Commit `fc693369d1`

fc693369d1fbecb51675b042d82ae86cba246b62

parent: ab2f101694

Verified · cmc ci/build: failure ci/lint: success

cmc <hello@cleberg.net> · 2026-08-27 04:00 UTC

Move CI from GitHub Actions to gitbay

Three jobs in .gitbay/ci.yml: lint and build on every push, link-check on
its weekly cron. The runner has no containers and a read-only /usr, so the
pinned ruff, orgo and lychee install into $HOME and are version-checked per
run instead of restored from a cache action.

Dropped with no gitbay equivalent: PR-only triggers, the paths filter on the
link-check workflow, permissions, and artifact upload — the lychee reports
go to the build log.

Layout: unified · split

.gitbay/ci.yml added +173

@@ -0,0 +1,173 @@
	1	# CI for cleberg.net.
	2	#
	3	# Every job runs on a plain host under the ci-runner account: no containers,
	4	# no per-job image, and /usr is read-only. Only $HOME (/var/lib/gitbay-runner)
	5	# survives between builds, so each pinned tool is installed there once and
	6	# version-checked on every run. The clone itself is fresh and discarded.
	7	#
	8	# lint and build run on every push. link-check runs on its cron.
	9
	10	jobs:
	11	# Separate from the build so a lint failure and a broken page are distinct
	12	# signals. build.py runs `ruff check --fix` and `ruff format` on development
	13	# builds; these are the verifying forms of the same two commands, reading the
	14	# same ruff.toml, so CI cannot disagree with a local dev build.
	15	lint:
	16	steps:
	17	# Pinned so a new ruff release adds rules on your schedule, not mid-push.
	18	# Changing the version here reinstalls it on the next build.
	19	- \|
	20	set -eu
	21	v=0.16.4
	22	d=$HOME/tools/ruff
	23	if ! "$d/bin/ruff" --version 2>/dev/null \| grep -qx "ruff $v"; then
	24	rm -rf "$d"
	25	python3 -m venv "$d"
	26	"$d/bin/pip" install --quiet --disable-pip-version-check "ruff==$v"
	27	fi
	28	"$d/bin/ruff" --version
	29
	30	- $HOME/tools/ruff/bin/ruff check --no-fix
	31
	32	- $HOME/tools/ruff/bin/ruff format --check --diff
	33
	34	build:
	35	steps:
	36	# rustup is here only to build orgo; nothing else on the runner uses it.
	37	- \|
	38	set -eu
	39	if [ ! -x "$HOME/.cargo/bin/cargo" ]; then
	40	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
	41	\| sh -s -- -y --no-modify-path --profile minimal
	42	fi
	43	"$HOME/.cargo/bin/cargo" --version
	44
	45	# orgo is installed from crates.io and takes minutes to compile, so it is
	46	# rebuilt only when this version changes. Nothing bumps it automatically:
	47	# raise it by hand, which is also how you find out orgo broke the site.
	48	- \|
	49	set -eu
	50	v=0.22.0
	51	if ! "$HOME/.cargo/bin/orgo" --version 2>/dev/null \| grep -qx "orgo $v"; then
	52	"$HOME/.cargo/bin/cargo" install orgo --version "$v" --locked
	53	fi
	54	"$HOME/.cargo/bin/orgo" --version
	55	python3 --version
	56
	57	# build.py deploys with rsync when DEPLOY=true and ENV=prod. This build
	58	# passes neither, but "we did not set the variable" is an assumption, not
	59	# a guarantee. Shadowing rsync with a failing stub turns it into one: if
	60	# the deploy path is ever reached from CI, the step fails loudly instead
	61	# of quietly reaching for a production host.
	62	#
	63	# ENV=prod is deliberate. The development path in build.py runs
	64	# `ruff check --fix` and `ruff format`, which rewrite files in place — CI
	65	# should verify the tree, not edit it. Production is also the build that
	66	# actually ships, including the onion image-URL rewrite. DEPLOY is left
	67	# unset, so main() builds and stops.
	68	- \|
	69	set -eu
	70	mkdir -p .ci-bin
	71	cat > .ci-bin/rsync <<'EOF'
	72	#!/bin/sh
