From 7c646625c26e444c98132821cf60358c15fe1559 Mon Sep 17 00:00:00 2001 From: Marcelo Alcantara Date: Sun, 27 Sep 2026 23:44:28 +1000 Subject: [PATCH 1/3] Build aarch64 PR packages natively on GitHub's arm64 runners The droplet pool is x86, so aarch64 builds ran under QEMU about 30x slower; omarchy-mac-boot's check() took 2h47m of the 180-minute job limit. Heavy packages stay on the droplets until a native build of each is shown to fit. --- .github/workflows/build-pr.yml | 16 +++++++++++----- ci/README.md | 10 +++++++--- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 591e3acf..a8e25ace 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -1,8 +1,9 @@ name: Build changed packages -# Build every package directory a PR touches, one job per package per arch, on -# the self-hosted droplet pool. Artifacts are unsigned; publish.yml signs and -# publishes them on merge. +# Build every package directory a PR touches, one job per package per arch: +# x86_64 on the self-hosted droplet pool, aarch64 natively on GitHub's arm64 +# runners. Artifacts are unsigned; publish.yml signs and publishes them on +# merge. # # Tooling runs from the base branch; a PR supplies only pkgbuilds/. The # vouch gate limits who may spend compute; this limits what their PR can run. @@ -159,13 +160,18 @@ jobs: build: needs: changes if: needs.changes.outputs.count != '0' - runs-on: [self-hosted, omarchy-builder] + # The droplets are x86, so aarch64 there runs under QEMU, about 30x + # slower: omarchy-mac-boot's check() took 2h47m of the 180 minutes. + # aarch64 builds natively on GitHub's arm64 runners (4 vCPU, 16 GB), + # except the packages listed here, which stay on the 32-vCPU droplets + # until a native build of each has been shown to fit. + runs-on: ${{ (matrix.arch == 'aarch64' && !contains(fromJSON('["linux-aurora","strata","obs-studio"]'), matrix.package)) && 'ubuntu-24.04-arm' || fromJSON('["self-hosted","omarchy-builder"]') }} timeout-minutes: 180 strategy: fail-fast: false matrix: ${{ fromJson(needs.changes.outputs.matrix) }} steps: - # Tooling from base: everything that executes on this droplet's host + # Tooling from base: everything that executes on this runner's host # (bin/, helpers/, build/) comes from the base branch. Only the PR's # package directories are overlaid. A PR can therefore change what # gets built, never how the runner builds it. A PR that changes both diff --git a/ci/README.md b/ci/README.md index 0e539888..4efadf38 100644 --- a/ci/README.md +++ b/ci/README.md @@ -6,8 +6,10 @@ signing on merge exactly as before. ## Pieces - `.github/workflows/build-pr.yml` — on a PR touching `pkgbuilds/**`, one job - per changed package on runners labelled `omarchy-builder`. Uploads the - unsigned `.pkg.tar.zst` as a workflow artifact (7 days). + per changed package on runners labelled `omarchy-builder`. aarch64 jobs + run on GitHub's native `ubuntu-24.04-arm` runners instead, except the few + heavy packages the workflow keeps on the droplets. Uploads the unsigned + `.pkg.tar.zst` as a workflow artifact (7 days). - `runner-cloud-init.yaml` — Ubuntu 24.04 user-data: docker + buildx, the GitHub runner registered `--ephemeral`, runs one job, powers off. - `controller.sh` — systemd timer every minute on a small always-on droplet. @@ -67,7 +69,9 @@ Watch it with `journalctl -u omarchy-controller -f` on the box. - Publish is incremental and immutable: pull the channel db, refuse different bytes under an existing name, accept identical bytes, upload packages then signatures then the db. -- aarch64 under QEMU with credential-preserving binfmt. +- aarch64 under QEMU with credential-preserving binfmt. PR builds now run + aarch64 natively on `ubuntu-24.04-arm` (QEMU was ~30x slower); publish.yml + still builds under QEMU when a merged tree has no PR artifact. - Vouch gate: collaborators, `.github/VOUCHED.td`, or the `build-approved` label; denounced authors cannot be overridden by the label. - Tests run on PRs