ci: keep every job on internal runners without GitHub Actions storage (#192 )

Runs used GitHub's artifact storage and cache service, which ran out of
the monthly included quota and blocked publishing. Caches and job
handoffs now stay on the self-hosted runner host, the desktop release
hands builds over through its draft release, and Windows waits for a
self-hosted runner instead of a GitHub-hosted one. A test enforces it.


Claude-Session: https://claude.ai/code/session_01R8L4XgqjAemFR2remB5hVY

Co-authored-by: Claude <noreply@anthropic.com>

2026-10-10 07:44:16 +02:00

3.1 KiB

Raw Blame History

CI merge gates

This repository splits continuous integration into product checks that should block merge and infra checks that provide signal without blocking Autopilot merges.

Required for merge (product)

Configure branch protection on main to require exactly one status check from the ci workflow:

Check name	Workflow	What it covers
Product CI	`ci.yml`	Lint, Typecheck, Production builds, Unit tests, Postgres journeys, Web E2E

The aggregate Product CI job fails when any of those product jobs fail. Individual job names remain visible on the pull request for debugging.

Optional but recommended repository settings:

Enable Allow auto-merge
Enable Automatically delete head branches after merge

Infra-only (never required)

These workflows may fail without blocking product delivery. Do not add them to required status checks.

Check / workflow	Why infra
`macOS setup screenshot (infra)` (`desktop-macos-screenshot.yml`)	Native screenshot capture; skips when the runner has no display
Playwright report handoff	Soft-fail (`continue-on-error`); the report stays on the evo runner host for `publish Playwright report`
`publish-server-image.yml` (PR paths)	Docker image validation for infra changes
`mobile Android screenshots`	Manual `workflow_dispatch` only
`nightly verification`	Scheduled visual regression
`manual topology verification`	Manual smoke
`release-desktop.yml`	Tag-driven release pipeline
`publish-playwright-report.yml`	Report publishing helper

Autopilot auto-merge

Workflow: .github/workflows/autopilot-auto-merge.yml (informational — not a required check)

Open a pull request from an Autopilot/cloud agent.
Add label autopilot or automerge.
Wait until Product CI is green on the head commit.
The workflow runs gh pr merge --auto --squash. GitHub merges when branch protection is satisfied (required checks green, reviews if configured).

Dry-run mode

Set repository variable AUTOPILOT_MERGE_DRY_RUN to true to log the merge command without enabling auto-merge.

Optional secret: `AUTOPILOT_MERGE_TOKEN`

Most repositories can rely on the built-in GITHUB_TOKEN (pull-requests: write).

Add a fine-grained PAT or GitHub App installation token as AUTOPILOT_MERGE_TOKEN when auto-merge is rejected because branch protection requires a human actor or bypass permission the default token lacks.

Minimum scopes:

Pull requests: read and write
Contents: read (if merge commits need it under your rules)

After adding the secret, remove AUTOPILOT_MERGE_DRY_RUN or set it to false.

One-time branch protection checklist (maintainer)

Settings → Branches → main → Require status checks before merging.
Search for Product CI and select only that check.
Remove macOS setup screenshot, artifact-only jobs, and other infra workflows from required checks if they were added earlier.
Enable Allow auto-merge if Autopilot should merge without manual clicking.

3.1 KiB Raw Blame History