|
RUNNER_VERSION="${RUNNER_VERSION:-2.337.0}"
|
|
RUNNER_HOME="${RUNNER_HOME:-$HOME/actions-runner}"
|
|
LABELS="${RUNNER_LABELS:-self-hosted,macOS,ARM64,codewhale-mac}"
|
|
RUNNER_NAME="${RUNNER_NAME:-$(scutil --get LocalHostName 2>/dev/null || hostname -s)-cw}"
|
|
|
|
case "$(uname -m)" in
|
|
arm64) ARCH="osx-arm64" ;;
|
|
x86_64) ARCH="osx-x64" ;;
|
|
*) echo "unsupported arch: $(uname -m)" >&2; exit 1 ;;
|
|
esac
|
|
|
|
command -v gh >/dev/null || { echo "gh is required" >&2; exit 1; }
|
|
gh auth status >/dev/null 2>&1 || { echo "run: gh auth login" >&2; exit 1; }
|
|
|
|
if [ ! -x "$RUNNER_HOME/run.sh" ]; then
|
|
echo "==> installing actions-runner $RUNNER_VERSION ($ARCH) into $RUNNER_HOME"
|
|
mkdir -p "$RUNNER_HOME"
|
|
TARBALL="actions-runner-${ARCH}-${RUNNER_VERSION}.tar.gz"
|
|
curl -fsSL -o "$RUNNER_HOME/$TARBALL" \
|
|
"https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/${TARBALL}"
|
|
tar -xzf "$RUNNER_HOME/$TARBALL" -C "$RUNNER_HOME"
|
|
rm -f "$RUNNER_HOME/$TARBALL"
|
|
fi
|
|
|
|
register_and_run() {
|
|
# Registration tokens are single-use and expire in ~1 hour, so mint a fresh
|
|
# one per job rather than caching it.
|
|
local token
|
|
token="$(gh api -X POST "repos/${REPO}/actions/runners/registration-token" --jq .token)"
|
|
[ -n "$token" ] || { echo "failed to mint a registration token" >&2; return 1; }
|
|
|
|
( cd "$RUNNER_HOME" && ./config.sh \
|
|
--url "https://github.com/${REPO}" \
|
|
--token "$token" \
|
|
--name "$RUNNER_NAME" \
|
|
--labels "$LABELS" \
|
|
--work _work \
|
|
--ephemeral \
|
|
--unattended \
|
|
--replace >/dev/null )
|
|
|
|
# --ephemeral: run.sh exits after exactly one job, leaving no registration.
|
|
( cd "$RUNNER_HOME" && ./run.sh )
|
|
}
|
|
|
|
if [ "${1:-}" = "--once" ]; then
|
|
register_and_run
|
|
exit 0
|
|
fi
|
|
|
|
echo "==> serving jobs for ${REPO} as '${RUNNER_NAME}' [${LABELS}]"
|
|
echo " one ephemeral registration per job; Ctrl-C to stop"
|
|
while true; do
|
|
register_and_run || { echo "runner exited abnormally; retrying in 15s" >&2; sleep 15; }
|
|
done
|