dilim/hermes-agent
1
0 Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-11-06 13:26:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: run everything on blacksmith.sh runners

Browse Source
This commit is contained in:
Maciej Lisiewski authored and Teknium committed 2026-10-15 05:23:46 -07:00
1 parent ecac27c0af
commit 91fae5f8cb
56 files changed
+266 -269
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/actionlint.yaml
+4 -5
View File
@@ -3,8 +3,7 @@
# the real findings, unless this file declares it.
self-hosted-runner:
labels:
- ubuntu-latest-96-core
- ubuntu-latest-32-core
- ubuntu-latest-32-arm-core
- windows-latest-32-core
- windows-latest-32-arm-core
- blacksmith-32vcpu-ubuntu-2404
- blacksmith-32vcpu-ubuntu-2404-arm
- blacksmith-32vcpu-windows-2025
- blacksmith-32vcpu-windows-2025-arm
.github/actions/setup-pm/README.md
+1 -1
View File
@@ -6,7 +6,7 @@ and verifies the exact native artifacts from `pm/lock.json`. The action does
not resolve a version range, install another setup action, or modify the lock.
```yaml
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- uses: ./.github/actions/setup-pm
with:
toolchain: all
.github/workflows/archive-inputs.yml
+2 -2
View File
@@ -24,7 +24,7 @@ jobs:
archive-inputs:
name: Preserve every pinned HTTP input
if: github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
timeout-minutes: 60
env:
@@ -33,7 +33,7 @@ jobs:
CLOUDFLARE_R2_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.sha || github.sha }}
persist-credentials: false
.github/workflows/blob-size-check.yml
+2 -2
View File
@@ -26,10 +26,10 @@ permissions:
jobs:
check-blob-size:
name: Reject large binaries
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 2 # the merge commit and its first parent (the base branch tip)
.github/workflows/bootstrap-installer-build.yml
+4 -4
View File
@@ -41,11 +41,11 @@ env:
jobs:
windows-x64:
name: Hermes-Setup.exe (windows x64, signed)
runs-on: windows-latest
runs-on: blacksmith-2vcpu-windows-2025
environment: release-signing
timeout-minutes: 90
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.ref }}
fetch-depth: 0
@@ -151,11 +151,11 @@ jobs:
macos-arm64:
name: Hermes-Setup.dmg (macos arm64, signed + notarized)
runs-on: macos-latest
runs-on: blacksmith-12vcpu-macos-latest
environment: release-signing
timeout-minutes: 90
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.ref }}
fetch-depth: 0
.github/workflows/bootstrap-installer.yml
+4 -5
View File
@@ -26,13 +26,13 @@ concurrency:
jobs:
posix:
name: install.sh protocol + small fresh-install E2E
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
# NOTE: `runner.temp` is only available in step-level env, not job-level
# env — a job-env `${{ runner.temp }}` makes GitHub reject the workflow
# graph at dispatch (0 jobs). Each step that needs these exports them.
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
# The mirror step pushes HEAD to a fresh bare repo — a shallow
@@ -134,13 +134,12 @@ jobs:
windows:
name: install.ps1 protocol surface
runs-on: windows-latest
runs-on: blacksmith-2vcpu-windows-2025
timeout-minutes: 10
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
# Windows PowerShell 5.1 is what ships with Windows and what `irm | iex`
# lands in for most users — the protocol surface must parse there.
- name: Protocol version + stage manifest (Windows PowerShell 5.1)
.github/workflows/canary-release.yml
+4 -4
View File
@@ -27,11 +27,11 @@ concurrency:
jobs:
tag:
name: Tag, draft, and start the canary build
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
# A dispatch from a feature branch would tag unmerged code as the canary.
if: github.ref_name == github.event.repository.default_branch
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# The changelog walks commits since the previous canary tag
fetch-depth: 0
@@ -48,7 +48,7 @@ jobs:
prune:
name: Prune canaries older than 14 days
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
needs: tag
environment: release-signing
# Prune even when this run had nothing new to tag. The desktop build
@@ -64,7 +64,7 @@ jobs:
CLOUDFLARE_R2_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
fetch-depth: 0
fetch-tags: true
.github/workflows/case-collision-check.yml
+2 -3
View File
@@ -29,12 +29,11 @@ permissions:
jobs:
check-case-collisions:
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
- name: Run case-collision checker
run: python3 scripts/check-case-collisions.py
.github/workflows/ci-review-comment.yml
+2 -2
View File
@@ -46,11 +46,11 @@ jobs:
if: >-
github.event.workflow_run.event == 'pull_request' &&
github.event.workflow_run.head_repository.full_name == github.repository
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 60
steps:
- name: Checkout trusted default branch
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ github.event.repository.default_branch }}
persist-credentials: false
.github/workflows/ci.yaml
+6 -6
View File
@@ -70,7 +70,7 @@ jobs:
# ─────────────────────────────────────────────────────────────────────
detect:
name: Detect affected areas
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 3
outputs:
python: ${{ steps.gate-lanes.outputs.python }}
@@ -92,7 +92,7 @@ jobs:
e2e_desktop_update: ${{ steps.gate-lanes.outputs.e2e_desktop_update }}
event_name: ${{ github.event_name }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
sparse-checkout: |
@@ -449,12 +449,12 @@ jobs:
# to block a merge. A separate run also stops it from holding this
# run open. That is what blocked ``gh run rerun``.
if: always()
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
outputs:
needs-json: ${{ steps.evaluate.outputs.needs-json }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit || github.sha }}
- name: Evaluate job results
@@ -484,11 +484,11 @@ jobs:
name: CI timing report
needs: [all-checks-pass]
if: always()
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/contributor-check.yml
+2 -2
View File
@@ -17,12 +17,12 @@ permissions:
jobs:
check-attribution:
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
outputs:
review_status: ${{ steps.check-emails.outputs.review_status }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 0 # Full history needed for git log
.github/workflows/deploy-site.yml
+3 -3
View File
@@ -43,7 +43,7 @@ jobs:
# a skills-index PR that doesn't touch website/** paths and so
# doesn't auto-deploy via the deploy-docs path.
if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 30
steps:
- name: Trigger Vercel Deploy
@@ -51,13 +51,13 @@ jobs:
deploy-docs:
if: github.repository == 'NousResearch/hermes-agent'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 30
environment:
name: github-pages
url: ${{ steps.deploy.outputs.page_url }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
fetch-depth: 0 # extract-plugins.py derives each catalog entry's added/updated dates from git log
.github/workflows/desktop-bundle-smoke.yml
+3 -3
View File
@@ -64,7 +64,7 @@ permissions:
jobs:
validate:
name: Require a supported native smoke target
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
env:
TARGET: ${{ inputs.platform }}/${{ inputs.arch }}/${{ inputs.format }}
@@ -103,7 +103,7 @@ jobs:
shell: bash
run: printf 'SMOKE_ROOT=%s/bundle-smoke\n' "$RUNNER_TEMP" >> "$GITHUB_ENV"
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# A dispatch tests the artifact of `sha` with the dispatched ref's scripts.
ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || inputs.channel-build != '' && inputs.controller-sha || inputs.sha }}
@@ -245,7 +245,7 @@ jobs:
name: Windows install and chat
needs: validate
if: inputs.platform == 'win32'
runs-on: ${{ inputs.arch == 'arm64' && 'windows-latest-32-arm-core' || 'windows-latest-32-core' }}
runs-on: ${{ inputs.arch == 'arm64' && 'windows-latest-32-arm-core' || 'blacksmith-32vcpu-windows-2025' }}
# windows-11-arm runners are much slower (npm ci alone runs 12+ minutes and
# the MSIX leg exceeds 30 total); x64 legs complete in ~14.
timeout-minutes: 45
.github/workflows/desktop-bundled-release.yml
+42 -42
View File
@@ -221,7 +221,7 @@ jobs:
# One dispatch: in disposable mode the allocation steps run first (the
# channel pin comes from them), then admission validates the build source.
# A failed allocation fails this job and skips everything downstream.
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
# Public root is an environment variable, not a repository variable. No
# secret is injected into admission; downstream jobs consume its outputs.
environment: release-signing
@@ -261,7 +261,7 @@ jobs:
channel-request-sha256: ${{ ((inputs.disposable_channel != '' || inputs.channel != '') && steps.allocate.outputs.channel_request_sha256) || '' }}
disposable-run: ${{ (inputs.disposable_channel != '' && github.run_id) || inputs.disposable_run || '' }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ (inputs.build_commit != '' || inputs.channel != '' || inputs.release-phase != '') && github.sha || inputs.tag }}
# Full checkout, always. Commit admission (require_pushed) needs the
@@ -469,7 +469,7 @@ jobs:
matrix:
target:
- label: win32-x64
runner: windows-latest-32-core
runner: blacksmith-32vcpu-windows-2025
env: &win32-env
CHANNEL_BUILD: ${{ needs.validate.outputs.channel-build }}
HERMES_DESKTOP_VARIANT: bundled
@@ -510,7 +510,7 @@ jobs:
# Check out the SHA the validate job admitted — never the tag ref,
# which a force-push can move between jobs. This is the privileged
# (release-signing) build; it must run the reviewed bytes.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
fetch-depth: ${{ (inputs.build_commit != '' || needs.validate.outputs.channel-build != '') && 1 || 0 }}
@@ -518,7 +518,7 @@ jobs:
- name: Check out trusted channel controller
if: needs.validate.outputs.channel-build != ''
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
path: .build/channel-controller
@@ -822,7 +822,7 @@ jobs:
# The trust-branch legs are read through needs.*.result below, so they must
# stay in the list — the result job gates on their outcomes, not its own.
needs: [validate, build-win32-x64-release, build-win32-x64-commit]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
permissions: {}
timeout-minutes: 5
env:
@@ -849,7 +849,7 @@ jobs:
# The trust-branch legs are read through needs.*.result below, so they must
# stay in the list — the result job gates on their outcomes, not its own.
needs: [validate, build-win32-arm64-release, build-win32-arm64-commit]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
permissions: {}
timeout-minutes: 5
env:
@@ -909,7 +909,7 @@ jobs:
# Check out the SHA the validate job admitted — never the tag ref,
# which a force-push can move between jobs. This is the privileged
# (release-signing) build; it must run the reviewed bytes.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
# Channel/commit builds derive versions from the request/env, not
@@ -919,7 +919,7 @@ jobs:
- name: Check out trusted channel controller
if: needs.validate.outputs.channel-build != ''
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
path: .build/channel-controller
@@ -1238,7 +1238,7 @@ jobs:
# The trust-branch legs are read through needs.*.result below, so they must
# stay in the list — the result job gates on their outcomes, not its own.
needs: [validate, build-darwin-arm64-release, build-darwin-arm64-commit]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
permissions: {}
timeout-minutes: 5
env:
@@ -1258,7 +1258,7 @@ jobs:
# The trust-branch legs are read through needs.*.result below, so they must
# stay in the list — the result job gates on their outcomes, not its own.
needs: [validate, build-darwin-x64-release, build-darwin-x64-commit]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
permissions: {}
timeout-minutes: 5
env:
@@ -1272,7 +1272,7 @@ jobs:
name: bundled linux-x64 (disabled for now)
if: needs.validate.outputs.linux-x64 == 'true'
needs: validate
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- name: Disabled
@@ -1283,7 +1283,7 @@ jobs:
name: bundled linux-arm64 (disabled for now)
if: needs.validate.outputs.linux-arm64 == 'true'
needs: validate
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- name: Disabled
@@ -1301,7 +1301,7 @@ jobs:
&& needs.validate.result == 'success' && needs.validate.outputs.sha != ''
&& needs.validate.outputs.darwin-arm64 == 'true'
&& needs.build-darwin-arm64.result == 'success'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
timeout-minutes: 15
outputs:
@@ -1315,7 +1315,7 @@ jobs:
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
CLOUDFLARE_R2_PUBLIC_URL: ${{ needs.validate.outputs.public-root }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
# Claim custody is re-checked in place: full history and the tags.
@@ -1335,7 +1335,7 @@ jobs:
&& needs.validate.result == 'success' && needs.validate.outputs.sha != ''
&& needs.validate.outputs.darwin-x64 == 'true'
&& needs.build-darwin-x64.result == 'success'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
timeout-minutes: 15
outputs:
@@ -1349,7 +1349,7 @@ jobs:
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
CLOUDFLARE_R2_PUBLIC_URL: ${{ needs.validate.outputs.public-root }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
# Claim custody is re-checked in place: full history and the tags.
@@ -1509,7 +1509,7 @@ jobs:
&& (needs.validate.outputs.win32-arm64 != 'true' || needs.build-win32-arm64.result == 'success')
&& (inputs.release-phase == '' || inputs.release-phase == 'candidate')
&& (inputs.upload_release == true || inputs.release-phase == 'candidate' || inputs.build_commit != '' || inputs.channel != '')
runs-on: windows-latest-32-core
runs-on: blacksmith-32vcpu-windows-2025
environment: release-signing
cache-mode: read
timeout-minutes: 45
@@ -1537,7 +1537,7 @@ jobs:
steps:
# Full checkout: stage-msixbundle.mjs imports ./msix-shared.mjs and the
# job runs it with no checkout at all today — ERR_MODULE_NOT_FOUND.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# Channel assembly/publishing code stays at the trusted controller.