	73	echo "rsync was invoked from CI — the deploy path must never run here" >&2
	74	exit 1
	75	EOF
	76	chmod +x .ci-bin/rsync
	77	PATH="$PWD/.ci-bin:$HOME/.cargo/bin:$PATH" ENV=prod BUILD=true python3 build.py
	78
	79	- \|
	80	set -eu
	81	pages=$(find .build -name '*.html' \| wc -l)
	82	echo "built $pages html pages"
	83	if [ "$pages" -lt 100 ]; then
	84	echo "only $pages pages built; expected the full site" >&2
	85	exit 1
	86	fi
	87
	88	# Weekly rather than per-push: most of these links are external, and the web
	89	# is flaky enough that a per-push run would fail for reasons no author
	90	# controls. A scheduled job does not run on push, so edits here are only
	91	# exercised by the next scheduled run.
	92	link-check:
	93	schedule: "0 7 * * 1"
	94	steps:
	95	- \|
	96	set -eu
	97	if [ ! -x "$HOME/.cargo/bin/cargo" ]; then
	98	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
	99	\| sh -s -- -y --no-modify-path --profile minimal
	100	fi
	101	v=0.22.0
	102	if ! "$HOME/.cargo/bin/orgo" --version 2>/dev/null \| grep -qx "orgo $v"; then
	103	"$HOME/.cargo/bin/cargo" install orgo --version "$v" --locked
	104	fi
	105	"$HOME/.cargo/bin/orgo" --version
	106
	107	# Prebuilt release binary, checksum-verified, kept in $HOME between runs.
	108	- \|
	109	set -eu
	110	v=0.24.2
	111	d=$HOME/tools/lychee
	112	if ! "$d/lychee" --version 2>/dev/null \| grep -qx "lychee $v"; then
	113	rm -rf "$d"
	114	mkdir -p "$d"
	115	t=lychee-x86_64-unknown-linux-gnu.tar.gz
	116	base=https://github.com/lycheeverse/lychee/releases/download/lychee-v$v
	117	curl -sSfL -o "$d/$t" "$base/$t"
	118	curl -sSfL -o "$d/$t.sha256" "$base/$t.sha256"
	119	(cd "$d" && sha256sum -c "$t.sha256")
	120	tar -xzf "$d/$t" -C "$d" --strip-components=1
	121	fi
	122	"$d/lychee" --version
	123
	124	# orgo directly, not build.py. A production build rewrites img.cleberg.net
	125	# URLs to /img/, which is served from a different docroot and would look
	126	# like 198 broken links here. The development output keeps them absolute,
	127	# so the image host gets checked for real.
	128	- $HOME/.cargo/bin/orgo build content -o .build-dev --strict
	129
	130	# Internal links are the half worth gating on: they are entirely within
	131	# this repo, so a failure is always a real defect and always fixable here.
	132	- \|
	133	set -eu
	134	st=0
	135	"$HOME/tools/lychee/lychee" \
	136	--offline \
	137	--root-dir "$PWD/.build-dev" \
	138	--include-verbatim \
	139	--no-progress \
	140	--format markdown \
	141	--output internal.md \
	142	'.build-dev/*/.html' \|\| st=$?
	143	cat internal.md 2>/dev/null \|\| echo "no report"
	144	exit $st
	145
	146	# External links are reported, not gated. A dead third-party link is worth
	147	# knowing about, but it is not a reason to block the site. Swallowing the
	148	# exit status also swallows lychee refusing to start at all, which would
	149	# report success while checking nothing, so assert the report has a
	150	# summary table in it.
	151	- \|
	152	set -eu
	153	st=0
	154	"$HOME/tools/lychee/lychee" \
	155	--root-dir "$PWD/.build-dev" \
	156	--exclude '\.onion' \
	157	--exclude '^https?://(localhost\|127\.0\.0\.1\|0\.0\.0\.0)' \
	158	--exclude '(\{\|%7B\|client_id=$)' \
	159	--max-concurrency 8 \
	160	--max-retries 2 \
	161	--timeout 20 \
	162	--accept 200,206,301,302,303,307,308,401,403,429 \
	163	--include-verbatim \
	164	--no-progress \
	165	--format markdown \
	166	--output external.md \
	167	'.build-dev/*/.html' \|\| st=$?
	168	cat external.md 2>/dev/null \|\| echo "no report"
	169	if ! grep -q "Total" external.md 2>/dev/null; then
	170	echo "lychee produced no summary — it did not run" >&2
	171	exit 1
	172	fi
	173	echo "external check exited $st; not gating"

