1660de6cc6
All checks were successful
PR build (required check) / changes (pull_request) Successful in 6s
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 8s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 3s
A single PR push fires pr-build, secrets-guard, and shell-lint as three independent workflows with no dependency between them, so the previous capacity (3, an earlier undocumented hand-tune of the tool's default of 1) already serializes build-backend/build-frontend/validate-observability behind them even with 16 idle cores on the runner host. Raise to 8 and track it in register-lan-runner.sh so a re-provision doesn't silently drop back to the default. Also document why more capacity belongs on the desktop rather than a runner on prod/beta: docker_host: automount gives job containers the host's own Docker socket, which on a live app or Forgejo host means any CI job gets root-equivalent access to what else is running there. An earlier stack revision did run the runner on beta and was reverted for this reason. |
||
|---|---|---|
| .. | ||
| db | ||
| forgejo | ||
| migrations | ||
| openmeteo | ||
| secrets | ||
| stack | ||
| swarm | ||
| twa | ||
| Caddyfile | ||
| deploy-dev.sh | ||
| deploy.sh | ||
| migrate-db.py | ||
| POSTGRES-MIGRATION.md | ||
| provision-agent-access.sh | ||
| provision-dev-lan.sh | ||
| provision-mail.sh | ||
| provision-secrets.sh | ||
| render-secrets.sh | ||
| thermograph-dev.service | ||
| thermograph.env.example | ||
| thermograph.service | ||