---
type: report
date: 2026-10-13
---
# CI runner: the development Orin builds the Rust services

The development unit (`mikkeli-orin-nano-2`) runs the yukart org's Gitea Actions runner
for Rust: native builds on the car Orin's L4T userland, so a passing glibc check means
the binary loads on the car (project-yukart `docs/REPOS.md`, "The runner must build on
the host"). halogen keeps the org's other runner (crosscheck, the Flutter app).

## What runs

| | |
|---|---|
| Registration | `mikkeli-orin-nano-2-yukart`, org-scoped to yukart |
| Labels | `orin-nano-2` (the machine), `l4t-rust` (what workflows ask for); both `:host` |
| Service | `gitea-runner-yukart.service`, system service, `User=gitea-runner`, capacity 1 |
| Binary | `/usr/local/bin/gitea-runner` v3.3.0 linux-arm64, sha256-checked at install |
| Account | `gitea-runner`, system user, no password, HOME `/var/lib/gitea-runner` (0750), no extra groups |
| Toolchain | its own rustup (stable, minimal profile, clippy + rustfmt) under that HOME |
| Config | `/var/lib/gitea-runner/yukart/config.yaml`, registration `.runner` beside it |
| Build cache | `~gitea-runner/target/<repo>`, kept between runs |

Host mode, because the sysroot is the point; a dedicated account, because in host mode
the account is the only sandbox a workflow has (not mikkeli: home, keys, sudo).

## Install

```bash
sudo ./scripts/setup-ci-runner.sh --check                  # pre-flight only
sudo RUNNER_TOKEN=<org token> ./scripts/setup-ci-runner.sh  # idempotent
```

The token: `tea api -X POST /orgs/yukart/actions/runners/registration-token`. The
script needs `node` (JavaScript actions in host mode), `objdump` (check-glibc), `cc`,
`pkg-config`, and Gitea reachable at `http://pi5-16.local:3005`.

## Workflows that use it

`.gitea/workflows/rust.yml` in svc-core, svc-gw and svc-nav (identical): clone the
pushed commit with contracts beside it, then clippy with `-D warnings`, tests, a
release build, and `scripts/check-glibc.sh` on every binary. Plain git, no JavaScript
actions. It runs on changes to `src/`, `Cargo.*`, the glibc script or itself.

contracts' `.gitea/workflows/rust-consumers.yml` covers the other direction: on a change
under `schema/` (what services compile in), it finds every yukart Rust repo whose source
refers to `../contracts/` and runs the same checks on each, at its master, against the
pushed contracts. README, docs and checklists do not trigger it.

⚠ **Upgrade both Orins or neither.** This runner proves glibc parity only while its
L4T/Ubuntu release matches the car's (R36.4.7 here, R36.4.4 on the car, both glibc 2.35
on 2026-10-13).