ci: migrate to ci-runners.md (container.image consumption)

Adopts the FabledRulebook ci-runners.md policy: workflows select toolchains via container.image, not via runs-on labels. `runs-on` stays as the scheduling handle only. Workflows updated: - test-go.yml: ci-go:1.26 on both `test` and `integration` jobs. - test-web.yml: ci-go:1.26 (bundles Node + npm); the actions/setup-node@v4 step is removed. - flutter.yml: ci-flutter:3.44 (Flutter 3.44 + Android + Java 25). - release.yml: ci-go:1.26 (ships docker CLI + buildx). Side effect: this unblocks the Go server deps bump (commit 6a62120) which auto-bumped go.mod to `go 1.25.0` via x/crypto v0.51.0's minimum — ci-go:1.26 satisfies it with headroom. Adds ci-requirements.md at repo root per the ci-runners.md "every project ships a requirements sheet" rule. Documents: runtime images consumed, image deps used per workflow, per-job installs (none), and a Notes section covering the integration docker-socket dependency, the toolchain pin rationale, and the in-app-update channel polling. Tracked in local task #70. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-20 14:24:38 -04:00
parent 6a62120457
commit c1fb2355c4
5 changed files with 61 additions and 15 deletions
@@ -31,10 +31,13 @@ on:

 jobs:
  analyze-test-build:
-    # flutter-ci runner image (CI-Runner/CI-flutter/Dockerfile) bakes in
-    # Flutter SDK + Android cmdline-tools + platform-34 + build-tools 34.0.0
-    # + JDK 17 + a non-root `runner` user. No setup-action ceremony needed.
+    # Toolchain selected via container.image per ci-runners.md
+    # (label = scheduling handle, image = environment). The ci-flutter
+    # image ships Flutter SDK + Android cmdline-tools/platform/build-tools
+    # + Java 25. See ci-requirements.md.
    runs-on: flutter-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-flutter:3.44

    defaults:
      run:
@@ -23,6 +23,8 @@ on:
 jobs:
  release:
    runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26

    env:
      IMAGE: git.fabledsword.com/bvandeusen/minstrel
@@ -44,6 +44,8 @@ on:
 jobs:
  test:
    runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26

    steps:
      - name: Checkout
@@ -65,6 +67,8 @@ jobs:

  integration:
    runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
    services:
      postgres:
        image: postgres:16-alpine
@@ -19,6 +19,8 @@ on:
 jobs:
  test:
    runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26

    defaults:
      run:
@@ -28,18 +30,6 @@ jobs:
      - name: Checkout
        uses: actions/checkout@v4

-      - name: Setup Node
-        # `cache: 'npm'` removed — the Forgejo Actions cache server at
-        # 172.18.0.27:41161 isn't reachable from this runner's container,
-        # so setup-node spent 4m41s burning the npm cache restore on
-        # ETIMEDOUT before failing open. npm ci still works deterministically
-        # from package-lock.json; just re-fetches from the registry on each
-        # run. Restore the cache option once the runner-host network reaches
-        # the cache server.
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
      - name: Install deps
        run: npm ci

@@ -0,0 +1,47 @@
+# CI Requirements — Minstrel
+
+> Copy of [the template](https://git.fabledsword.com/bvandeusen/CI-runner/src/branch/main/docs/requirements-sheet.template.md).
+> Family-wide policy: `ci-runners.md` in the FabledRulebook.
+
+## Runtime images
+
+Minstrel's four workflows consume two CI images:
+
+```
+git.fabledsword.com/bvandeusen/ci-go:1.26
+git.fabledsword.com/bvandeusen/ci-flutter:3.44
+```
+
+- `ci-go:1.26` — Go server tests (`.forgejo/workflows/test-go.yml`), web SPA tests (`.forgejo/workflows/test-web.yml`), and the release container build (`.forgejo/workflows/release.yml`).
+- `ci-flutter:3.44` — Flutter client tests + debug/release APK builds (`.forgejo/workflows/flutter.yml`).
+
+## Image deps used
+
+### From `ci-go:1.26`
+- **Go** (1.26 toolchain) — `go vet`, `go test -race`, `go build`, `go mod`.
+- **Node + npm** — `npm ci` and `npm test` / `npm run check` in `test-web.yml`.
+- **golangci-lint** — lint pass in `test-go.yml`.
+- **docker CLI** — bridge-IP discovery of the per-job Postgres service container in `test-go.yml` integration job (via the runner's shared `/var/run/docker.sock`).
+- **docker buildx** — release container build + push in `release.yml`.
+- **curl** — release-asset polling / upload in `release.yml`.
+
+### From `ci-flutter:3.44`
+- **Flutter** (3.44 stable channel) — `flutter pub get`, `flutter analyze --fatal-infos`, `flutter test`, `flutter build apk` (debug + signed release).
+- **Dart** — `dart run tool/gen_tokens.dart`, `dart run build_runner build` (drift codegen).
+- **Android SDK + NDK + cmdline-tools + build-tools** — APK assembly + signing.
+- **Java 25** — Gradle / Android build.
+- **git** — `actions/checkout@v4` baseline (and any shell git operations).
+- **base64 + curl** — keystore decode + release-asset upload in the tag-build path.
+
+## Per-job tool installs
+
+None.
+
+## Notes
+
+- **Label/image split.** Workflows keep `runs-on: go-ci` / `runs-on: flutter-ci` as the scheduling label per the [`ci-runners.md`](https://…/FabledRulebook/ci-runners.md) "label = scheduling handle, image = `container.image`" pattern. The labels are intentional handles, not toolchain assertions.
+- **Integration-job docker-socket dependency.** `test-go.yml`'s integration job uses the runner's shared docker socket (`/var/run/docker.sock`) to bridge-IP-discover the per-job Postgres service container by name + network intersection — the dev compose's `minstrel-postgres-*` containers are explicitly skipped as belt-and-suspenders. Depends on `act_runner.valid_volumes` whitelisting the socket; if that ever stops auto-mounting, integration tests fail at the `docker inspect` step.
+- **Go toolchain pin.** `go.mod` is on `go 1.25.0` because `golang.org/x/crypto v0.51.0` declares 1.25 as its minimum. `ci-go:1.26` satisfies this with headroom. Future `x/crypto` bumps that move the Go floor should be paired with an image-tag bump in this file + the workflows.
+- **In-app update channel polling.** `release.yml` polls Forgejo's release-asset API for up to 15 min on tag pushes to fetch the APK that `flutter.yml` is concurrently attaching to the same release. The asset eventually appears because `flutter.yml` and `release.yml` run in parallel on the same tag; if the polling times out, the server image ships without the bundled update channel (graceful degradation, not a build failure).
+- **Cache server reachability.** `test-web.yml` does NOT use `cache: 'npm'` on `actions/setup-node` — the Forgejo Actions cache server isn't reachable from this runner's container network and `setup-node` was burning ~4m41s on ETIMEDOUT before failing open. With the migration to `ci-go:1.26`, `setup-node` is removed entirely (Node is in the image). The cache concern reappears if a future change re-introduces a network-dependent action.
+- **Friction asks.** None pending. The two images cover everything Minstrel needs.