ref: ${{ needs.validate.outputs.channel-build != '' && github.sha || needs.validate.outputs.sha }}
@@ -1718,7 +1718,7 @@ jobs:
&& needs.assemble-win32-bundle.result == 'success'
&& needs.smoke-darwin-arm64.result == 'success' && needs.smoke-darwin-x64.result == 'success'
&& needs.smoke-win32-arm64.result == 'success' && needs.smoke-win32-x64.result == 'success'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
cache-mode: read
timeout-minutes: 45
@@ -1737,7 +1737,7 @@ jobs:
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
CLOUDFLARE_R2_PUBLIC_URL: ${{ needs.validate.outputs.public-root }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
# require_pushed proves commit-build ancestry from local history;
@@ -1767,7 +1767,7 @@ jobs:
&& needs.validate.result == 'success' && needs.validate.outputs.sha != ''
&& needs.assemble-win32-bundle.result == 'success'
&& needs.smoke-win32-arm64.result == 'success' && needs.smoke-win32-x64.result == 'success'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
timeout-minutes: 15
concurrency:
@@ -1783,7 +1783,7 @@ jobs:
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
CLOUDFLARE_R2_PUBLIC_URL: ${{ vars.CLOUDFLARE_R2_PUBLIC_URL }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
- uses: ./.github/actions/setup-pm
@@ -1847,7 +1847,7 @@ jobs:
&& needs.validate.result == 'success' && needs.validate.outputs.sha != ''
&& needs.build-darwin-arm64.result == 'success' && needs.build-darwin-x64.result == 'success'
&& needs.smoke-darwin-arm64.result == 'success' && needs.smoke-darwin-x64.result == 'success'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
timeout-minutes: 15
concurrency:
@@ -1861,7 +1861,7 @@ jobs:
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
CLOUDFLARE_R2_PUBLIC_URL: ${{ vars.CLOUDFLARE_R2_PUBLIC_URL }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# Privileged job: pin to the SHA validate admitted, not the tag.
ref: ${{ needs.validate.outputs.sha }}
@@ -1909,7 +1909,7 @@ jobs:
name: Build + publish the termux .deb (aarch64)
needs: [validate]
if: inputs.channel == '' && inputs.disposable_channel == '' && needs.validate.outputs.termux == 'true' && (inputs.upload_release == true || inputs.release-phase == 'candidate' || inputs.build_commit != '')
runs-on: ubuntu-24.04-arm
runs-on: blacksmith-2vcpu-ubuntu-2404-arm
environment: release-signing
timeout-minutes: 90
env:
@@ -1929,7 +1929,7 @@ jobs:
CLOUDFLARE_R2_PUBLIC_URL: ${{ vars.CLOUDFLARE_R2_PUBLIC_URL }}
steps:
# Use the admitted commit, not a tag that can move after validation.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
# Commit builds only rev-parse HEAD; tag builds verify ancestry.
@@ -2280,9 +2280,9 @@ jobs:
needs: validate
# Pairs with builds-table: a pending page nothing finalizes must not be written.
if: inputs.build_commit == '' && inputs.upload_release == true && needs.validate.outputs.all-jobs == 'true'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
- name: Render the placeholder
@@ -2325,10 +2325,10 @@ jobs:
always() && inputs.build_commit == '' && inputs.channel == '' && inputs.upload_release == true && inputs.release-phase == ''
&& needs.validate.result == 'success' && needs.validate.outputs.sha != ''
&& needs.validate.outputs.all-jobs == 'true'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# Privileged job: pin to the SHA validate admitted. A bare checkout
# here would land on the dispatch branch, not the release bytes.
@@ -2383,13 +2383,13 @@ jobs:
always() && inputs.build_commit != '' && inputs.channel == '' && inputs.disposable_channel == ''
&& needs.validate.result == 'success' && needs.validate.outputs.sha != ''
&& needs.validate.outputs.all-jobs == 'true'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
permissions:
contents: write
actions: read
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# Runs from the admitted commit so the renderer matches the built bytes.
ref: ${{ needs.validate.outputs.sha }}
@@ -2422,7 +2422,7 @@ jobs:
--summary-out "$GITHUB_STEP_SUMMARY" \
--summary-failed-legs "$failed" --run-url "$RUN_URL"
- name: Return to the trusted receipt controller
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
fetch-depth: 0
@@ -2443,7 +2443,7 @@ jobs:
name: Verify published candidate files
needs: validate
if: inputs.release-phase == 'publish'
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
environment: release-signing
timeout-minutes: 90
env:
@@ -2457,7 +2457,7 @@ jobs:
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
CLOUDFLARE_R2_PUBLIC_URL: ${{ vars.CLOUDFLARE_R2_PUBLIC_URL }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
- uses: ./.github/actions/setup-pm
@@ -2472,7 +2472,7 @@ jobs:
# The Store is not a release gate: a failed submission leaves the release publishable
# and the summary names the Store package for a manual Partner Center upload.
continue-on-error: true
runs-on: windows-latest-32-core
runs-on: blacksmith-32vcpu-windows-2025
environment: release-signing
timeout-minutes: 60
env:
@@ -2487,7 +2487,7 @@ jobs:
MS_STORE_CLIENT_SECRET: ${{ secrets.MS_STORE_CLIENT_SECRET }}
MS_STORE_PRODUCT_ID: ${{ vars.MS_STORE_PRODUCT_ID }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
- uses: ./.github/actions/setup-pm
@@ -2538,9 +2538,9 @@ jobs:
stable-publish,
stable-store
]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
- name: Require every phase job
@@ -2602,10 +2602,10 @@ jobs:
&& needs.smoke-win32-arm64.result == 'success' && needs.smoke-win32-x64.result == 'success'
&& needs.publish-win32-updater.result == 'success'
&& needs.publish-darwin-updater.result == 'success'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.validate.outputs.sha }}
fetch-depth: 0
.github/workflows/docker-lint.yml
+2 -2
View File
@@ -28,11 +28,11 @@ concurrency:
jobs:
lint-docker-and-shell:
name: Lint Dockerfile (hadolint)
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/docker.yml
+27 -27
View File
@@ -71,7 +71,7 @@ jobs:
# the parent stable-release workflow, which passes the candidate commit.
mode:
name: Resolve release phase
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
phase: ${{ steps.resolve.outputs.phase }}
@@ -100,12 +100,12 @@ jobs:
name: Detect affected areas
needs: [mode]
if: needs.mode.outputs.release != 'true'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
outputs:
build: ${{ steps.gate.outputs.build }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
@@ -157,19 +157,19 @@ jobs:
variant: [slim, desktop]
include:
- arch: amd64
runner: ubuntu-latest-32-core
runner: blacksmith-32vcpu-ubuntu-2404
platform: linux/amd64
# arm64 builds on the native arm64 larger runner. A build of
# linux/arm64 on an x64 host uses emulation.
- arch: arm64
runner: ubuntu-latest-32-arm-core
runner: blacksmith-32vcpu-ubuntu-2404-arm
platform: linux/arm64
runs-on: ${{ matrix.runner }}
timeout-minutes: 45
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
# Stable dispatches from the default branch and names the claim commit.
# Pin it, never a mutable branch ref.
@@ -213,16 +213,16 @@ jobs:
- name: Set up Docker Buildx
id: buildx
continue-on-error: true
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Set up Docker Buildx (retry)
if: steps.buildx.outcome == 'failure'
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
# Build once, load into the local daemon for testing. Cached
# per-arch; the push step below reuses every layer from this build.
- name: Build image (${{ matrix.variant }}/${{ matrix.arch }})
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
uses: useblacksmith/build-push-action@v2
with:
context: .