.github/workflows/build.yml deleted −99

	@@ -1,99 +0,0 @@
1	name: Build
2
3	on:
4	pull_request:
5	push:
6	branches: [main]
7
8	permissions:
9	contents: read
10
11	env:
12	# Pinned so a new ruff release adds rules on your schedule, not mid-PR.
13	RUFF_VERSION: "0.16.4"
14	# orgo is installed from crates.io, so nothing bumps this automatically —
15	# dependabot does not see `cargo install` in a workflow. Raise it by hand when
16	# a new orgo lands, which is also how you find out orgo broke the site.
17	ORGO_VERSION: "0.22.0"
18
19	jobs:
20	# Separate from the build so a lint failure and a broken page are distinct
21	# signals. build.py runs `ruff check --fix` and `ruff format` on development
22	# builds; these are the verifying forms of the same two commands, reading
23	# the same ruff.toml, so CI cannot disagree with a local dev build.
24	lint:
25	runs-on: ubuntu-latest
26	steps:
27	- uses: actions/checkout@v7
28
29	- name: Install ruff
30	run: pipx install "ruff==$RUFF_VERSION"
31
32	- name: Lint
33	run: \|
34	ruff --version
35	ruff check --no-fix
36
37	- name: Format
38	run: ruff format --check --diff
39
40	build:
41	runs-on: ubuntu-latest
42	steps:
43	- uses: actions/checkout@v7
44
45	# Compiling orgo takes minutes; the binary only changes when the pinned
46	# version does, so key the cache on it.
47	- name: Cache orgo
48	id: cache-orgo
49	uses: actions/cache@v6
50	with:
51	path: ~/.cargo/bin/orgo
52	key: orgo-${{ env.ORGO_VERSION }}-${{ runner.os }}
53
54	- name: Install orgo
55	if: steps.cache-orgo.outputs.cache-hit != 'true'
56	run: \|
57	cargo --version
58	cargo install orgo --version "$ORGO_VERSION" --locked
59
60	- name: Show versions
61	run: \|
62	orgo --version
63	python3 --version
64
65	# build.py deploys with rsync when DEPLOY=true and ENV=prod. CI passes
66	# neither, but "we did not set the variable" is an assumption, not a
67	# guarantee. Shadowing rsync with a failing stub turns it into one: if the
68	# deploy path is ever reached from CI, the job fails loudly instead of
69	# quietly reaching for a production host.
70	- name: Block the deploy path
71	run: \|
72	mkdir -p "$RUNNER_TEMP/bin"
73	cat > "$RUNNER_TEMP/bin/rsync" <<'EOF'
74	#!/usr/bin/env bash
75	echo "::error::rsync was invoked from CI — the deploy path must never run here" >&2
76	exit 1
77	EOF
78	chmod +x "$RUNNER_TEMP/bin/rsync"
79	echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
80
81	# ENV=prod is deliberate. The development path in build.py runs
82	# `ruff check --fix` and `ruff format`, which rewrite files in place —
83	# CI should verify the tree, not edit it. Production is also the build
84	# that actually ships, including the onion image-URL rewrite. DEPLOY is
85	# left unset, so main() builds and stops.
86	- name: Build the site
87	env:
88	ENV: prod
89	BUILD: "true"
90	run: python3 build.py
91
92	- name: Check the build produced pages
93	run: \|
94	pages=$(find .build -name '*.html' \| wc -l)
95	echo "built $pages html pages"
96	if [ "$pages" -lt 100 ]; then
97	echo "::error::only $pages pages built; expected the full site"
98	exit 1
99	fi

