.gitea/workflows/agents.yml

@@ -0,0 +1,49 @@
+name: Agents
+run-name: >-
+  AI bot at
+  #${{ gitea.event.issue.number || gitea.event.pull_request.number }}
+
+on:
+  issues:
+    types: [opened]
+  pull_request:
+    types: [opened, review_requested]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+# New human events replace stale runs for the same work item. AI-bot comments
+# get unique groups so their skipped workflows cannot cancel an active login.
+concurrency:
+  group: >-
+    agents-${{ gitea.event.sender.login == 'bot' && gitea.run_id ||
+    gitea.event.issue.number || gitea.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  bot:
+    # Nothing the bot account posts can start a run, so it cannot trigger itself.
+    if: >
+      gitea.event.sender.login != 'bot' &&
+      ((gitea.event_name == 'issues' &&
+      contains(gitea.event.issue.body, '@bot')) ||
+      (gitea.event_name == 'pull_request' &&
+      ((gitea.event.action == 'opened' &&
+      contains(gitea.event.pull_request.body, '@bot')) ||
+      gitea.event.requested_reviewer.login == 'bot')) ||
+      (gitea.event_name == 'issue_comment' &&
+      contains(gitea.event.comment.body, '@bot')) ||
+      (gitea.event_name == 'pull_request_review_comment' &&
+      contains(gitea.event.review.content, '@bot')))
+    runs-on: self-hosted
+    container:
+      volumes:
+        - bot-home:/root
+    steps:
+      - name: Run AI bot
+        # Intentionally follow protected main so centrally managed profiles and
+        # quota fallbacks update without per-repository credential changes.
+        uses: https://git.capsulizers.com/commons/bot-agents@main
+        with:
+          master-key: ${{ secrets.BOT_AGENTS_MASTER_KEY }}

.gitea/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  checks:
+    runs-on: self-hosted
+    container:
+      volumes:
+        - memona-plugin-target:/cargo-target
+    env:
+      CARGO_BUILD_JOBS: 2
+      CARGO_TARGET_DIR: /cargo-target/serialized
+      CARGO_HOME: /cargo-target/cargo-home
+      RUSTUP_HOME: /cargo-target/rustup-home
+      RUSTUP_TOOLCHAIN: stable
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install system packages
+        run: >-
+          apt-get update && apt-get install -y --no-install-recommends
+          build-essential ca-certificates curl util-linux
+
+      # The same lock protects the shared toolchain and every Cargo command.
+      # Keep its target and lock paths in sync with Memona's plugin checks.
+      - name: Check and build plugin
+        run: |
+          flock --no-fork "$CARGO_TARGET_DIR.lock" sh -ec '
+            export PATH="$CARGO_HOME/bin:$PATH"
+            if [ ! -x "$CARGO_HOME/bin/rustup" ]; then
+              mkdir -p "$CARGO_HOME"
+              curl --proto =https --tlsv1.2 -fsSL https://sh.rustup.rs -o "$CARGO_HOME/rustup-init.sh"
+              sh "$CARGO_HOME/rustup-init.sh" -y --no-modify-path --default-toolchain none
+              rm "$CARGO_HOME/rustup-init.sh"
+            fi
+            rustup toolchain install stable --profile minimal --component clippy,rustfmt --target wasm32-wasip2 --no-self-update
+            cargo fmt --check
+            cargo clippy --locked --all-targets -- -D warnings
+            cargo test --locked --lib
+            cargo build --locked --release --target wasm32-wasip2
+          '