file: Dockerfile
@@ -348,17 +348,17 @@ jobs:
variant: [slim, desktop]
include:
- arch: amd64
runner: ubuntu-latest-32-core
runner: blacksmith-32vcpu-ubuntu-2404
platform: linux/amd64
# Native arm64 for the same reason as the build matrix above.
- arch: arm64
runner: ubuntu-latest-32-arm-core
runner: blacksmith-32vcpu-ubuntu-2404-arm
platform: linux/arm64
runs-on: ${{ matrix.runner }}
timeout-minutes: 30
steps:
- name: Checkout trusted source
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 0
@@ -388,11 +388,11 @@ jobs:
- name: Set up Docker Buildx
id: buildx
continue-on-error: true
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Set up Docker Buildx (retry)
if: steps.buildx.outcome == 'failure'
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -404,7 +404,7 @@ jobs:
# manifest list after both architecture publishers complete.
- name: Push ${{ matrix.variant }}/${{ matrix.arch }} by digest
id: push
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
uses: useblacksmith/build-push-action@v2
with:
context: .
file: Dockerfile
@@ -443,7 +443,7 @@ jobs:
# `needs` is the whole 4-leg matrix: only publish both :main variants
# after every arch and variant publisher succeeds.
if: ${{ !cancelled() && needs.mode.outputs.release != 'true' && github.repository == 'NousResearch/hermes-agent' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
needs: [mode, publish]
timeout-minutes: 10
environment: container-publish
@@ -470,11 +470,11 @@ jobs:
- name: Set up Docker Buildx
id: buildx
continue-on-error: true
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Set up Docker Buildx (retry)
if: steps.buildx.outcome == 'failure'
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -537,7 +537,7 @@ jobs:
matrix:
arch: [amd64, arm64]
variant: [slim, desktop]
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 45
env:
ARCH: ${{ matrix.arch }}
@@ -546,7 +546,7 @@ jobs:
SUFFIX: ${{ matrix.variant == 'desktop' && '-desktop' || '' }}
steps:
- name: Checkout release code (helper scripts only, no build)
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit || github.sha }}
@@ -566,11 +566,11 @@ jobs:
- name: Set up Docker Buildx
id: buildx
continue-on-error: true
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Set up Docker Buildx (retry)
if: steps.buildx.outcome == 'failure'
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Load tested image
run: |
@@ -628,7 +628,7 @@ jobs:
name: Assemble versioned manifest and digest receipt
if: needs.mode.outputs.phase == 'publish'
needs: [mode, release-publish]
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
outputs:
digest: ${{ steps.list.outputs.digest }}
timeout-minutes: 15
@@ -637,7 +637,7 @@ jobs:
RELEASE_TAG: ${{ inputs.tag }}
steps:
- name: Checkout release code (helper scripts only)
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit || github.sha }}
@@ -650,11 +650,11 @@ jobs:
- name: Set up Docker Buildx
id: buildx
continue-on-error: true
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Set up Docker Buildx (retry)
if: steps.buildx.outcome == 'failure'
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -760,7 +760,7 @@ jobs:
name: Docker phase requirements met
if: always() && inputs.release-phase != ''
needs: [mode, build, release-publish, release-publish-manifest]
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- name: Validate phase job results
.github/workflows/docs-site-checks.yml
+2 -2
View File
@@ -13,10 +13,10 @@ permissions:
jobs:
docs-site-checks:
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 20
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/e2e-desktop-core.yml
+2 -2
View File
@@ -30,10 +30,10 @@ concurrency:
jobs:
core:
name: Desktop core E2E (Linux)
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 30
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/e2e-desktop-update.yml
+2 -2
View File
@@ -32,7 +32,7 @@ concurrency:
jobs:
update:
name: Desktop install/update E2E (Linux, ${{ matrix.cell }})
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 30
# Required whenever the e2e_desktop_update lane fires (see ci.yaml): it was
# advisory until it proved stable, and every main push shard since has passed.
@@ -51,7 +51,7 @@ jobs:
- cell: update-concurrency
specs: e2e/update/update-concurrency.spec.ts
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
# The seeded install clones this checkout through a local bare origin.
.github/workflows/e2e-desktop.yml
+2 -2
View File
@@ -26,12 +26,12 @@ jobs:
# This job builds the renderer and the electron bundle, then drives a real
# Electron app under xvfb. vite, tsc and the Playwright workers all scale
# with the core count.
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 20
outputs:
review_status: ${{ steps.review-status.outputs.review_status }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/history-check.yml
+2 -2
View File
@@ -30,12 +30,12 @@ permissions:
jobs:
check-common-ancestor:
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
outputs:
review_status: ${{ steps.merge-base-check.outputs.review_status }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 0 # full history both sides for merge-base
.github/workflows/icons-freshness-check.yml
+2 -2
View File
@@ -26,10 +26,10 @@ permissions:
jobs:
check:
name: Regenerate icons + diff against committed
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/infographic-check.yml
+2 -2
View File
@@ -33,12 +33,12 @@ permissions:
jobs:
check-no-committed-infographics:
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
outputs:
review_status: ${{ steps.infographic-check.outputs.review_status }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/install-e2e-macos-run.yml
+4 -4
View File
@@ -101,7 +101,7 @@ jobs:
update-ref: ${{ inputs.update-ref }}
tag-has-desktop: ${{ inputs.tag-has-desktop }}
leg-id: ${{ inputs.leg-id }}
runner: macos-latest
runner: blacksmith-6vcpu-macos-latest
timeout-minutes: ${{ inputs.timeout-minutes }}
# ---- arm 2: the published dmg, then Playwright drives the app ------------
@@ -112,13 +112,13 @@ jobs:
if: >-
inputs.install-method == 'desktop-installer@latest' && inputs.tag-has-desktop
&& contains(fromJSON('["open-app-update", "hermes-desktop-app-update", "hermes-update", "installer-script", "installer-script+desktop"]'), inputs.update-method)
runs-on: macos-latest
runs-on: blacksmith-12vcpu-macos-latest
timeout-minutes: ${{ inputs.timeout-minutes }}
steps:
# Full history: the driver bare-clones this checkout as the repo the
# installer/updater talk to.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit || github.sha }}
fetch-depth: 0
@@ -217,7 +217,7 @@ jobs:
timeout-minutes: ${{ inputs.timeout-minutes }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit || github.sha }}
.github/workflows/install-e2e-red.yml
+2 -2
View File
@@ -40,14 +40,14 @@ jobs:
track:
name: Update the install-e2e-red tracker
if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.event == 'schedule'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
permissions:
contents: read
actions: read
issues: write
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
sparse-checkout: tests/install/e2e-assets/red-tracker.mjs
sparse-checkout-cone-mode: false
.github/workflows/install-e2e-run.yml
+2 -2
View File
@@ -72,7 +72,7 @@ on:
description: 'Runner label.'
