ci: no sccache install on the bare aarch64 (klokka) runner; builtin:checkout

Gate the sccache install to the ephemeral x86_64 container; on the bare klokka
runner check-and-fail (the tarball was x86_64-only, so it was a host mutation
and a wrong-arch binary). Switch checkout to v4 builtin:checkout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -16,32 +16,42 @@ jobs:
           - arch: x86_64
             target: x86_64-unknown-linux-gnu
             runs-on: ubuntu-latest
+            sccache_dir: /sccache
           - arch: aarch64
             target: aarch64-unknown-linux-gnu
             runs-on: aarch64
+            sccache_dir: /var/lib/gitea-runner/sccache
 
     runs-on: ${{ matrix.runs-on }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: builtin:checkout
 
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
 
-      - name: Cache cargo + build artifacts
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-${{ matrix.arch }}-cargo-${{ hashFiles('Cargo.lock') }}
-          # Reuse a prior build's compiled deps (pipewire-sys/bindgen is slow,
-          # especially on the aarch64 host) even when Cargo.lock changed.
-          restore-keys: |
-            ${{ runner.os }}-${{ matrix.arch }}-cargo-
+      # Compiled-crate cache via sccache. x86_64 uses /sccache (a persistent
+      # host dir bind-mounted into the job container by the runner config);
+      # aarch64 runs on the klokka host and uses a runner-owned dir. Both
+      # persist across releases, unlike the (unreachable) Gitea cache service.
+      - name: Set up sccache
+        run: |
+          echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+          echo "SCCACHE_DIR=${{ matrix.sccache_dir }}" >> "$GITHUB_ENV"
+          mkdir -p "${{ matrix.sccache_dir }}"
+          if command -v sccache >/dev/null 2>&1; then sccache --version; exit 0; fi
+          # Bare runners (aarch64 = klokka host) are pre-provisioned; CI must not
+          # install onto them (and this tarball is x86_64-only). Only the
+          # ephemeral x86_64 container installs; a bare host missing it fails loud.
+          if [ "${{ matrix.arch }}" != x86_64 ]; then
+            echo "::error::sccache missing on the bare ${{ matrix.arch }} runner — provision klokka; CI must not install on bare hosts"; exit 1
+          fi
+          V=0.8.2
+          curl -sSL "https://github.com/mozilla/sccache/releases/download/v${V}/sccache-v${V}-x86_64-unknown-linux-musl.tar.gz" | tar -xz
+          sudo install -m0755 "sccache-v${V}-x86_64-unknown-linux-musl/sccache" /usr/local/bin/sccache
+          sccache --version
 
       - name: Ensure audio build deps (libpipewire + clang for native capture)
         run: |
@@ -115,7 +125,7 @@ jobs:
     runs-on: aarch64
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: builtin:checkout
 
       - name: Compute checksums and update PKGBUILD
         run: |
@@ -132,19 +142,27 @@ jobs:
       # (docs.gitea.com/usage/packages/arch). The PKGBUILD only repacks the
       # release tarballs, so CARCH can produce both architectures from this
       # one host. Consumers: see the infrastructure README.
+      # Best-effort mirror to the instance Arch registry. The ephemeral
+      # GITHUB_TOKEN is not accepted as a package-write credential, so this
+      # uses a dedicated REGISTRY_TOKEN secret (a write:package token for bl);
+      # if it is unset the step is skipped, and continue-on-error keeps a
+      # registry hiccup from failing the release or the AUR push.
       - name: Publish to the Arch package registry
+        continue-on-error: true
         run: |
           set -euo pipefail
+          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
+            echo "::warning::REGISTRY_TOKEN not set — skipping Arch registry publish"
+            exit 0
+          fi
           cd aur
-          # Build both arches here (repackaging the released binaries) and
-          # push each to the instance Arch registry. Use --packagelist for
-          # the exact filename (honours the runner's PKGEXT/PKGDEST) rather
-          # than globbing, and !strip (in the PKGBUILD) so packaging the
-          # foreign-arch binary on this host does not try to strip it.
+          # --packagelist gives the exact filename (honours the runner's
+          # PKGEXT); !strip (in the PKGBUILD) lets the foreign-arch binary be
+          # packaged on this host without stripping.
           for carch in aarch64 x86_64; do
             pkgfile=$(CARCH="$carch" makepkg --packagelist | tail -1)
             CARCH="$carch" makepkg -f --nodeps --noconfirm --skipinteg
-            curl --fail-with-body --user "${{ gitea.actor }}:${{ secrets.GITHUB_TOKEN }}" \
+            curl --fail-with-body --user "bl:${{ secrets.REGISTRY_TOKEN }}" \
               --upload-file "$pkgfile" \
               "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/arch/uhhm"
           done

Cargo.lock

@@ -737,7 +737,7 @@ checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "spectrust"
-version = "0.2.8"
+version = "0.2.9"
 dependencies = [
  "byteorder",
  "clap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "spectrust"
-version = "0.2.8"
+version = "0.2.9"
 edition = "2021"
 
 [profile.release]

aur/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Bendik Aagaard Lynghaug <bendik.lynghaug@gmail.com>
 pkgname=spectrust
-pkgver=0.2.8
+pkgver=0.2.9
 pkgrel=1
 pkgdesc="Terminal audio spectrum analyzer"
 arch=('x86_64' 'aarch64')