ci: move to bladerunner infra with microVMs

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+self-hosted-runner:
+  labels:
+    - bladerunner-macos
+    - bladerunner-linux

.github/actions/linux-android-toolchain/action.yml

@@ -0,0 +1,46 @@
+name: linux-android-toolchain
+description: >-
+  Toolchain for the Android jobs on bladerunner Linux: JDK, Android
+  SDK/NDK, Go, Node/yarn, Gradle via the repo wrapper, and the
+  patch-node-modules helper. 
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-java@v5
+      with:
+        distribution: temurin
+        java-version: '17'
+
+    - uses: android-actions/setup-android@v3
+      with:
+        packages: 'platform-tools platforms;android-36 build-tools;36.0.0 ndk;27.1.12297006'
+
+    - uses: actions/setup-go@v5
+      with:
+        go-version: '1.25'
+        cache: false
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+
+    - name: Enable corepack (yarn version from package.json#packageManager)
+      shell: bash
+      run: corepack enable
+
+    - name: Export NDK, Gradle wrapper, patch-node-modules
+      shell: bash
+      run: |
+        echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/27.1.12297006" >> "$GITHUB_ENV"
+        echo "ANDROID_NDK_ROOT=$ANDROID_HOME/ndk/27.1.12297006" >> "$GITHUB_ENV"
+        echo "GRADLE=./gradlew" >> "$GITHUB_ENV"
+
+        venv="$HOME/.cache/syncup-fdroid-venv"
+        [ -x "$venv/bin/python" ] || python3 -m venv "$venv"
+        "$venv/bin/pip" install --quiet fdroidserver
+        mkdir -p "$RUNNER_TEMP/bin"
+        printf '#!/bin/sh\nexec "%s/bin/python" "%s/nix/patch-node-modules.py" "$@"\n' \
+          "$venv" "$GITHUB_WORKSPACE" > "$RUNNER_TEMP/bin/patch-node-modules"
+        chmod +x "$RUNNER_TEMP/bin/patch-node-modules"
+        echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

.github/actions/macos-toolchain/action.yml

@@ -0,0 +1,29 @@
+name: macos-toolchain
+description: >-
+  Toolchain for the iOS jobs on bladerunner macOS: Go, Node/yarn,
+  and CocoaPods + fastlane from the repo Gemfile as ./bin binstubs. Xcode and
+  a ruby >= 3.2.
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-go@v5
+      with:
+        go-version: '1.25'
+        cache: false
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+
+    - name: Enable corepack (yarn version from package.json#packageManager)
+      shell: bash
+      run: corepack enable
+
+    - name: Install gems (CocoaPods, fastlane)
+      shell: bash
+      run: |
+        bundle config set --local path "$HOME/.cache/syncup-bundle"
+        bundle install
+        bundle binstubs cocoapods fastlane --force
+        echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH"

.github/workflows/ci.yml

@@ -11,14 +11,13 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  NODE_VERSION: '20'
-  GO_VERSION: '1.25'
-  JAVA_VERSION: '17'
+  SYSTEM: '1'
+  DEVELOPER_DIR: ${{ vars.XCODE_DEVELOPER_DIR || '/Applications/Xcode.app/Contents/Developer' }}
 
 jobs:
   lint-and-typecheck:
     name: lint + typecheck + go vet
-    runs-on: [self-hosted, linux]
+    runs-on: bladerunner-linux
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
@@ -31,20 +30,15 @@ jobs:
   android:
     name: android build
     if: github.event_name == 'push'
-    runs-on: [self-hosted, linux]
+    runs-on: bladerunner-linux
     needs: lint-and-typecheck
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
 
-      # Nix (via flake.nix) provides Go, Node/corepack, JDK, Gradle, gomake.
-      # Android SDK/NDK are not in the flake — install them here.
-      - name: Set up Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          packages: 'tools platform-tools platforms;android-36 build-tools;36.0.0 ndk;27.1.12297006'
+      - uses: ./.github/actions/linux-android-toolchain
 
-      - name: Build Android APK (via nix)
+      - name: Build Android APK
         run: make android
 
