ci: add a provisioning script for an x86_64 Android build runner
Gitea runs on an aarch64 host, and Flutter cannot build an Android APK on a Linux arm64 host at all: the SDK ships no arm64-host gen_snapshot (flutter/flutter#189724, #75864, open as of July 2026). So CI for this repo was failing for two independent reasons, and fixing the runner's container network would only have exposed the second. An x86_64 runner is a requirement here, not a preference. Registers at android-stuff org scope rather than repo scope, so any Android repo in the org can use the same runner, and labels it by capability (flutter-android) rather than by hostname, so the workflow does not encode which machine happens to provide it. Host mode rather than a container: the machine already has a proven Flutter, JDK and Android SDK/NDK, so jobs build with the same toolchain that produced the verified release and skip a per-run NDK download. The trade is isolation, which the header states plainly — workflows run as that user on that machine. Refuses to register unless the toolchain it would advertise is actually present, so a missing SDK fails at setup with a list rather than inside every later job. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Executable
+160
@@ -0,0 +1,160 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Register this machine as a Gitea Actions runner for the android-stuff org.
|
||||||
|
#
|
||||||
|
# WHY THIS MACHINE, AND NOT THE GITEA HOST
|
||||||
|
# Gitea runs on pi5-16 (aarch64). Flutter cannot build an Android APK on a
|
||||||
|
# Linux arm64 host at all — the SDK ships no arm64-host gen_snapshot
|
||||||
|
# (flutter/flutter#189724, #75864, open as of July 2026). So an Android build
|
||||||
|
# runner has to be x86_64 regardless of how the Gitea host is configured.
|
||||||
|
#
|
||||||
|
# WHY HOST MODE, AND NOT A CONTAINER
|
||||||
|
# This machine already has a proven Flutter + Android SDK + NDK toolchain. In
|
||||||
|
# host mode the job uses it directly: no SDK download, no ~1GB NDK pull per
|
||||||
|
# run, and CI builds with the exact toolchain that produced the verified
|
||||||
|
# release. The trade is isolation — a workflow in this org runs commands as
|
||||||
|
# this user on this machine. That is the normal self-hosted-runner bargain, but
|
||||||
|
# it is a real one: only grant it for repos whose workflows you trust.
|
||||||
|
#
|
||||||
|
# USAGE
|
||||||
|
# 1. Get an ORG-scoped registration token:
|
||||||
|
# http://pi5-16.local:3005/org/android-stuff/settings/actions/runners
|
||||||
|
# → "Create new runner" → copy the token
|
||||||
|
# Org scope, not repo scope, so every android-stuff repo can use it.
|
||||||
|
# 2. RUNNER_TOKEN=xxxx ./tool/setup_ci_runner.sh
|
||||||
|
#
|
||||||
|
# Re-running is safe: it skips the download if the binary is current and
|
||||||
|
# refuses to clobber an existing registration.
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
VERSION="${RUNNER_VERSION:-3.3.0}"
|
||||||
|
INSTANCE="${GITEA_INSTANCE:-http://pi5-16.local:3005}"
|
||||||
|
RUNNER_NAME="${RUNNER_NAME:-$(hostname)-android}"
|
||||||
|
RUNNER_HOME="${RUNNER_HOME:-$HOME/.local/share/gitea-runner}"
|
||||||
|
BIN="${RUNNER_BIN:-$HOME/.local/bin/gitea-runner}"