required: false
type: string
default: ubuntu-latest
default: blacksmith-2vcpu-ubuntu-2404
timeout-minutes:
description: 'Job timeout. A cold run installs real toolchains twice, and app-update legs add a full Electron build + launch.'
required: false
@@ -101,7 +101,7 @@ jobs:
# Full history: the driver bare-clones this checkout as the repo the
# installer/updater talk to, and both OLD and HEAD must be reachable
# in that clone. A shallow clone cannot serve either need.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit || github.sha }}
fetch-depth: 0
.github/workflows/install-e2e-windows-run.yml
+4 -4
View File
@@ -112,10 +112,10 @@ jobs:
bundled-e2e:
name: packaged bundle (open-app-update)
if: inputs.install-method == 'packaged-app' && inputs.update-method == 'open-app-update'
runs-on: ${{ inputs.bundle-arch == 'arm64' && 'windows-latest-32-arm-core' || 'windows-latest-32-core' }}
runs-on: ${{ inputs.bundle-arch == 'arm64' && 'windows-latest-32-arm-core' || 'blacksmith-32vcpu-windows-2025' }}
timeout-minutes: ${{ inputs.timeout-minutes }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit || github.sha }}
- name: Set up driver tools only
@@ -184,7 +184,7 @@ jobs:
|| (contains(fromJSON('["installer-script+desktop", "hermes-desktop-app-update", "desktop-installer@latest"]'), inputs.update-method) && inputs.tag-has-desktop)
|| (inputs.update-method == 'open-app-update' && inputs.tag-has-desktop
&& contains(fromJSON('["desktop-installer@latest", "installer-script+desktop"]'), inputs.install-method)))
runs-on: windows-latest-32-core
runs-on: blacksmith-32vcpu-windows-2025
timeout-minutes: ${{ inputs.timeout-minutes }}
env:
@@ -199,7 +199,7 @@ jobs:
# Full history: the driver bare-clones this checkout as the repo the
# installer/updater talk to, and both OLD and HEAD must be reachable
# in that clone. A shallow checkout cannot serve either need.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit || github.sha }}
fetch-depth: 0
.github/workflows/install-e2e.yml
+11 -11
View File
@@ -130,7 +130,7 @@ env:
jobs:
pick-releases:
name: Pick release tags
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
tags: ${{ steps.pick.outputs.tags }}
@@ -139,7 +139,7 @@ jobs:
# checkout: no blobs (filter), no other files (sparse), but DO fetch
# tags -- they are the whole input, and the default shallow checkout
# has none.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
filter: blob:none
@@ -195,7 +195,7 @@ jobs:
generate-matrix:
name: Expand combinations
needs: pick-releases
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
linux: ${{ steps.gen.outputs.linux }}
@@ -205,7 +205,7 @@ jobs:
windows-legs: ${{ steps.gen.outputs.windows-legs }}
macos-legs: ${{ steps.gen.outputs.macos-legs }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
sparse-checkout: scripts/sandbox/generate-e2e-matrix.mjs
@@ -232,7 +232,7 @@ jobs:
bundle-inputs:
name: Validate pinned bundle transitions
# Bundled legs need dispatch-only manifests.
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
windows: ${{ steps.inputs.outputs.windows }}
@@ -240,7 +240,7 @@ jobs:
windows-arch: ${{ steps.inputs.outputs.windows-arch }}
macos-arch: ${{ steps.inputs.outputs.macos-arch }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
- id: inputs
@@ -352,10 +352,10 @@ jobs:
# looks it up by that name.
leg-player:
name: Upload leg player
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
sparse-checkout: tests/install/e2e-assets/playback.html
@@ -380,7 +380,7 @@ jobs:
name: Source matrix gate
if: always() && inputs.release == true
needs: [generate-matrix, linux, windows, macos]
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- name: Evaluate source legs
@@ -422,10 +422,10 @@ jobs:
name: Result chart
if: always()
needs: [leg-player, pick-releases, linux, windows, macos, bundle-inputs, windows-bundled, macos-bundled]
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
sparse-checkout: |
.github/workflows/js-autofix.yml
+4 -4
View File
@@ -57,13 +57,13 @@ concurrency:
jobs:
generate-patch:
name: Generate eslint --fix patch
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
has-fixes: ${{ steps.produce-patch.outputs.has-fixes }}
# No permissions override → inherits workflow-level contents: read.
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- name: Set up locked Node and npm
id: node
@@ -134,14 +134,14 @@ jobs:
# Skip entirely when generate-patch found no fixes — saves a runner,
# avoids a redundant checkout/download, and keeps the job graph honest.
if: needs.generate-patch.outputs.has-fixes == 'true'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
environment: trusted-automation
permissions:
contents: write # needed to push to bot/js-autofix
pull-requests: write # needed for PR creation + auto-merge
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- name: Get GitHub App token
id: app-token
.github/workflows/js-tests.yml
+2 -2
View File
@@ -19,10 +19,10 @@ jobs:
#
# One larger runner installs one time. vitest, tsc and eslint each size
# their own worker pool from the core count.
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 30
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
- name: Set up the locked JS build toolchain
.github/workflows/label-rerun.yml
+1 -1
View File
@@ -26,7 +26,7 @@ jobs:
rerun-with-e2e:
name: Rerun CI with every E2E lane
if: github.event.label.name == 'run-e2e'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
steps:
- name: Cancel and rerun the head commit's CI, Docker and Nix runs
.github/workflows/lazy-deps-guard.yml
+2 -2
View File
@@ -33,10 +33,10 @@ permissions:
jobs:
lazy-deps-guard:
name: No production imports of the tools.lazy_deps stub
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/lint.yml
+8 -8
View File
@@ -39,11 +39,11 @@ jobs:
lint-diff:
name: ruff + ty diff
if: inputs.event_name == 'pull_request' && inputs.python
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 0 # need full history for merge-base + worktree
@@ -146,11 +146,11 @@ jobs:
# the diff comment even when enforcement fails.
name: ruff enforcement (blocking)
if: inputs.python
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
@@ -184,11 +184,11 @@ jobs:
# parent (current main), so an improvement that lands on main is locked in at once.
name: code health ratchet (blocking)
if: inputs.event_name == 'pull_request'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 2 # the merge commit and its first parent (the base branch tip)
@@ -220,11 +220,11 @@ jobs:
