Stage 9: CI build on a self-hosted Gitea runner (0.7.0)

- .gitea/workflows/build.yml builds the packages and both ISOs with
  `make iso iso-server` on pushes to main and dev, v* tags and on demand
- ci/runner: setup of the CI host (WSL2 Ubuntu 24.04 with Docker Engine
  and gitea-runner as a systemd service, autostart task for Windows)
- scripts/builder.sh: DASOS_OUT keeps out/ outside the checkout, so CI
  reuses void-packages, the masterdir and the download cache
- README and TODO updated

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci/runner/autostart.ps1

@@ -0,0 +1,12 @@
+# Starts the dasci WSL distro (Docker and gitea-runner inside) when Windows
+# boots, without anyone logging in. Run once in an elevated PowerShell.
+# The task keeps a process attached so WSL never stops the distro as idle.
+$wsl = 'C:\Program Files\WSL\wsl.exe'
+$action = New-ScheduledTaskAction -Execute $wsl -Argument '-d dasci --exec /bin/sleep infinity'
+$trigger = New-ScheduledTaskTrigger -AtStartup
+$principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType S4U -RunLevel Highest
+$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit 0 -AllowStartIfOnBatteries `
+  -DontStopIfGoingOnBatteries -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1)
+Register-ScheduledTask -TaskName 'DasOS CI (WSL dasci)' -Action $action -Trigger $trigger `
+  -Principal $principal -Settings $settings -Force | Out-Null
+Get-ScheduledTask -TaskName 'DasOS CI (WSL dasci)' | Select-Object TaskName, State

ci/runner/config.yaml

@@ -0,0 +1,23 @@
+# gitea-runner configuration for the Das OS CI host (WSL2 distro "dasci").
+# Jobs run directly on the host: scripts/builder.sh needs the host's Docker
+# and paths it can bind-mount into the privileged Void builder container.
+log:
+  level: info
+
+runner:
+  file: /var/lib/gitea-runner/.runner
+  # One build at a time: packages and ISOs share the cache in DASOS_OUT
+  capacity: 1
+  # Matches Gitea's default job timeout; the first build bootstraps void-packages
+  timeout: 3h
+  envs:
+    DASOS_OUT: /var/lib/dasos-ci/out
+  labels:
+    - "dasci:host"
+
+cache:
+  # Build caches live in DASOS_OUT, the workflow does not use actions/cache
+  enabled: false
+
+host:
+  workdir_parent: /var/lib/gitea-runner/work

ci/runner/gitea-runner.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Gitea Actions runner for Das OS
+After=docker.service network-online.target
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+User=runner
+Group=runner
+WorkingDirectory=/var/lib/gitea-runner
+ExecStart=/usr/local/bin/gitea-runner -c /etc/gitea-runner/config.yaml daemon
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

ci/runner/setup.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+# Sets up the Das OS CI host: Docker Engine, the runner user and gitea-runner.
+# Run as root inside a fresh Ubuntu 24.04 WSL2 distro with systemd enabled:
+#   sh setup.sh                      install everything
+#   sh setup.sh register <token>     register the runner with git.das.org.ua
+# Safe to run again.
+set -eu
+
+RUNNER_VERSION=5.1.1
+INSTANCE=https://git.das.org.ua
+here=$(cd "$(dirname "$0")" && pwd)
+
+if [ "${1:-}" = register ]; then
+  [ -n "${2:-}" ] || { echo "usage: setup.sh register <token>" >&2; exit 1; }
+  sudo -u runner /usr/local/bin/gitea-runner -c /etc/gitea-runner/config.yaml \
+    register --no-interactive --instance "$INSTANCE" --token "$2" --name dasci
+  systemctl restart gitea-runner
+  exit 0
+fi
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -q
+apt-get install -yq ca-certificates curl git make xz-utils
+
+# Docker Engine from Docker's repository (Ubuntu's docker.io lags behind)
+install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+. /etc/os-release
+echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $VERSION_CODENAME stable" \
+  >/etc/apt/sources.list.d/docker.list
+apt-get update -q
+apt-get install -yq docker-ce docker-ce-cli containerd.io docker-buildx-plugin
+systemctl enable --now docker
+
+# Jobs run as an unprivileged user: build-packages.sh creates its xbps-src user
+# with the caller's UID, which must not be root
+id runner >/dev/null 2>&1 || useradd --create-home --shell /bin/bash --groups docker runner
+install -d -o runner -g runner /var/lib/gitea-runner /var/lib/dasos-ci /var/lib/dasos-ci/out
+
+url=https://gitea.com/gitea/runner/releases/download/v$RUNNER_VERSION/gitea-runner-$RUNNER_VERSION-linux-amd64.xz
+tmp=$(mktemp -d)
+curl -fsSL -o "$tmp/gitea-runner.xz" "$url"
+curl -fsSL -o "$tmp/gitea-runner.xz.sha256" "$url.sha256"
+(cd "$tmp" && echo "$(cut -d' ' -f1 gitea-runner.xz.sha256)  gitea-runner.xz" | sha256sum -c --quiet)
+xz -d "$tmp/gitea-runner.xz"
+install -m 0755 "$tmp/gitea-runner" /usr/local/bin/gitea-runner
+rm -rf "$tmp"
+
+install -D -m 0644 "$here/config.yaml" /etc/gitea-runner/config.yaml
+install -m 0644 "$here/gitea-runner.service" /etc/systemd/system/gitea-runner.service
+systemctl daemon-reload
+systemctl enable gitea-runner
+# The runner starts once it is registered
+if [ -f /var/lib/gitea-runner/.runner ]; then
+  systemctl restart gitea-runner
+else
+  echo "Now register: sh setup.sh register <token>"
+fi
+gitea-runner --version