Merge pull request #671 from omacom/mac/109-aarch64-native-ci

Build aarch64 PR packages natively on arm64 runners

.github/workflows/build-pr.yml

@@ -1,8 +1,9 @@
 name: Build changed packages
 
-# Build every package directory a PR touches, one job per package per arch, on
-# the self-hosted droplet pool. Artifacts are unsigned; publish.yml signs and
-# publishes them on merge.
+# Build every package directory a PR touches, one job per package per arch:
+# x86_64 on the self-hosted droplet pool, aarch64 natively on GitHub's arm64
+# runners. Artifacts are unsigned; publish.yml signs and publishes them on
+# merge.
 #
 # Tooling runs from the base branch; a PR supplies only pkgbuilds/. The
 # vouch gate limits who may spend compute; this limits what their PR can run.
@@ -159,13 +160,17 @@ jobs:
   build:
     needs: changes
     if: needs.changes.outputs.count != '0'
-    runs-on: [self-hosted, omarchy-builder]
+    # The droplets are x86, so aarch64 there runs under QEMU: omarchy-mac-boot
+    # took 2h47m of the 180 minutes, most of it in check().
+    # GitHub's arm64 runners (4 vCPU, 16 GB; ~100 GB disk free in our pilots)
+    # build it natively in 11 minutes, and linux-aurora in 30 (72 under QEMU).
+    runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || fromJSON('["self-hosted","omarchy-builder"]') }}
     timeout-minutes: 180
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.changes.outputs.matrix) }}
     steps:
-      # Tooling from base: everything that executes on this droplet's host
+      # Tooling from base: everything that executes on this runner's host
       # (bin/, helpers/, build/) comes from the base branch. Only the PR's
       # package directories are overlaid. A PR can therefore change what
       # gets built, never how the runner builds it. A PR that changes both

ci/README.md

@@ -6,8 +6,9 @@ signing on merge exactly as before.
 ## Pieces
 
 - `.github/workflows/build-pr.yml` — on a PR touching `pkgbuilds/**`, one job
-  per changed package on runners labelled `omarchy-builder`. Uploads the
-  unsigned `.pkg.tar.zst` as a workflow artifact (7 days).
+  per changed package on runners labelled `omarchy-builder`. aarch64 jobs
+  run on GitHub's native `ubuntu-24.04-arm` runners instead. Uploads the unsigned
+  `.pkg.tar.zst` as a workflow artifact (7 days).
 - `runner-cloud-init.yaml` — Ubuntu 24.04 user-data: docker + buildx, the
   GitHub runner registered `--ephemeral`, runs one job, powers off.
 - `controller.sh` — systemd timer every minute on a small always-on droplet.
@@ -67,7 +68,9 @@ Watch it with `journalctl -u omarchy-controller -f` on the box.
 - Publish is incremental and immutable: pull the channel db, refuse
   different bytes under an existing name, accept identical bytes, upload
   packages then signatures then the db.
-- aarch64 under QEMU with credential-preserving binfmt.
+- aarch64 under QEMU with credential-preserving binfmt. PR builds now run
+  aarch64 natively on `ubuntu-24.04-arm` (QEMU was up to ~15x slower); publish.yml
+  still builds under QEMU when a merged tree has no PR artifact.
 - Vouch gate: collaborators, `.github/VOUCHED.td`, or the `build-approved`
   label; denounced authors cannot be overridden by the label.
 - Tests run on PRs only; `result`, `self-tests`, `build-isolation` are the