ci: sync the git.upriser.nl mirror on pushes to master, feat/steamify and release branches (the mirror has no interval of its own)

.github/workflows/git-upriser-sync.yml

@@ -0,0 +1,26 @@
+name: Sync git.upriser.nl mirror
+
+# Trigger the Gitea pull-mirror immediately instead of waiting for its interval,
+# so Gitea builds/tests right after main, a release branch or a tag lands on GitHub (the mirror has no sync interval of its own).
+on:
+  push:
+    branches: [master, feat/steamify, 'release/**']
+    tags: ['*']
+  workflow_dispatch:
+
+jobs:
+  sync:
+    # Gitea also reads .github/workflows on the mirror; only run on GitHub
+    if: github.server_url == 'https://github.com'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger mirror-sync
+        env:
+          GITEA_URL: ${{ secrets.GIT_UPRISER_URL }}
+          GIT_UPRISER_TOKEN: ${{ secrets.GIT_UPRISER_TOKEN }}
+          # Gitea "owner/repo"; defaults to the same path as on GitHub
+          GITEA_REPO: ${{ vars.GITEA_REPO || github.repository }}
+        run: |
+          curl --fail-with-body -sS --retry 5 --retry-delay 10 --retry-all-errors -X POST \
+            -H "Authorization: token ${GIT_UPRISER_TOKEN}" \
+            "${GITEA_URL%/}/api/v1/repos/${GITEA_REPO}/mirror-sync"

.github/workflows/iso-2-gitea-build.yml

@@ -36,14 +36,17 @@ jobs:
     steps:
       # First only what the cache action needs (node, git), then the caches, then the rest from the restored cache.
       - name: Node and git
+        id: node
         run: |
           pacman-key --init && pacman-key --populate
           pacman -Syu --noconfirm --needed nodejs git
+          # The caches' keys: one entry per ISO week (an exact hit saves nothing, a new week restores the old one and saves once).
+          echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
       - name: Cache - pacman packages
         uses: actions/cache@v4
         with:
           path: /var/cache/pacman/pkg
-          key: pacman-build-${{ github.run_id }}
+          key: pacman-build-${{ steps.node.outputs.week }}
           restore-keys: pacman-build-
       - name: Tools
         run: pacman -S --noconfirm --needed archiso mkinitcpio-archiso squashfs-tools grub sudo curl jq
@@ -113,21 +116,24 @@ jobs:
     steps:
       # First only what the cache action needs (node, git), then the caches, then the rest from the restored cache.
       - name: Node and git
+        id: node
         run: |
           pacman-key --init && pacman-key --populate
           pacman -Syu --noconfirm --needed nodejs git
+          # The caches' keys: one entry per ISO week (an exact hit saves nothing, a new week restores the old one and saves once).
+          echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
       - name: Cache - pacman packages
         uses: actions/cache@v4
         with:
           path: /var/cache/pacman/pkg
-          key: pacman-test-${{ github.run_id }}
+          key: pacman-test-${{ steps.node.outputs.week }}
           restore-keys: pacman-test-
       # The guests' packages (VM_CACHE, shared into the VMs): downloaded once for every run.
       - name: Cache - the VMs' packages
         uses: actions/cache@v4
         with:
           path: /root/vms/pkg-cache
-          key: vmpkg-${{ needs.build.outputs.steamify }}-${{ github.run_id }}
+          key: vmpkg-${{ needs.build.outputs.steamify }}-${{ steps.node.outputs.week }}
           restore-keys: |
             vmpkg-${{ needs.build.outputs.steamify }}-
             vmpkg-
@@ -197,21 +203,24 @@ jobs:
     steps:
       # First only what the cache action needs (node, git), then the caches, then the rest from the restored cache.
       - name: Node and git
+        id: node
         run: |
           pacman-key --init && pacman-key --populate
           pacman -Syu --noconfirm --needed nodejs git
+          # The caches' keys: one entry per ISO week (an exact hit saves nothing, a new week restores the old one and saves once).
+          echo "week=$(date -u +%G-%V)" >> "$GITHUB_OUTPUT"
       - name: Cache - pacman packages
         uses: actions/cache@v4
         with:
           path: /var/cache/pacman/pkg
-          key: pacman-test-${{ github.run_id }}
+          key: pacman-test-${{ steps.node.outputs.week }}
           restore-keys: pacman-test-
       # The guests' packages (VM_CACHE, shared into the VMs): downloaded once for every run.
       - name: Cache - the VMs' packages
         uses: actions/cache@v4
         with:
           path: /root/vms/pkg-cache
-          key: vmpkg-${{ needs.build.outputs.steamify }}-${{ github.run_id }}
+          key: vmpkg-${{ needs.build.outputs.steamify }}-${{ steps.node.outputs.week }}
           restore-keys: |
             vmpkg-${{ needs.build.outputs.steamify }}-
             vmpkg-
@@ -239,21 +248,16 @@ jobs:
 
