BFE EngineeringandClaude Fable 5
5155224594
Preparing the repo to go public (ADR-0007): - CI: kernel-build moves from the self-hosted runner to ubuntu-latest (installs its own cross toolchain + qemu, caches the pristine tarball). On a public repo a registered self-hosted runner is reachable from approved fork-PR workflows — i.e. arbitrary code on private infrastructure — and the build never actually needed the SDK host. ADR-0004 marked superseded-in-part; docs/ci-cd.md rewritten (site specifics now live only in the private deployment log). - Licensing: LICENSE gains the GPL-2.0 carve-out for patches/ and the kernel source excerpts (Linux derivatives; per-driver provenance was already tracked in PROVENANCE.md); patches/README.md states it too. - Scrubbed from the tip: bench-unit dev credentials and its gadget IP (m2-boot notes), the site AP SSID+BSSID and a neighboring AP's BSSID and the device WLAN MAC (wifi bring-up evidence — BSSIDs are geolocatable), the runner mesh IP. NOTE: these remain in git history; decision on a pre-publication history rewrite is separate. - Emoji cleanup across 21 tracked files (kernel port docs, review report, enforce-mcdc.sh) per repo text conventions: status marks became [x]/[wip]/[ ]/OK plain text. - "[maintainer]-gated" process phrasing normalized to "maintainer-gated" (attributions in dated evidence docs kept). Verified: zero emojis tracked; scrub grep clean; patches carry no internal references; ci.yml parses; shellcheck unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
2.1 KiB
2.1 KiB
ADR 0007 — Public repo: kernel-build moves to GitHub-hosted runners
Status: Accepted (2026-08-30). Supersedes the runner half of ADR-0004.
Context
The repo is going public (free Actions minutes for hosted runners; open-source alignment with the stack philosophy). Two facts change the ADR-0004 calculus:
- A self-hosted runner on a public repo is a standing hazard. A fork PR can modify workflow files; once any run of theirs is approved, workflows can target the repo's registered self-hosted runners — i.e. arbitrary code on the private host, which also serves production. GitHub's own guidance is to never attach self-hosted runners to public repos, and personal-account repos have no runner groups to scope the risk away.
- The build never needed the SDK host. ADR-0004's premise ("needs the SDK
toolchain and Buildroot's baked-in absolute paths") does not apply to
kernel-build: the hermetic build is freestanding, uses Debian'sgcc-arm-linux-gnueabihf, and self-provisionspython. It fits a hosted runner (4 vCPU / 16 GB), and public-repo minutes are free.
Decision
kernel-build runs on ubuntu-latest, apt-installing its toolchain, kernel
build deps, and qemu-system-arm, with the pristine tarball cached like
patches-apply does. It stays workflow_dispatch-only for now (a full build
per push is still noisy; flipping it to push-on-main later is one line). The
warden-sdk self-hosted runner instance is deregistered from this repo
before it goes public; the flare and flare-edge runner instances on the same
host are unaffected (those repos stay private).
Consequences
- No path from public workflows to private infrastructure; nothing to babysit in fork-PR approval settings beyond GitHub's defaults (still set "require approval for all outside contributors" as belt-and-braces).
- Kernel artifacts no longer persist on the runner host; the GitHub artifact (5-day retention + prune job) is the only build output channel.
- Hosted kernel builds are slower than the 0640 box but free and parallel; the boot-smoke step rides along unchanged.