       - name: Upload APK
@@ -64,12 +58,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Nix provides Go, Node, CocoaPods, etc. via flake.nix.
-      # Xcode must be pre-installed on the runner.
+      - uses: ./.github/actions/macos-toolchain
+
       - name: Clean stale build state
         run: make clean
 
-      - name: Build iOS app (via nix)
+      - name: Build iOS app
         run: make ios
 
       - name: Upload simulator app

.github/workflows/release-android.yml

@@ -12,25 +12,25 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  SYSTEM: '1'
+
 jobs:
   # Open PRs: build an APK with .pr applicationId suffix, upload to appdrop, comment QR.
   pr-build:
     name: pr build + appdrop upload
     if: >-
       github.event_name == 'pull_request' &&
       github.event.action != 'closed'
-    runs-on: [self-hosted, linux]
+    runs-on: bladerunner-linux
     timeout-minutes: 45
     permissions:
       contents: read
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          packages: 'tools platform-tools platforms;android-36 build-tools;36.0.0 ndk;27.1.12297006'
+      - uses: ./.github/actions/linux-android-toolchain
 
       - name: Decode release keystore
         run: echo "${{ secrets.RELEASE_KEYSTORE_BASE64 }}" | base64 -d > /tmp/release.keystore
@@ -47,8 +47,6 @@ jobs:
           RELEASE_KEYSTORE_PASSWORD: ${{ secrets.RELEASE_KEYSTORE_PASSWORD }}
           RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
           RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
-          ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.1.12297006
-          ANDROID_NDK_ROOT: ${{ env.ANDROID_HOME }}/ndk/27.1.12297006
           FDROID_VERSION_CODE: ${{ github.run_number }}
 
       - name: Upload APK to appdrop.sh
@@ -114,7 +112,7 @@ jobs:
       github.event_name == 'push' ||
       (github.event.pull_request.merged == true &&
        startsWith(github.event.pull_request.head.ref, 'release/'))
-    runs-on: [self-hosted, linux]
+    runs-on: bladerunner-linux
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
@@ -126,7 +124,7 @@ jobs:
 
   build-apk:
     name: build ${{ matrix.abi }}
-    runs-on: [self-hosted, linux]
+    runs-on: bladerunner-linux
     needs: lint-and-typecheck
     timeout-minutes: 45
     strategy:
@@ -142,12 +140,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Nix (via flake.nix) provides Go, Node/corepack, JDK, Gradle, gomobile.
-      # Android SDK/NDK are not in the flake — install them here.
-      - name: Set up Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          packages: 'tools platform-tools platforms;android-36 build-tools;36.0.0 ndk;27.1.12297006'
+      - uses: ./.github/actions/linux-android-toolchain
 
       - name: Decode release keystore
         run: echo "${{ secrets.RELEASE_KEYSTORE_BASE64 }}" | base64 -d > /tmp/release.keystore
@@ -176,8 +169,6 @@ jobs:
           RELEASE_KEYSTORE_PASSWORD: ${{ secrets.RELEASE_KEYSTORE_PASSWORD }}
           RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
           RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
-          ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.1.12297006
-          ANDROID_NDK_ROOT: ${{ env.ANDROID_HOME }}/ndk/27.1.12297006
 
       - name: Extract versionCode
         if: matrix.abi == 'arm64-v8a'

.github/workflows/release-ios.yml

@@ -12,9 +12,8 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  # Override per-runner via repo variable XCODE_DEVELOPER_DIR if needed.
-  # The default matches GitHub-hosted macOS runners' xcode-select target.
-  XCODE_DEVELOPER_DIR: ${{ vars.XCODE_DEVELOPER_DIR || '/Applications/Xcode.app/Contents/Developer' }}
+  DEVELOPER_DIR: ${{ vars.XCODE_DEVELOPER_DIR || '/Applications/Xcode.app/Contents/Developer' }}
+  SYSTEM: '1'
 
