From ca42eeb386aac6a015858c65f3b5394afec64eec Mon Sep 17 00:00:00 2001
From: Bendik Aagaard Lynghaug <bendik.lynghaug@gmail.com>
Date: Sun, 13 Sep 2026 11:21:08 +0200
Subject: [PATCH] =?UTF-8?q?CI:=20never=20install=20packages=20on=20bare=20?=
 =?UTF-8?q?runners=20=E2=80=94=20check=20deps,=20install=20only=20in=20con?=
 =?UTF-8?q?tainers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bare runners are real hosts; pacman -Sy in CI mutates them (and can leave a
partial-sync state). Now the ephemeral container runner installs its deps as
before, while the bare (aarch64/klokka) runner is only checked for
libpipewire+clang and fails with a clear message if they're absent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GLUwWE2KmFPzhKaf67tWbx
---
 .gitea/workflows/release.yml | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 456ceb3..5bcdbbc 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -36,14 +36,23 @@ jobs:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-${{ matrix.arch }}-cargo-${{ hashFiles('Cargo.lock') }}
 
-      - name: Install audio build deps (libpipewire + clang for native capture)
+      - name: Ensure audio build deps (libpipewire + clang for native capture)
         run: |
-          SUDO=""; command -v sudo >/dev/null && SUDO=sudo
           if command -v apt-get >/dev/null; then
+            # Ephemeral container runner: safe to install into it.
+            SUDO=""; command -v sudo >/dev/null && SUDO=sudo
             $SUDO apt-get update
             $SUDO apt-get install -y libpipewire-0.3-dev libspa-0.2-dev clang libclang-dev pkg-config
-          elif command -v pacman >/dev/null; then
-            $SUDO pacman -Sy --needed --noconfirm pipewire clang pkgconf
+          else
+            # Bare/host runner: never mutate it - require deps preinstalled.
+            missing=""
+            pkg-config --exists libpipewire-0.3 2>/dev/null || missing="$missing libpipewire(+dev headers)"
+            command -v clang >/dev/null || missing="$missing clang"
+            if [ -n "$missing" ]; then
+              echo "::error::bare runner missing build deps:$missing — install once on the host; CI does not modify bare runners"
+              exit 1
+            fi
+            echo "bare runner already has libpipewire + clang"
           fi
 
       - name: Build