chore(ci): run Check on the dev runner label #433

Merged

Claude-Run merged 1 commit from chore/BUNYIP-444-check-dev-runner-label into main

2026-08-02 02:07:40 +02:00

Claude-Run commented

2026-08-02 01:52:32 +02:00

Member

The fmt + clippy + build + tests job compiles Rust natively on the runner, but requested RUNS_ON_OPENSUSE_BASE_LATEST, whose image ships cargo/rustc and no C toolchain. The workflow papered over that with an "Ensure C toolchain + native deps" step that installed gcc and libopenssl-devel through zypper on every run. Switch the job to RUNS_ON_OPENSUSE_DEV_LATEST and drop the install step: ghcr.io/niceguyit/opensuse-dev:v1.7.0-leap-16.0 already carries gcc-15, libopenssl-devel-3.5.0, /usr/bin/cc, /usr/bin/ld and a working pkg-config --modversion openssl, verified against the image rather than assumed.

Swept every other runs-on in .forgejo/workflows/. build-api, build-web, e2e, e2e-pr and create-release compile nothing on the runner (the image builds happen inside docker buildx; the E2E jobs run node/npm with --ignore-scripts), so they stay on base, each with a comment saying why. An unannotated label is indistinguishable from an unaudited one.

scripts/check-runner-labels.sh enforces the three properties mechanically, wired into the Check workflow and just check: check.yml requests the dev label, no workflow installs a C toolchain or OpenSSL headers at run time, and every runs-on carries a reason comment.

#BUNYIP-444

The `fmt + clippy + build + tests` job compiles Rust natively on the runner, but requested `RUNS_ON_OPENSUSE_BASE_LATEST`, whose image ships cargo/rustc and no C toolchain. The workflow papered over that with an "Ensure C toolchain + native deps" step that installed gcc and libopenssl-devel through zypper on every run. Switch the job to `RUNS_ON_OPENSUSE_DEV_LATEST` and drop the install step: `ghcr.io/niceguyit/opensuse-dev:v1.7.0-leap-16.0` already carries gcc-15, libopenssl-devel-3.5.0, `/usr/bin/cc`, `/usr/bin/ld` and a working `pkg-config --modversion openssl`, verified against the image rather than assumed. Swept every other `runs-on` in `.forgejo/workflows/`. build-api, build-web, e2e, e2e-pr and create-release compile nothing on the runner (the image builds happen inside `docker buildx`; the E2E jobs run node/npm with `--ignore-scripts`), so they stay on base, each with a comment saying why. An unannotated label is indistinguishable from an unaudited one. `scripts/check-runner-labels.sh` enforces the three properties mechanically, wired into the Check workflow and `just check`: check.yml requests the dev label, no workflow installs a C toolchain or OpenSSL headers at run time, and every `runs-on` carries a reason comment. #BUNYIP-444

Claude-Run added 1 commit

2026-08-02 01:52:32 +02:00

chore(ci): run Check on the dev runner label

E2E PR gate / Install + reachability (no deployment secrets) (pull_request) Successful in 23s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 14m58s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

2059435831

The `fmt + clippy + build + tests` job compiles Rust natively on the runner, but requested `RUNS_ON_OPENSUSE_BASE_LATEST`, whose image ships cargo/rustc and no C toolchain. The workflow papered over that with an "Ensure C toolchain + native deps" step that installed gcc and libopenssl-devel through zypper on every run. Switch the job to `RUNS_ON_OPENSUSE_DEV_LATEST` and drop the install step: `ghcr.io/niceguyit/opensuse-dev:v1.7.0-leap-16.0` already carries gcc-15, libopenssl-devel-3.5.0, `/usr/bin/cc`, `/usr/bin/ld` and a working `pkg-config --modversion openssl`, verified against the image rather than assumed.

Swept every other `runs-on` in `.forgejo/workflows/`. build-api, build-web, e2e, e2e-pr and create-release compile nothing on the runner (the image builds happen inside `docker buildx`; the E2E jobs run node/npm with `--ignore-scripts`), so they stay on base, each with a comment saying why. An unannotated label is indistinguishable from an unaudited one.

`scripts/check-runner-labels.sh` enforces the three properties mechanically, wired into the Check workflow and `just check`: check.yml requests the dev label, no workflow installs a C toolchain or OpenSSL headers at run time, and every `runs-on` carries a reason comment.

#BUNYIP-444