From 23912712b80bec3adfde912bbdf52b2cd0de54f0 Mon Sep 17 00:00:00 2001 From: Paul Foley <8870031+Soul-Craft@users.noreply.github.com> Date: Fri, 16 Oct 2026 11:26:31 -0600 Subject: [PATCH 1/2] package-ci and gitleaks: CI_POOL=on pools them over every free runner (label soulcraft-free) The package gate and gitleaks are proven on linux-arm64 (probe runs 38936500441, 38937829563: the base testbed, Chromium 1.62.0, verify.sh and gitleaks match x64 exactly), so with the org variable CI_POOL=on they may run on any runner labelled soulcraft-free, the never-sleeping Oracle Cloud A1 runner (workspace ci/oracle-runner/) included. Unset, nothing changes: label soulcraft-hf. gitleaks downloads the tarball of the runner's architecture, each checked against its own SHA-256. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/gitleaks.yml | 24 ++++++++++++++++-------- .github/workflows/package-ci.yml | 8 +++++--- 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index faa10e6..019d0b6 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -7,9 +7,10 @@ # uses: SoulCraft-Org/.github/.github/workflows/gitleaks.yml@main # # A false positive goes in the repository's .gitleaksignore (one finding fingerprint per line, printed in the log). -# gitleaks is its release tarball, checked against the SHA-256 the release publishes before it runs. Dependabot cannot -# move it: on a new gitleaks release, set VERSION and SHA256 (the linux_x64 line of gitleaks__checksums.txt at -# https://github.com/gitleaks/gitleaks/releases) and the pre-commit rev in each repository's .pre-commit-config.yaml. +# gitleaks is its release tarball for the runner's architecture, checked against the SHA-256 the release publishes before +# it runs. Dependabot cannot move it: on a new gitleaks release, set VERSION, SHA256_X64 and SHA256_ARM64 (the linux_x64 +# and linux_arm64 lines of gitleaks__checksums.txt at https://github.com/gitleaks/gitleaks/releases) and the +# pre-commit rev in each repository's .pre-commit-config.yaml. name: gitleaks on: @@ -24,12 +25,14 @@ permissions: jobs: gitleaks: - # CI_RUNNER: see package-ci.yml (private repositories only; public ones never see it and stay on GitHub's runners) - runs-on: ${{ vars.CI_RUNNER == 'hf' && 'soulcraft-hf' || 'ubuntu-24.04' }} + # CI_RUNNER and CI_POOL: see package-ci.yml (private repositories only; public ones never see them and stay on + # GitHub's runners). Proven on linux-arm64 and x64 alike (gitleaks 8.30.1, both tarballs, 2026-10-16). + runs-on: ${{ vars.CI_RUNNER == 'hf' && (vars.CI_POOL == 'on' && 'soulcraft-free' || 'soulcraft-hf') || 'ubuntu-24.04' }} timeout-minutes: 15 env: VERSION: 8.30.1 - SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb + SHA256_X64: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb + SHA256_ARM64: e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -38,9 +41,14 @@ jobs: - name: gitleaks ${{ env.VERSION }} (checksum verified) run: | + case "$RUNNER_ARCH" in + X64) arch=x64; sum="$SHA256_X64" ;; + ARM64) arch=arm64; sum="$SHA256_ARM64" ;; + *) echo "::error::no gitleaks tarball pinned for $RUNNER_ARCH"; exit 1 ;; + esac curl -fsSL -o "$RUNNER_TEMP/gitleaks.tgz" \ - "https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_x64.tar.gz" - echo "$SHA256 $RUNNER_TEMP/gitleaks.tgz" | sha256sum -c - + "https://github.com/gitleaks/gitleaks/releases/download/v$VERSION/gitleaks_${VERSION}_linux_$arch.tar.gz" + echo "$sum $RUNNER_TEMP/gitleaks.tgz" | sha256sum -c - tar -xzf "$RUNNER_TEMP/gitleaks.tgz" -C "$RUNNER_TEMP" gitleaks - name: no secret anywhere in the history diff --git a/.github/workflows/package-ci.yml b/.github/workflows/package-ci.yml index 7d8fbd0..1254e6a 100644 --- a/.github/workflows/package-ci.yml +++ b/.github/workflows/package-ci.yml @@ -43,9 +43,11 @@ permissions: jobs: verify: # CI_RUNNER (organization variable, private repositories only): "hf" while GitHub-hosted minutes are out; the job then - # runs on SoulCraft-Org's self-hosted runner on a free Hugging Face Space (runner group hf-free, label soulcraft-hf; - # workspace ci/hf-runner/). Unset or "github": GitHub's ubuntu-24.04. - runs-on: ${{ vars.CI_RUNNER == 'hf' && 'soulcraft-hf' || 'ubuntu-24.04' }} + # runs on SoulCraft-Org's self-hosted runners (runner group hf-free). Unset or "github": GitHub's ubuntu-24.04. + # Self-hosted, CI_POOL picks which: "on" = label soulcraft-free, any free runner, the never-sleeping linux-arm64 one on + # Oracle Cloud included (this gate is proven on arm64; workspace ci/oracle-runner/); unset = label soulcraft-hf, the + # Hugging Face Spaces (x64, workspace ci/hf-runner/). + runs-on: ${{ vars.CI_RUNNER == 'hf' && (vars.CI_POOL == 'on' && 'soulcraft-free' || 'soulcraft-hf') || 'ubuntu-24.04' }} timeout-minutes: 90 env: NAME: ${{ github.event.repository.name }} From 125b40d28ef3887e69d82434ca6e7086886231de Mon Sep 17 00:00:00 2001 From: Paul Foley <8870031+Soul-Craft@users.noreply.github.com> Date: Fri, 16 Oct 2026 11:31:09 -0600 Subject: [PATCH 2/2] package-ci: the Oracle runners skip the GitHub uv cache (theirs is on disk) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/package-ci.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/package-ci.yml b/.github/workflows/package-ci.yml index 1254e6a..0923b2d 100644 --- a/.github/workflows/package-ci.yml +++ b/.github/workflows/package-ci.yml @@ -81,10 +81,12 @@ jobs: echo "COMFY_BASE=$GITHUB_WORKSPACE/ComfyUI-Base" >> "$GITHUB_ENV" echo "BASE_WORKSPACE=$GITHUB_WORKSPACE" >> "$GITHUB_ENV" - # base_test reaches pytest through `uv run --no-project --python --with pytest` + # base_test reaches pytest through `uv run --no-project --python --with pytest`. The Oracle runners keep + # their uv cache on disk between jobs (UV_CACHE_DIR, workspace ci/oracle-runner/): the GitHub cache would only + # download it again and upload it whole, so they skip it. - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: - enable-cache: true + enable-cache: ${{ !startsWith(runner.name, 'soulcraft-oracle') }} # The live App-view tier drives the real frontend through _build/appview.py, a uv script that pins its own # playwright; the browser build has to match that pin, so it is installed per pinned version (none: no-op).