AkurAI-Build

Latest change 941c1e29871d5e7548906ba3b75ddd925cc9326e - ci: fail closed on PR branches, fix false rollback claims, drop PyYAML by Ólafur Búi Ólafsson

version: 1
# AkurAI-Build runs as one hardened systemd service on Titan that also owns
# pipeline execution (AKURAI_WORKERS=1). A push to hosted Git queues a run
# automatically when the repository carries this file. The protected
# deploy-production job cannot mutate the service it runs inside of
# (ReadOnlyPaths on the service binary, NoNewPrivileges), so deploy/service-deploy.sh stages
# the packaged binary for the root-owned akurai-deploy.path host agent
# (deploy/host/), which checksum-verifies, installs, restarts, health-gates,
# and rolls back automatically on failure. deploy-production runs unattended
# once verify+package pass - no approval or manual promotion step.
#
# Never hardcode a worker username or data root: the runner injects
# AKURAI_BUILD_ROOT, AKURAI_BUILD_HOSTED, AKURAI_BUILD_WORKSPACE, and
# AKURAI_BUILD_HOME into every job. See README "Pipeline build context".
#
# This repository is the one pipeline that must also run on the PREVIOUS build,
# because it is what produces the runner that injects those variables. Hence
# the `$(getent passwd ...)` fallback below: it resolves the invoking user's
# real home with no username baked in, and is simply unused once the injected
# AKURAI_BUILD_HOME is present.
jobs:
  # PENDING INTEGRATION (fail closed, 2026-09-06 rework):
  # A prior revision of this job dropped `branches: [main]` from `verify` so
  # PR/feature refs would run fmt/clippy/test. Independent review (comment 76
  # on t_2578e75e, task t_8488c4cf) correctly rejected that: `executor: native`
  # runs cargo (build scripts, proc macros, tests) as the same trusted service
  # user that has write access to the deploy-staging directory the root-owned
  # akurai-deploy.path agent consumes (see deploy/service-deploy.sh). A
  # `branches` allow-list in this YAML is a scheduling filter, not a sandbox —
  # it cannot enforce "PR code never deploys" because it does not stop PR
  # code from running with deploy-staging write access in the first place.
  # There is no per-ref execution isolation in src/runner.rs today (native
  # jobs are gated only by `repository_trusted` + the controller's
  # `AKURAI_ALLOW_NATIVE` flag, both repository-wide, not per-ref) and no
  # trusted/untrusted ref classification exists yet — that is exactly what
  # primary task t_2578e75e's PR/branch-protection work is building.
  # Failing closed: `verify` keeps `branches: [main]` below, same as
  # `package`/`deploy-production`, until the primary runner integration
  # ships ref-level trust classification or an isolated (non-native, e.g.
  # `docker` with no deploy-staging mount) executor for untrusted refs. Do
  # not remove this restriction again without that isolation landing first.
  - name: verify
    executor: native
    branches: [main]
    cache: [target]
    run:
      - H=${AKURAI_BUILD_HOME:-$(getent passwd "$(id -u)" | cut -d':' -f6)}; RUSTUP_HOME=$H/.rustup CARGO_HOME=$H/.cargo PATH=$H/.cargo/bin:/usr/bin:/bin cargo fmt --all -- --check
      - H=${AKURAI_BUILD_HOME:-$(getent passwd "$(id -u)" | cut -d':' -f6)}; RUSTUP_HOME=$H/.rustup CARGO_HOME=$H/.cargo PATH=$H/.cargo/bin:/usr/bin:/bin cargo clippy --all-targets --all-features -- -D warnings
      - H=${AKURAI_BUILD_HOME:-$(getent passwd "$(id -u)" | cut -d':' -f6)}; RUSTUP_HOME=$H/.rustup CARGO_HOME=$H/.cargo PATH=$H/.cargo/bin:/usr/bin:/bin cargo test
      - python3 -S tests/test_pr_pipeline.py -v

  - name: package
    needs: [verify]
    executor: native
    branches: [main]
    cache: [target]
    run: H=${AKURAI_BUILD_HOME:-$(getent passwd "$(id -u)" | cut -d':' -f6)}; RUSTUP_HOME=$H/.rustup CARGO_HOME=$H/.cargo PATH=$H/.cargo/bin:/usr/bin:/bin cargo build --release
    artifacts:
      - target/release/akurai

  - name: deploy-production
    needs: [package]
    executor: native
    branches: [main]
    environment: production
    run: H=${AKURAI_BUILD_HOME:-$(getent passwd "$(id -u)" | cut -d':' -f6)}; AKURAI_HOST_BIN=$H/.local/bin sh deploy/service-deploy.sh