.github/workflows/link-check.yml deleted −100

	@@ -1,100 +0,0 @@
1	name: Link check
2
3	# Weekly rather than per-PR: most of these links are external, and the web is
4	# flaky enough that a per-PR run would fail for reasons no author controls.
5	# The paths filter still runs it on any PR that edits this workflow, so a change
6	# here is validated by the thing it changes.
7	on:
8	schedule:
9	- cron: "0 7 * * 1"
10	workflow_dispatch:
11	pull_request:
12	paths: [".github/workflows/link-check.yml"]
13
14	permissions:
15	contents: read
16
17	env:
18	ORGO_VERSION: "0.22.0"
19
20	jobs:
21	links:
22	runs-on: ubuntu-latest
23	steps:
24	- uses: actions/checkout@v7
25
26	- name: Cache orgo
27	id: cache-orgo
28	uses: actions/cache@v6
29	with:
30	path: ~/.cargo/bin/orgo
31	key: orgo-${{ env.ORGO_VERSION }}-${{ runner.os }}
32
33	- name: Install orgo
34	if: steps.cache-orgo.outputs.cache-hit != 'true'
35	run: cargo install orgo --version "$ORGO_VERSION" --locked
36
37	# orgo directly, not build.py. A production build rewrites
38	# img.cleberg.net URLs to /img/, which is served from a different docroot
39	# and would look like 198 broken links here. The development output keeps
40	# them absolute, so the image host gets checked for real.
41	- name: Build the site
42	run: orgo build content -o .build-dev --strict
43
44	# Internal links are the half worth gating on: they are entirely within
45	# this repo, so a failure is always a real defect and always fixable here.
46	- name: Internal links
47	uses: lycheeverse/lychee-action@v2.9.0
48	with:
49	args: >-
50	--offline
51	--root-dir ${{ github.workspace }}/.build-dev
52	--include-verbatim
53	'.build-dev/*/.html'
54	fail: true
55	output: internal.md
56
57	# External links are reported, not gated. A dead third-party link is worth
58	# knowing about, but it is not a reason to block the site.
59	- name: External links
60	uses: lycheeverse/lychee-action@v2.9.0
61	with:
62	args: >-
63	--root-dir ${{ github.workspace }}/.build-dev
64	--exclude '\.onion'
65	--exclude '^https?://(localhost\|127\.0\.0\.1\|0\.0\.0\.0)'
66	--exclude '(\{\|%7B\|client_id=$)'
67	--max-concurrency 8
68	--max-retries 2
69	--timeout 20
70	--accept 200,206,301,302,303,307,308,401,403,429
71	--include-verbatim
72	'.build-dev/*/.html'
73	fail: false
74	output: external.md
75
76	# `fail: false` stops a dead third-party link failing the job — but it also
77	# swallows lychee refusing to start at all, which reports success while
78	# checking nothing. Assert the report has a summary table in it.
79	- name: External step actually ran
80	run: \|
81	if ! grep -q "Total" external.md; then
82	echo "::error::lychee produced no summary — it did not run"
83	cat external.md
84	exit 1
85	fi
86
87	- name: Summary
88	if: always()
89	run: \|
90	{ echo "## Internal"; cat internal.md 2>/dev/null \|\| echo "no report";
91	echo; echo "## External"; cat external.md 2>/dev/null \|\| echo "no report";
92	} >> "$GITHUB_STEP_SUMMARY"
93
94	- uses: actions/upload-artifact@v7
95	if: always()
96	with:
97	name: link-reports
98	path: \|
99	internal.md
100	external.md

Commit fc693369d1

Commit `fc693369d1`