 jobs:
   # PR builds: signed .pr IPA uploaded to appdrop.sh, install link posted back to the PR.
@@ -29,23 +28,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Select Xcode
-        run: |
-          if [ ! -d "$XCODE_DEVELOPER_DIR" ]; then
-            echo "::error::XCODE_DEVELOPER_DIR=$XCODE_DEVELOPER_DIR does not exist on this runner."
-            echo "Set the XCODE_DEVELOPER_DIR repo variable to a valid Xcode Developer dir."
-            exit 1
-          fi
-          echo "DEVELOPER_DIR=$XCODE_DEVELOPER_DIR" >> "$GITHUB_ENV"
-          echo "Selected Xcode at: $XCODE_DEVELOPER_DIR"
-          DEVELOPER_DIR=$XCODE_DEVELOPER_DIR xcodebuild -version
+      - uses: ./.github/actions/macos-toolchain
 
       - name: Scrub global Xcode caches
         run: |
-          # make clean only wipes mobile-app/ios/build & Pods. Stale state in
-          # ~/Library leaks across runs and is the textbook cause of "module X
-          # in precompiled file but not in any loaded module map file" errors
-          # (this build works locally where these dirs are empty).
           rm -rf "$HOME/Library/Developer/Xcode/DerivedData"
           rm -rf "$HOME/Library/Developer/Xcode/Archives/$(date +%Y-%m-%d)"
           rm -rf "$HOME/Library/Caches/com.apple.dt.Xcode"
@@ -58,7 +44,6 @@ jobs:
         env:
           MATCH_DEPLOY_KEY: ${{ secrets.MATCH_DEPLOY_KEY }}
         run: |
-          # Per-workspace key so we don't touch the runner's global ~/.ssh state.
           KEY="$RUNNER_TEMP/match_key"
           printf '%s\n' "$MATCH_DEPLOY_KEY" > "$KEY"
           chmod 600 "$KEY"
@@ -78,6 +63,15 @@ jobs:
           FASTLANE_SKIP_UPDATE_CHECK: '1'
         run: make ios-pr
 
+      - name: Upload raw xcodebuild log
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: xcodebuild-archive-log-pr-${{ github.run_id }}
+          path: mobile-app/ios/build/xcodebuild-archive.log
+          if-no-files-found: ignore
+          retention-days: 7
+
       - name: Upload IPA to appdrop.sh
         id: appdrop
         env:
@@ -146,16 +140,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Select Xcode
-        run: |
-          if [ ! -d "$XCODE_DEVELOPER_DIR" ]; then
-            echo "::error::XCODE_DEVELOPER_DIR=$XCODE_DEVELOPER_DIR does not exist on this runner."
-            echo "Set the XCODE_DEVELOPER_DIR repo variable to a valid Xcode Developer dir."
-            exit 1
-          fi
-          echo "DEVELOPER_DIR=$XCODE_DEVELOPER_DIR" >> "$GITHUB_ENV"
-          echo "Selected Xcode at: $XCODE_DEVELOPER_DIR"
-          DEVELOPER_DIR=$XCODE_DEVELOPER_DIR xcodebuild -version
+      - uses: ./.github/actions/macos-toolchain
 
       - name: Scrub global Xcode caches
         run: |
@@ -190,6 +175,15 @@ jobs:
           FASTLANE_SKIP_UPDATE_CHECK: '1'
         run: make ios-release
 
+      - name: Upload raw xcodebuild log
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: xcodebuild-archive-log-release-${{ github.run_id }}
+          path: mobile-app/ios/build/xcodebuild-archive.log
+          if-no-files-found: ignore
+          retention-days: 7
+
       - name: Upload IPA artifact
         uses: actions/upload-artifact@v4
         with:

.gitignore

@@ -42,6 +42,10 @@ yarn-error.*
 /mobile-app/ios/.xcode.env.local
 /mobile-app/ios/Frameworks/
 
+# Ruby (bundler binstubs + local config; see Gemfile)
+/bin/
+/.bundle/
+
 # Fastlane
 /fastlane/report.xml
 /fastlane/README.md

Gemfile

@@ -0,0 +1,5 @@
+source "https://rubygems.org"
+
+gem "cocoapods", "~> 1.17"
+gem "fastlane", "~> 2.228"
+gem "json", "< 3"