# See scripts/check-windows-footguns.py for the full rule list.
name: Windows footguns (blocking)
if: inputs.python
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/live-providers.yml
+2 -2
View File
@@ -35,7 +35,7 @@ jobs:
name: Live provider canaries
# Forks and PRs never see these secrets; only run where they exist.
if: github.repository == 'NousResearch/hermes-agent'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 25
# Only booleans at job level: the key VALUES are scoped to the one step that
# needs them ('Run live canaries'), so `uv sync` build backends and the
@@ -63,7 +63,7 @@ jobs:
- name: Checkout code
if: steps.gate.outputs.configured != '0'
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
- name: Install uv
if: steps.gate.outputs.configured != '0'
.github/workflows/lockfile-diff.yml
+2 -2
View File
@@ -40,14 +40,14 @@ concurrency:
jobs:
diff:
name: package-lock.json semantic diff
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
changed: ${{ steps.diff.outputs.changed }}
review_status: ${{ steps.emit-status.outputs.review_status }}
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 0 # need history for the merge base
.github/workflows/nix.yml
+4 -4
View File
@@ -57,12 +57,12 @@ jobs:
# flake turns main red after the merge.
detect:
name: Detect affected areas
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
outputs:
nix: ${{ steps.classify.outputs.nix }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# A stable run passes the claim commit. Every other event tests its own head SHA.
ref: ${{ inputs.commit || github.sha }}
@@ -83,11 +83,11 @@ jobs:
# takes minutes and not seconds when the cache misses. `nix flake check`
# builds 21 checks, and --max-jobs defaults to the core count. It uses the
# wider runner with no more configuration.
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 60
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
# A stable run passes the claim commit. Every other event tests its own head SHA.
ref: ${{ inputs.commit || github.sha }}
.github/workflows/plugin-catalog-ci.yml
+4 -4
View File
@@ -20,10 +20,10 @@ permissions:
jobs:
structural:
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
persist-credentials: false # this job is read-only
@@ -44,10 +44,10 @@ jobs:
python3 scripts/validate_plugin_catalog.py plugin-catalog/
pinned-source-validate:
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 30
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# Full commit graph + tags, blobs on demand: the diff below needs the
# merge commit's first parent, and Hermes resolves its own version
.github/workflows/pm-bundle.yml
+5 -5
View File
@@ -64,24 +64,24 @@ jobs:
fail-fast: false
matrix:
target:
# TODO(ethie): restore the linux legs once the ubuntu-latest-32-*
# TODO(ethie): restore the linux legs once the blacksmith-32vcpu-ubuntu-2404-*
# larger runners are re-imaged to Ubuntu 24.04. They currently boot
# ubuntu-22.04 (glibc 2.35), and the prebuilt llama-server staged by
# the native payload requires GLIBC_2.38, so verification fails.
# - label: linux-x64
# runner: ubuntu-latest-32-core
# runner: blacksmith-32vcpu-ubuntu-2404
# - label: linux-arm64
# runner: ubuntu-latest-32-arm-core
# runner: blacksmith-32vcpu-ubuntu-2404-arm
- label: darwin-arm64
runner: macos-15
- label: darwin-x64
runner: macos-15-intel
- label: win32-x64
runner: windows-latest-32-core
runner: blacksmith-32vcpu-windows-2025
- label: win32-arm64
runner: windows-latest-32-arm-core
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# Default to the exact candidate commit (github.sha); inputs.ref
# remains an escape hatch for a focused manual reproduction.
.github/workflows/profile-artifact-check.yml
+2 -2
View File
@@ -18,10 +18,10 @@ permissions:
jobs:
check-profile-artifacts:
name: Reject profile archives
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
- name: Reject profile exports in the checkout
.github/workflows/prompt-surface-diff.yml
+2 -2
View File
@@ -40,14 +40,14 @@ concurrency:
jobs:
diff:
name: Prompt surface summary
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
changed: ${{ steps.diff.outputs.changed }}
review_status: ${{ steps.emit-status.outputs.review_status }}
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 0 # need history for the merge base
.github/workflows/remote-backends.yml
+2 -2
View File
@@ -36,11 +36,11 @@ env:
jobs:
real-backends:
name: SSH + Docker backends (real sshd, real daemon)
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/rust-tests.yml
+2 -2
View File
@@ -35,13 +35,13 @@ jobs:
# cargo builds codegen units and test binaries in parallel across the
# cores. This lane also builds the crate from the start when Cargo.toml
# changes.
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 30
defaults:
run:
working-directory: apps/bootstrap-installer/src-tauri
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/sandbox-image.yml
+12 -12
View File
@@ -45,21 +45,21 @@ jobs:
matrix:
include:
- arch: amd64
runner: ubuntu-latest-32-core
runner: blacksmith-32vcpu-ubuntu-2404
platform: linux/amd64
- arch: arm64
runner: ubuntu-latest-32-arm-core
runner: blacksmith-32vcpu-ubuntu-2404-arm
platform: linux/arm64
runs-on: ${{ matrix.runner }}
timeout-minutes: 45
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Build (${{ matrix.arch }})
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
uses: useblacksmith/build-push-action@v2
with:
context: .
file: docker/sandbox-desktop.Dockerfile
@@ -83,18 +83,18 @@ jobs:
matrix:
include:
- arch: amd64
runner: ubuntu-latest-32-core
runner: blacksmith-32vcpu-ubuntu-2404
platform: linux/amd64
- arch: arm64
runner: ubuntu-latest-32-arm-core
runner: blacksmith-32vcpu-ubuntu-2404-arm
platform: linux/arm64
runs-on: ${{ matrix.runner }}
timeout-minutes: 30
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -104,7 +104,7 @@ jobs:
- name: Push ${{ matrix.arch }} by digest
id: push
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
uses: useblacksmith/build-push-action@v2
with:
context: .