|
||||||
|
|
||||||
|
# Capability-based label, deliberately not host-based: it says what the runner
|
||||||
|
# can do, so the workflow does not encode which machine happens to provide it.
|
||||||
|
LABEL="${RUNNER_LABEL:-flutter-android}"
|
||||||
|
|
||||||
|
: "${RUNNER_TOKEN:?set RUNNER_TOKEN to an org registration token (see header)}"
|
||||||
|
|
||||||
|
echo "==> Checking the toolchain this runner promises to provide"
|
||||||
|
missing=0
|
||||||
|
for cmd in flutter dart java cmake ninja node git unzip; do
|
||||||
|
if command -v "$cmd" >/dev/null; then
|
||||||
|
printf ' ok %s\n' "$cmd"
|
||||||
|
else
|
||||||
|
printf ' MISSING %s\n' "$cmd"
|
||||||
|
missing=1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
SDK="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}"
|
||||||
|
if [[ -n "$SDK" && -d "$SDK/ndk" && -d "$SDK/build-tools" ]]; then
|
||||||
|
echo " ok Android SDK at $SDK (ndk: $(ls "$SDK/ndk" | tr '\n' ' '))"
|
||||||
|
else
|
||||||
|
echo " MISSING Android SDK with ndk/ and build-tools/ (ANDROID_HOME=${SDK:-unset})"
|
||||||
|
missing=1
|
||||||
|
fi
|
||||||
|
if [[ $missing -ne 0 ]]; then
|
||||||
|
echo
|
||||||
|
echo "Refusing to register: a runner advertising '$LABEL' must actually" >&2
|
||||||
|
echo "provide these, or every job will fail confusingly instead of here." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "==> Installing gitea-runner $VERSION"
|
||||||
|
mkdir -p "$(dirname "$BIN")" "$RUNNER_HOME"
|
||||||
|
if [[ -x "$BIN" ]] && "$BIN" --version 2>/dev/null | grep -qF "$VERSION"; then
|
||||||
|
echo " already at $VERSION"
|
||||||
|
else
|
||||||
|
url="https://dl.gitea.com/gitea-runner/${VERSION}/gitea-runner-${VERSION}-linux-amd64"
|
||||||
|
echo " downloading $url"
|
||||||
|
curl -fSL --retry 3 -o "$BIN.tmp" "$url"
|
||||||
|
chmod +x "$BIN.tmp"
|
||||||
|
mv "$BIN.tmp" "$BIN"
|
||||||
|
fi
|
||||||
|
"$BIN" --version
|
||||||
|
|
||||||
|
echo "==> Writing config"
|
||||||
|
CONFIG="$RUNNER_HOME/config.yaml"
|
||||||
|
if [[ -f "$CONFIG" ]]; then
|
||||||
|
echo " $CONFIG exists, leaving it alone"
|
||||||
|
else
|
||||||
|
cat > "$CONFIG" <<YAML
|
||||||
|
log:
|
||||||
|
level: info
|
||||||
|
|
||||||
|
runner:
|
||||||
|
file: .runner
|
||||||
|
# One Android build at a time: gradle + a 2-ABI NDK compile will happily
|
||||||
|
# saturate this box, and concurrent runs would just contend.
|
||||||
|
capacity: 1
|
||||||
|
timeout: 45m
|
||||||
|
# ':host' runs the job directly on this machine using the toolchain above,
|
||||||
|
# rather than in a container that would have to fetch its own.
|
||||||
|
labels:
|
||||||
|
- "${LABEL}:host"
|
||||||
|
|
||||||
|
container:
|
||||||
|
# Unused in host mode, kept so switching to container mode later is a
|
||||||
|
# one-line change rather than a rediscovery.
|
||||||
|
network: ""
|
||||||
|
privileged: false
|
||||||
|
|
||||||
|
host:
|
||||||
|
workdir_parent: ${RUNNER_HOME}/workspace
|
||||||
|
YAML
|
||||||
|
echo " wrote $CONFIG"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "==> Registering with $INSTANCE"
|
||||||
|
if [[ -f "$RUNNER_HOME/.runner" ]]; then
|
||||||
|
echo " already registered (found $RUNNER_HOME/.runner) — skipping."
|
||||||
|
echo " To re-register: remove that file and the runner in the Gitea UI first."
|
||||||
|
else
|
||||||
|
(cd "$RUNNER_HOME" && "$BIN" register \
|
||||||
|
--no-interactive \
|
||||||
|
--instance "$INSTANCE" \
|
||||||
|
--token "$RUNNER_TOKEN" \
|
||||||
|
--name "$RUNNER_NAME" \
|
||||||
|
--labels "${LABEL}:host" \
|
||||||
|
--config "$CONFIG")
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat <<EOF
|
||||||
|
|
||||||
|
==> Done. Start it with:
|
||||||
|
|
||||||
|
cd $RUNNER_HOME && $BIN daemon --config $CONFIG
|
||||||
|
|
||||||
|
Or install a user service that survives logout:
|
||||||
|
|
||||||
|
systemctl --user enable --now gitea-runner
|
||||||
|
loginctl enable-linger $USER # so it runs without an active session
|
||||||
|
|
||||||
|
A unit file is written alongside this script's output at:
|
||||||
|
$RUNNER_HOME/gitea-runner.service
|
||||||
|
Copy it to ~/.config/systemd/user/ and 'systemctl --user daemon-reload'.
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > "$RUNNER_HOME/gitea-runner.service" <<UNIT
|
||||||
|
[Unit]
|
||||||
|
Description=Gitea Actions runner (${LABEL}, host mode)
|
||||||
|
After=network-online.target
|
||||||
|
Wants=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
ExecStart=${BIN} daemon --config ${CONFIG}
|
||||||
|
WorkingDirectory=${RUNNER_HOME}
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5
|
||||||
|
# Host mode uses the login environment's toolchain; make the SDK explicit so a
|
||||||
|
# job does not depend on which shell rc happened to be sourced.
|
||||||
|
Environment=ANDROID_HOME=${SDK}
|
||||||
|
Environment=ANDROID_SDK_ROOT=${SDK}
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=default.target
|
||||||
|
UNIT
|
||||||
|
echo " (unit file written)"
|
||||||
Reference in New Issue
Block a user