Repository navigation
Run CI on jiji and let jiji pin the image - #35
Merged
Merged
Conversation
GitHub-hosted jobs no longer start (Actions billing), so ci-complete and merge move to jiji-ci with the rest of CI. The publish workflow's pin job stays hosted: it holds jiji's deploy key, which shouldn't reach the ci user. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pin job pushed to cbetta/jiji with a write deploy key, and hosted runners are out. jiji's own pin.yml now pins the image from ghcr (the moving tag and the io.betta.jiji.tag label added here), so nothing in this repo holds a key to jiji. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cbetta
changed the title
jiji pins from a 1-minute systemd timer now, not pin.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
App credentials need runner isolation, and timer-driven publishing needs a master-only guard.
2 open issues
What changed in this PR
Moves remaining CI jobs to jiji’s self-hosted runners and delegates image pinning to jiji’s timer.
Changes:
- Moves
ci-completeandmergetojiji-ci. - Removes the deployment-key-based pin job.
- Adds an image tag label for timer-driven pinning.
| File | Description |
|---|---|
.github/workflows/publish.yml |
Replaces direct pinning with image metadata for jiji’s timer. |
.github/workflows/ci.yml |
Moves completion and merge jobs to self-hosted runners. |
Review effort: Balanced
| (startsWith(github.head_ref, 'deps-factory/') || | ||
| github.event.pull_request.user.login == 'dependabot[bot]') | ||
| runs-on: ubuntu-latest | ||
| runs-on: [self-hosted, jiji-ci] |
| exit 1 | ||
| labels: | | ||
| org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} | ||
| io.betta.jiji.tag=${{ steps.meta.outputs.tag }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Everything now runs on jiji-ci, because hosted jobs stopped starting ("recent account payments have failed"), and nothing here can push to cbetta/jiji any more.
ci-completeandmergemove fromubuntu-latestto[self-hosted, jiji-ci].pinjob is gone. Publish labels the image with its tag, and jiji's own pin timer (pin-run.sh, every minute) pins it with a key that never leaves jiji:After merge, the
jiji-deployenvironment, itsJIJI_DEPLOY_KEYand the matching deploy key on cbetta/jiji can go.🤖 Generated with Claude Code