only; `result`, `self-tests`, `build-isolation` are the From ee001efd34df8f60714bf62529859db5cf97b302 Mon Sep 17 00:00:00 2001 From: Marcelo Alcantara Date: Mon, 28 Sep 2026 00:24:12 +1000 Subject: [PATCH 2/3] Build every aarch64 package natively Native pilots of the heavy packages fit the arm64 runner: linux-aurora 30 minutes, strata 17, obs-studio 7, with over 90 GB disk free throughout. --- .github/workflows/build-pr.yml | 7 +++---- ci/README.md | 3 +-- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index a8e25ace..827bf69f 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -162,10 +162,9 @@ jobs: if: needs.changes.outputs.count != '0' # The droplets are x86, so aarch64 there runs under QEMU, about 30x # slower: omarchy-mac-boot's check() took 2h47m of the 180 minutes. - # aarch64 builds natively on GitHub's arm64 runners (4 vCPU, 16 GB), - # except the packages listed here, which stay on the 32-vCPU droplets - # until a native build of each has been shown to fit. - runs-on: ${{ (matrix.arch == 'aarch64' && !contains(fromJSON('["linux-aurora","strata","obs-studio"]'), matrix.package)) && 'ubuntu-24.04-arm' || fromJSON('["self-hosted","omarchy-builder"]') }} + # GitHub's arm64 runners (4 vCPU, 16 GB; ~100 GB disk free in our pilots) + # build it natively in 11 minutes, and linux-aurora in 30 (72 under QEMU). + runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || fromJSON('["self-hosted","omarchy-builder"]') }} timeout-minutes: 180 strategy: fail-fast: false diff --git a/ci/README.md b/ci/README.md index 4efadf38..6d62b058 100644 --- a/ci/README.md +++ b/ci/README.md @@ -7,8 +7,7 @@ signing on merge exactly as before. - `.github/workflows/build-pr.yml` — on a PR touching `pkgbuilds/**`, one job per changed package on runners labelled `omarchy-builder`. aarch64 jobs - run on GitHub's native `ubuntu-24.04-arm` runners instead, except the few - heavy packages the workflow keeps on the droplets. Uploads the unsigned + run on GitHub's native `ubuntu-24.04-arm` runners instead. Uploads the unsigned `.pkg.tar.zst` as a workflow artifact (7 days). - `runner-cloud-init.yaml` — Ubuntu 24.04 user-data: docker + buildx, the GitHub runner registered `--ephemeral`, runs one job, powers off. From 2ff4dda4804f99b526cee605ce30e2bb5ec52260 Mon Sep 17 00:00:00 2001 From: Marcelo Alcantara Date: Mon, 28 Sep 2026 00:30:33 +1000 Subject: [PATCH 3/3] Match the runner comments to the measured times --- .github/workflows/build-pr.yml | 4 ++-- ci/README.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 827bf69f..d79b7bfb 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -160,8 +160,8 @@ jobs: build: needs: changes if: needs.changes.outputs.count != '0' - # The droplets are x86, so aarch64 there runs under QEMU, about 30x - # slower: omarchy-mac-boot's check() took 2h47m of the 180 minutes. + # The droplets are x86, so aarch64 there runs under QEMU: omarchy-mac-boot + # took 2h47m of the 180 minutes, most of it in check(). # GitHub's arm64 runners (4 vCPU, 16 GB; ~100 GB disk free in our pilots) # build it natively in 11 minutes, and linux-aurora in 30 (72 under QEMU). runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-24.04-arm' || fromJSON('["self-hosted","omarchy-builder"]') }} diff --git a/ci/README.md b/ci/README.md index 6d62b058..edb4f538 100644 --- a/ci/README.md +++ b/ci/README.md @@ -69,7 +69,7 @@ Watch it with `journalctl -u omarchy-controller -f` on the box. different bytes under an existing name, accept identical bytes, upload packages then signatures then the db. - aarch64 under QEMU with credential-preserving binfmt. PR builds now run - aarch64 natively on `ubuntu-24.04-arm` (QEMU was ~30x slower); publish.yml + aarch64 natively on `ubuntu-24.04-arm` (QEMU was up to ~15x slower); publish.yml still builds under QEMU when a merged tree has no PR artifact. - Vouch gate: collaborators, `.github/VOUCHED.td`, or the `build-approved` label; denounced authors cannot be overridden by the label.