       # The suites run on a plain CachyOS VM (Plasma, no Steamify): the newest CachyOS ISO, installed once;
       # every block then starts from a fresh overlay of that VM.
-      # The CachyOS ISO (~3 GB) is cached per release (the release get-iso.sh would download).
-      - name: CachyOS release
-        id: cachyos
-        run: |
-          rel="$(curl -fsL https://cachyos.org/download/ | grep -oE 'cachyos-desktop-linux-[0-9]+' | head -n 1)"
-          echo "release=${rel:?no CachyOS release found}" >> "$GITHUB_OUTPUT"
-      - name: Cache - the CachyOS ISO
-        uses: actions/cache@v4
+      - uses: christopherhx/gitea-download-artifact@v4
         with:
-          path: |
-            steamify-cachyos-dev/cachyos.iso
-            steamify-cachyos-dev/cachyos.iso.version
-          key: cachyos-iso-${{ steps.cachyos.outputs.release }}
+          name: iso
+          path: iso
 
-      - name: Plain CachyOS VM
+      # The suites test steamify.sh from a plain system, so the base VM is installed from the ISO this run built
+      # with its Steamify step skipped (VM_STEAMIFY=skip): the ISO's installer, kernels, packages and boot loader
+      # are tested, every block then starts from a fresh overlay of that VM. (The boot loader jobs test the
+      # ISO with Steamify installed.)
+      - name: Base VM from the new ISO
         env:
           CI: "1"
           VM_TIMEZONE: UTC
@@ -263,9 +267,9 @@ jobs:
         run: |
           mkdir -p ~/.ssh ~/vms/pkg-cache
           ssh-keygen -q -t ed25519 -N "" -C steamify-vm -f ~/.ssh/steamify-vm_ed25519
+          iso="$(ls "$GITHUB_WORKSPACE"/iso/*.iso | head -n 1)"
           cd steamify-cachyos-dev
-          ./get-iso.sh   # does nothing when the cached ISO is the current release
-          VM_DIR="$HOME/vms/steamify-vm" scripts/vminstall.sh --iso cachyos.iso
+          VM_DIR="$HOME/vms/steamify-vm" scripts/vminstall.sh --iso "$iso"
 
       # Two suites at a time, 4 GB and 2 vCPUs each (vmsuite.sh).
       - name: vmtest.sh (every suite)

AGENTS.md

@@ -121,7 +121,7 @@ Full write-up, with every trap: `steamify-iso-release` in steamify-cachyos-dev.
 - `.github/workflows/iso-2-gitea-build.yml` (Gitea, `on: push: tags: v*`, skipped on GitHub) runs four jobs for that
   tag: build the ISO, test it (steamify-cachyos-dev's `scripts/vmbootloadertest.sh --install`, one job per boot loader,
   parallel up to the runner's capacity; needs `/dev/kvm` on the runner and checks out steamify-cachyos-dev `main` and
-  steamify-cachyos at the ISO's version from the mirror), then, after those, the suites (`scripts/vmtest.sh cli menu hw installer toggles` on a plain CachyOS VM installed from the newest CachyOS ISO, two at a time), and only when all tests passed attach it to the mirror's release. The tag decides everything: Steamify version (`steamify-prepare.sh`
+  steamify-cachyos at the ISO's version from the mirror), then, after those, the suites (`scripts/vmtest.sh cli menu hw installer toggles` on a plain VM installed from the new ISO with `VM_STEAMIFY=skip`, two at a time), and only when all tests passed attach it to the mirror's release. The tag decides everything: Steamify version (`steamify-prepare.sh`
   takes `STEAMIFY_VERSION`), file name (`STEAMIFY_ISO_VERSION` -> `iso_version` in `profiledef.sh`), label
   (`STEAMIFY_BUILD_STAMP`), boot menu and `/etc/steammachine-iso-build`. The build reads no clock; without a
   tag everything says `local`.
@@ -131,5 +131,5 @@ Full write-up, with every trap: `steamify-iso-release` in steamify-cachyos-dev.
   GitHub doesn't have, and the release with them. GitHub releases can't hold the ISO (2 GB per file).
 - Gitea needs `[repository.release] FILE_MAX_SIZE` above the ISO (413 otherwise) and the runner
   `container: privileged: true` (archiso mounts `/proc`); the workflow's `--privileged` option is ignored.
-- Caches (`actions/cache`, the runner's cache server): pacman's package cache per job kind (build, test), the VMs' packages (`VM_CACHE`, `~/vms/pkg-cache`) and the CachyOS ISO for the suites, per release. Each job first installs only node and git, restores the caches, then installs the rest.
+- Caches (`actions/cache`, the runner's cache server): pacman's package cache per job kind (build, test) and the VMs' packages (`VM_CACHE`, `~/vms/pkg-cache`), keys per ISO week. Each job first installs only node and git, restores the caches, then installs the rest.
 - CachyOS's own `Desktop ISO` workflow (`build.yml`) is removed here; the test job of iso-2-gitea-build.yml replaces it.