mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-30 11:07:33 +00:00
DanConwayDev
01b5419f33
Require 4 GiB for Rust compilation, tests and release-building jobs rather than relying on operator defaults. Production jobs at two vCPUs peaked at 2717.7 MiB for Rust CI and 2393.5 MiB for container build and verification, with no swap or OOM kills. This leaves headroom above observed guest demand. The Rust run restored cached dependency objects; the container job built its release image. Tag-only publication was not exercised. These are selection floors, not caps or guarantees for future code or different parallelism. Keep existing container privileges, steps and secret boundaries unchanged. Validation: both production workflows passed with complete usage summaries; the YAML diff uses the existing resource grammar and passes whitespace checks. Assisted-by: GPT-6
77 lines
2.9 KiB
YAML
77 lines
2.9 KiB
YAML
version: 1
|
|
system: x86_64-linux
|
|
name: release assets
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
jobs:
|
|
archive:
|
|
requirements:
|
|
resources:
|
|
memory-mib: {gte: 4096}
|
|
build: packages.x86_64-linux.release-archive
|
|
artifacts:
|
|
release-archive: release
|
|
container:
|
|
steps:
|
|
- tools: {build: packages.x86_64-linux.ci-container-tools}
|
|
- build
|
|
requirements:
|
|
resources:
|
|
memory-mib: {gte: 4096}
|
|
environment:
|
|
/configuration/guest/job-uid: {eq: 0}
|
|
/configuration/guest/no-new-privileges: {eq: false}
|
|
/configuration/guest/module-autoload: {eq: true}
|
|
/configuration/guest/kernel-features/NAMESPACES: {eq: true}
|
|
/configuration/guest/kernel-features/PID_NS: {eq: true}
|
|
/configuration/guest/kernel-features/NET_NS: {eq: true}
|
|
/configuration/guest/kernel-features/CGROUPS: {eq: true}
|
|
/configuration/guest/kernel-features/MEMCG: {eq: true}
|
|
/configuration/guest/kernel-features/OVERLAY_FS: {eq: true}
|
|
/configuration/guest/kernel-features/BRIDGE: {eq: true}
|
|
/configuration/guest/kernel-features/VETH: {eq: true}
|
|
/configuration/guest/kernel-features/NETFILTER: {eq: true}
|
|
/configuration/guest/kernel-features/NF_NAT: {eq: true}
|
|
/configuration/guest/kernel-features/NF_TABLES: {eq: true}
|
|
/configuration/guest/kernel-features/SECCOMP_FILTER: {eq: true}
|
|
artifacts:
|
|
layout: layout
|
|
provenance: provenance.json
|
|
publish-container:
|
|
steps:
|
|
- tools: {build: packages.x86_64-linux.ci-publisher-tools}
|
|
- publish
|
|
needs: [container]
|
|
secrets: [NGIT_PUBLISHER_NBUNKSEC]
|
|
verify-container:
|
|
steps:
|
|
- tools: {build: packages.x86_64-linux.ci-container-tools}
|
|
- verify
|
|
needs: [publish-container]
|
|
requirements:
|
|
resources:
|
|
memory-mib: {gte: 4096}
|
|
environment:
|
|
/configuration/guest/job-uid: {eq: 0}
|
|
/configuration/guest/no-new-privileges: {eq: false}
|
|
/configuration/guest/module-autoload: {eq: true}
|
|
/configuration/guest/kernel-features/NAMESPACES: {eq: true}
|
|
/configuration/guest/kernel-features/PID_NS: {eq: true}
|
|
/configuration/guest/kernel-features/NET_NS: {eq: true}
|
|
/configuration/guest/kernel-features/CGROUPS: {eq: true}
|
|
/configuration/guest/kernel-features/MEMCG: {eq: true}
|
|
/configuration/guest/kernel-features/OVERLAY_FS: {eq: true}
|
|
/configuration/guest/kernel-features/BRIDGE: {eq: true}
|
|
/configuration/guest/kernel-features/VETH: {eq: true}
|
|
/configuration/guest/kernel-features/NETFILTER: {eq: true}
|
|
/configuration/guest/kernel-features/NF_NAT: {eq: true}
|
|
/configuration/guest/kernel-features/NF_TABLES: {eq: true}
|
|
/configuration/guest/kernel-features/SECCOMP_FILTER: {eq: true}
|
|
publish-release:
|
|
steps:
|
|
- tools: {build: packages.x86_64-linux.ci-publisher-tools}
|
|
- publish
|
|
needs: [archive, verify-container]
|
|
secrets: [NGIT_PUBLISHER_NBUNKSEC]
|