file: docker/sandbox-desktop.Dockerfile
@@ -131,7 +131,7 @@ jobs:
merge:
if: ${{ !cancelled() && github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.publish)) }}
needs: [publish]
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
environment: container-publish
steps:
@@ -142,7 +142,7 @@ jobs:
merge-multiple: true
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Log in to Docker Hub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
.github/workflows/skills-index-freshness.yml
+4 -4
View File
@@ -23,7 +23,7 @@ permissions:
jobs:
check-freshness:
if: github.repository == 'NousResearch/hermes-agent'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 10
environment: trusted-automation
steps:
@@ -33,7 +33,7 @@ jobs:
# "Can't find 'action.yml' ... under .github/actions/get-app-token"
# every time the probe is non-ok — i.e. exactly when the watchdog is
# supposed to file its issue.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- name: Probe live index
id: probe
@@ -176,11 +176,11 @@ jobs:
# chain lacks Access-Control-Allow-Origin (#136483). The probe above uses
# curl -L, which never checks CORS, so it stays green while Desktop is blocked.
if: github.repository == 'NousResearch/hermes-agent'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
environment: trusted-automation
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- name: Fetch the plugin catalog the way Desktop does
id: probe
.github/workflows/skills-index.yml
+4 -4
View File
@@ -19,7 +19,7 @@ jobs:
build-index:
# Only run on the upstream repository, not on forks
if: github.repository == 'NousResearch/hermes-agent'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
# Critical path (Sep 2026): clawhub walk ∥ github taps ~8 min, then skills.sh
# resolve ~6 min, then a bounded 8 min owner enrichment. 15 min cancelled every
# scheduled run for two months and left the live index frozen; on Sep 17 ClawHub
@@ -28,7 +28,7 @@ jobs:
timeout-minutes: 120
environment: trusted-automation
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- name: Get GitHub App token
id: app-token
@@ -85,7 +85,7 @@ jobs:
trigger-deploy:
needs: build-index
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
environment: trusted-automation
steps:
@@ -93,7 +93,7 @@ jobs:
# (./.github/actions/get-app-token) and cannot resolve without the repo
# checked out. `build-index` above already does this; this job did not,
# so the scheduled deploy re-trigger never fired.
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
- name: Get GitHub App token
id: app-token
.github/workflows/stable-release-publication.yml
+3 -3
View File
@@ -32,11 +32,11 @@ jobs:
(github.event.workflow_run.conclusion != 'success' &&
github.event.workflow_run.event == 'workflow_dispatch' &&
github.event.workflow_run.head_repository.full_name == github.repository)
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 30
environment: release-signing
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.event.repository.default_branch }}
fetch-depth: 0
@@ -46,7 +46,7 @@ jobs:
toolchain: node
cache-python: false
- name: Set up Docker Buildx for ordered alias promotion
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Log in to Docker Hub for ordered alias promotion
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
.github/workflows/stable-release.yml
+19 -19
View File
@@ -38,7 +38,7 @@ jobs:
# that can read it.
permissions:
contents: write
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
outputs:
claim-tag: ${{ steps.admit.outputs.claim-tag }}
claim-object: ${{ steps.admit.outputs.claim-object }}
@@ -53,7 +53,7 @@ jobs:
lanes: ${{ steps.admit.outputs.lanes }}
jobs: ${{ steps.admit.outputs.jobs }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
fetch-depth: 0
@@ -294,14 +294,14 @@ jobs:
name: Pin actual OLD and NEW signed packages (darwin-arm64)
needs: [admit, candidates-darwin-arm64]
if: fromJSON(needs.admit.outputs.jobs)['transitions-darwin-arm64']
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
outputs:
windows: ${{ steps.plan.outputs.windows }}
macos: ${{ steps.plan.outputs.macos }}
baseline: ${{ steps.plan.outputs.baseline }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
fetch-depth: 0
@@ -329,14 +329,14 @@ jobs:
name: Pin actual OLD and NEW signed packages (darwin-x64)
needs: [admit, candidates-darwin-x64]
if: fromJSON(needs.admit.outputs.jobs)['transitions-darwin-x64']
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
outputs:
windows: ${{ steps.plan.outputs.windows }}
macos: ${{ steps.plan.outputs.macos }}
baseline: ${{ steps.plan.outputs.baseline }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
fetch-depth: 0
@@ -364,14 +364,14 @@ jobs:
name: Pin actual OLD and NEW signed packages (win32)
needs: [admit, candidates-win32-bundle]
if: fromJSON(needs.admit.outputs.jobs)['transitions-win32']
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
outputs:
windows: ${{ steps.plan.outputs.windows }}
macos: ${{ steps.plan.outputs.macos }}
baseline: ${{ steps.plan.outputs.baseline }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
fetch-depth: 0
@@ -404,7 +404,7 @@ jobs:
if: always() && fromJSON(needs.admit.outputs.jobs)['candidate-manifest']
needs: [admit, candidates-darwin-arm64, candidates-darwin-x64, candidates-win32-arm64,
candidates-win32-x64, candidates-win32-bundle, candidates-termux]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
timeout-minutes: 90
outputs:
@@ -421,7 +421,7 @@ jobs:
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
CLOUDFLARE_R2_PUBLIC_URL: ${{ vars.CLOUDFLARE_R2_PUBLIC_URL }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
fetch-depth: 0
@@ -493,9 +493,9 @@ jobs:
name: Bootstrap installer release identity
needs: admit
if: fromJSON(needs.admit.outputs.jobs)['bootstrap-version']
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ needs.admit.outputs.commit }}
- name: Stamp and verify the Cargo and Tauri release identity
@@ -532,9 +532,9 @@ jobs:
candidate-manifest, transitions-darwin-arm64, transitions-darwin-x64,
transitions-win32, windows-packaged, macos-packaged-arm64, macos-packaged-x64,
bootstrap-version]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
- uses: ./.github/actions/setup-pm
@@ -587,9 +587,9 @@ jobs:
name: All artifact publication succeeded
if: always()
needs: [admit, acceptance, publish-docker, publish-bundles]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
- uses: ./.github/actions/setup-pm
@@ -605,13 +605,13 @@ jobs:
if: always()
needs: [admit, ci, docker, acceptance, candidate-manifest, publication, publish-docker,
windows-packaged, macos-packaged-arm64, macos-packaged-x64]
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
permissions:
contents: write
actions: read
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
ref: ${{ github.sha }}
fetch-depth: 0
@@ -668,7 +668,7 @@ jobs:
--candidate-manifest-sha256 "$CANDIDATE_MANIFEST_SHA256" --candidate-commit "$RELEASE_COMMIT" \
"${args[@]}"
- name: Set up Docker Buildx for ordered alias promotion
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
uses: useblacksmith/setup-docker-builder@v2
- name: Log in to Docker Hub for ordered alias promotion
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
.github/workflows/supply-chain-audit.yml
+5 -5
View File
@@ -55,13 +55,13 @@ jobs:
scan:
name: Scan PR for critical supply chain risks
if: inputs.scan
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
outputs:
review_status: ${{ steps.emit-status.outputs.review_status }}
steps:
- name: Checkout
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 0
@@ -159,13 +159,13 @@ jobs:
dep-bounds:
name: Check PyPI dependency upper bounds
if: inputs.deps
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
outputs:
review_status: ${{ steps.emit-status.outputs.review_status }}
steps:
- name: Checkout
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
fetch-depth: 0
@@ -239,7 +239,7 @@ jobs:
name: Aggregate review statuses
needs: [scan, dep-bounds]
if: always()
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
outputs:
review_status: ${{ steps.merge.outputs.review_status }}
.github/workflows/termux-verify.yml
+7 -7
View File
@@ -42,10 +42,10 @@ concurrency:
jobs:
contracts:
name: Termux packaging contracts on Linux
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# A stable run passes the claim commit. Every other event tests its own head SHA.
