mikkeli
654ec96e3b
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz
2.6 KiB
type, date
| type | date |
|---|---|
| report | 2026-10-13 |
CI runner: the development Orin builds the Rust services
The development unit (mikkeli-orin-nano-2) runs the yukart org's Gitea Actions runner
for Rust: native builds on the car Orin's L4T userland, so a passing glibc check means
the binary loads on the car (project-yukart docs/REPOS.md, "The runner must build on
the host"). halogen keeps the org's other runner (crosscheck, the Flutter app).
What runs
| Registration | mikkeli-orin-nano-2-yukart, org-scoped to yukart |
| Labels | orin-nano-2 (the machine), l4t-rust (what workflows ask for); both :host |
| Service | gitea-runner-yukart.service, system service, User=gitea-runner, capacity 1 |
| Binary | /usr/local/bin/gitea-runner v3.3.0 linux-arm64, sha256-checked at install |
| Account | gitea-runner, system user, no password, HOME /var/lib/gitea-runner (0750), no extra groups |
| Toolchain | its own rustup (stable, minimal profile, clippy + rustfmt) under that HOME |
| Config | /var/lib/gitea-runner/yukart/config.yaml, registration .runner beside it |
| Build cache | ~gitea-runner/target/<repo>, kept between runs |
Host mode, because the sysroot is the point; a dedicated account, because in host mode the account is the only sandbox a workflow has (not mikkeli: home, keys, sudo).
Install
sudo ./scripts/setup-ci-runner.sh --check # pre-flight only
sudo RUNNER_TOKEN=<org token> ./scripts/setup-ci-runner.sh # idempotent
The token: tea api -X POST /orgs/yukart/actions/runners/registration-token. The
script needs node (JavaScript actions in host mode), objdump (check-glibc), cc,
pkg-config, and Gitea reachable at http://pi5-16.local:3005.
Workflows that use it
.gitea/workflows/rust.yml in svc-core, svc-gw and svc-nav (identical): clone the
pushed commit with contracts beside it, then clippy with -D warnings, tests, a
release build, and scripts/check-glibc.sh on every binary. Plain git, no JavaScript
actions. It runs on changes to src/, Cargo.*, the glibc script or itself.
contracts' .gitea/workflows/rust-consumers.yml covers the other direction: on a change
under schema/ (what services compile in), it finds every yukart Rust repo whose source
refers to ../contracts/ and runs the same checks on each, at its master, against the
pushed contracts. README, docs and checklists do not trigger it.
⚠ Upgrade both Orins or neither. This runner proves glibc parity only while its L4T/Ubuntu release matches the car's (R36.4.7 here, R36.4.4 on the car, both glibc 2.35 on 2026-10-13).