CI runner on the development Orin: setup script and report

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz
2026-10-13 19:09:33 +09:00
parent cc97f16872
commit a17c0b18f4
2 changed files with 234 additions and 0 deletions
@@ -0,0 +1,49 @@
+---
+type: report
+date: 2026-10-13
+---
+# CI runner: the development Orin builds the Rust services
+
+The development unit (`mikkeli-orin-nano-2`) runs the yukart org's Gitea Actions runner
+for Rust: native builds on the car Orin's L4T userland, so a passing glibc check means
+the binary loads on the car (project-yukart `docs/REPOS.md`, "The runner must build on
+the host"). halogen keeps the org's other runner (crosscheck, the Flutter app).
+
+## What runs
+
+| | |
+|---|---|
+| Registration | `mikkeli-orin-nano-2-yukart`, org-scoped to yukart |
+| Labels | `orin-nano-2` (the machine), `l4t-rust` (what workflows ask for); both `:host` |
+| Service | `gitea-runner-yukart.service`, system service, `User=gitea-runner`, capacity 1 |
+| Binary | `/usr/local/bin/gitea-runner` v3.3.0 linux-arm64, sha256-checked at install |
+| Account | `gitea-runner`, system user, no password, HOME `/var/lib/gitea-runner` (0750), no extra groups |
+| Toolchain | its own rustup (stable, minimal profile, clippy + rustfmt) under that HOME |
+| Config | `/var/lib/gitea-runner/yukart/config.yaml`, registration `.runner` beside it |
+| Build cache | `~gitea-runner/target/<repo>`, kept between runs |
+
+Host mode, because the sysroot is the point; a dedicated account, because in host mode
+the account is the only sandbox a workflow has (not mikkeli: home, keys, sudo).
+
+## Install
+
+```bash
+sudo ./scripts/setup-ci-runner.sh --check                  # pre-flight only
+sudo RUNNER_TOKEN=<org token> ./scripts/setup-ci-runner.sh  # idempotent
+```
+
+The token: `tea api -X POST /orgs/yukart/actions/runners/registration-token`. The
+script needs `node` (JavaScript actions in host mode), `objdump` (check-glibc), `cc`,
+`pkg-config`, and Gitea reachable at `http://pi5-16.local:3005`.
+
+## Workflows that use it
+
+`.gitea/workflows/rust.yml` in svc-core, svc-gw and svc-nav (identical): clone the
+pushed commit with contracts beside it, then clippy with `-D warnings`, tests, a
+release build, and `scripts/check-glibc.sh` on every binary. Plain git, no JavaScript
+actions. It runs on changes to `src/`, `Cargo.*`, the glibc script or itself, not on
+contracts changes.
+
+⚠ **Upgrade both Orins or neither.** This runner proves glibc parity only while its
+L4T/Ubuntu release matches the car's (R36.4.7 here, R36.4.4 on the car, both glibc 2.35
+on 2026-10-13).