ref: ${{ inputs.commit || github.sha }}
@@ -72,10 +72,10 @@ jobs:
tui:
name: Prebuilt TUI checks
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 15
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# A stable run passes the claim commit. Every other event tests its own head SHA.
ref: ${{ inputs.commit || github.sha }}
@@ -101,7 +101,7 @@ jobs:
r2-provisioned:
name: Detect R2 credentials
if: github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
runs-on: ubuntu-24.04
runs-on: blacksmith-2vcpu-ubuntu-2404
environment: release-signing
timeout-minutes: 5
outputs:
@@ -120,7 +120,7 @@ jobs:
# A stable-release candidate run still fails loudly on missing R2: the
# release must not pass on a skipped verification.
if: needs.r2-provisioned.outputs.configured == 'true' || inputs.release == true
runs-on: ubuntu-24.04-arm
runs-on: blacksmith-2vcpu-ubuntu-2404-arm
environment: release-signing
timeout-minutes: 45
env:
@@ -129,7 +129,7 @@ jobs:
CLOUDFLARE_R2_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
CLOUDFLARE_R2_BUCKET: ${{ vars.CLOUDFLARE_R2_BUCKET }}
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
# A stable run passes the claim commit. Every other event tests its own head SHA.
ref: ${{ inputs.commit || github.sha }}
.github/workflows/tests-os.yml
+7 -7
View File
@@ -12,7 +12,7 @@ name: OS-specific tests
# is where those markers actually execute:
#
# macos → ``-m platforms`` on macos-latest
# windows → ``-m platforms`` on windows-latest-32-core and windows-latest-32-arm-core
# windows → ``-m platforms`` on blacksmith-32vcpu-windows-2025 and windows-latest-32-arm-core
#
# (tests/conftest.py's ``pytest_collection_modifyitems`` hook skips
# foreign-OS ``platforms(...)`` markers on each host, so one shared ``-m
@@ -85,15 +85,15 @@ jobs:
# Two slices on the free standard runner (3 cores, 3 workers): one lane ran
# ~7.5 min and became the slowest required job once the Linux suite split.
- name: macOS-only tests (1/2)
runner: macos-latest
runner: blacksmith-6vcpu-macos-latest
marker: macos
slice: 1/2
- name: macOS-only tests (2/2)
runner: macos-latest
runner: blacksmith-6vcpu-macos-latest
marker: macos
slice: 2/2
- name: Windows-only tests
runner: windows-latest-32-core
runner: blacksmith-32vcpu-windows-2025
marker: windows
- name: Windows-only tests (arm64)
runner: windows-latest-32-arm-core
@@ -101,7 +101,7 @@ jobs:
timeout: 60
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
@@ -238,11 +238,11 @@ jobs:
# 32-core like os-tests' Windows row: seven files run in parallel and each spawns
# process trees; on the 4-vCPU image the suite step took 153-171 s (job 4.7-5.6 min),
# here 124 s (job 3.1 min), with headroom against scheduling-starved timeouts.
runs-on: windows-latest-32-core
runs-on: blacksmith-32vcpu-windows-2025
timeout-minutes: 25
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/tests.yml
+8 -8
View File
@@ -43,7 +43,7 @@ jobs:
# scale linearly. run_tests_parallel.py partitions from the checkout alone, so
# both slices agree on the split without a planning job.
name: Run tests (${{ matrix.slice }}/2)
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 30
strategy:
fail-fast: false
@@ -51,7 +51,7 @@ jobs:
slice: [1, 2]
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
@@ -142,11 +142,11 @@ jobs:
# The core suites spawn real serve / gateway / tui_gateway / MCP / SQLite
# writer processes per test; a 4-vCPU runner serialises them into timeouts.
if: inputs.e2e
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 30
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
@@ -261,13 +261,13 @@ jobs:
# carries the whole tree's wall time against the 60-minute timeout.
# Skipping this job skips every e2e-upgrade shard with it.
if: inputs.e2e_upgrade
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
shards: ${{ steps.plan.outputs.shards }}
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
# The clean-worktree step below loads its action from the checkout.
@@ -305,7 +305,7 @@ jobs:
# runs ~5-15 min. Sharded by suite directory (see e2e-upgrade-plan).
name: e2e-upgrade (${{ matrix.shard }})
needs: e2e-upgrade-plan
runs-on: ubuntu-latest-32-core
runs-on: blacksmith-32vcpu-ubuntu-2404
timeout-minutes: 60
strategy:
fail-fast: false
@@ -313,7 +313,7 @@ jobs:
shard: ${{ fromJSON(needs.e2e-upgrade-plan.outputs.shards) }}
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
# N-1 = `git describe --tags --abbrev=0 HEAD~1`.
.github/workflows/uv-lockfile-check.yml
+2 -2
View File
@@ -65,13 +65,13 @@ concurrency:
jobs:
check:
name: python -m pm.build_env --source . --check-lock
runs-on: ubuntu-latest
runs-on: blacksmith-2vcpu-ubuntu-2404
timeout-minutes: 5
outputs:
review_status: ${{ steps.verify.outputs.review_status }}
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
.github/workflows/windows-bundle-sdk.yml
+1 -1
View File
@@ -31,7 +31,7 @@ jobs:
matrix:
runner: [windows-latest-32-arm-core, windows-latest-32-arm-core]
steps:
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
- uses: useblacksmith/checkout@v1
with:
persist-credentials: false
- uses: ./.github/actions/setup-pm
.github/workflows/windows-install-update-e2e.yml
+2 -2
View File
@@ -49,12 +49,12 @@ concurrency:
jobs:
install-update:
name: Windows install.ps1 + hermes update E2E
runs-on: windows-latest-32-core
runs-on: blacksmith-32vcpu-windows-2025
# A typical run is ~17 min; one slow runner took 28 min for the same work (run 36295230146).
timeout-minutes: 75
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
ref: ${{ inputs.commit }}
# serve.git is a bare clone of this checkout: the installer's treeless clone and
.github/workflows/windows-venv-e2e.yml
+2 -2
View File
@@ -42,11 +42,11 @@ concurrency:
jobs:
venv-holder-e2e:
name: venv-holder live E2E (windows-latest)
runs-on: windows-latest-32-core
runs-on: blacksmith-32vcpu-windows-2025
timeout-minutes: 25
steps:
- name: Checkout code
uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7.0.1
uses: useblacksmith/checkout@v1
with:
# The stable caller dispatches on the candidate tag; github.sha is
# the exact candidate commit there and the head SHA everywhere else.
evals/desktop_gateway_ticket_native/workflow.yml
+1 -1
View File
@@ -12,7 +12,7 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [windows-latest, macos-latest]
os: [blacksmith-4vcpu-windows-2025, blacksmith-6vcpu-macos-latest]
runs-on: ${{ matrix.os }}
timeout-minutes: 30
defaults: