ci: make Gitea primary Linux forge

.github/workflows/actions-security.yml

@@ -16,34 +16,6 @@ permissions:
   contents: read
 
 jobs:
-  actionlint:
-    name: actionlint
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: actionlint handwritten workflows
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
-        with:
-          files: >-
-            .github/workflows/actions-security.yml,
-            .github/workflows/ci.yml,
-            .github/workflows/interop-netem.yml,
-            .github/workflows/osv-scanner.yml,
-            .github/workflows/rust-clippy.yml,
-            .github/workflows/semver.yml,
-            .github/workflows/supply-chain.yml
-
-      - name: actionlint generated release workflow
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
-        with:
-          files: .github/workflows/irtt-rs-release.yml
-          shellcheck: false
   zizmor:
     name: zizmor
     runs-on: ubuntu-latest
@@ -60,7 +32,13 @@ jobs:
         with:
           persist-credentials: false
 
+      # Zizmor's SARIF integration publishes GitHub Code Scanning results.
+      # It remains here while portable actionlint runs with Gitea CI, but scans
+      # both workflow directories through its GitHub Actions rule set.
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           persona: regular
+          inputs: |
+            .github/workflows
+            .gitea/workflows

.github/workflows/ci-arm.yml

@@ -0,0 +1,80 @@
+name: Rust ARM CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  merge_group:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  verify:
+    name: cargo ${{ matrix.task }} (${{ matrix.target }})
+    # Gitea currently has only amd64 Linux runners; retain ARM coverage here.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - task: check
+            target: aarch64-unknown-linux-gnu
+            musl: false
+
+          - task: test
+            target: aarch64-unknown-linux-gnu
+            musl: false
+
+          - task: check
+            target: aarch64-unknown-linux-musl
+            musl: true
+
+          - task: test
+            target: aarch64-unknown-linux-musl
+            musl: true
+
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 25
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install musl toolchain
+        if: matrix.musl
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends musl-tools
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        with:
+          target: ${{ matrix.target }}
+          cache-key: ${{ matrix.task }}-${{ matrix.target }}
+
+      - name: Run ${{ matrix.task }} with all features
+        run: |
+          cargo ${{ matrix.task }} \
+            --workspace \
+            --all-targets \
+            --all-features \
+            --target ${{ matrix.target }} \
+            --locked
+
+      - name: Run ${{ matrix.task }} without default features
+        run: |
+          cargo ${{ matrix.task }} \
+            --workspace \
+            --all-targets \
+            --no-default-features \
+            --target ${{ matrix.target }} \
+            --locked

.github/workflows/ci.yml

@@ -1,185 +0,0 @@
-name: Rust CI
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  merge_group:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  fmt:
-    name: cargo fmt
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
-        with:
-          components: rustfmt
-          cache-key: fmt
-
-      - name: Check formatting
-        uses: actions-rust-lang/rustfmt@4066006ec54a31931b9b1fddfd38f2fdf2d27143 # v1
-
-  clippy:
-    name: cargo clippy
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
-        with:
-          components: clippy
-          cache-key: clippy
-
-      - name: Run clippy
-        run: |
-          cargo clippy \
-            --workspace \
-            --all-targets \
-            --all-features \
-            --locked \
-            -- -D warnings
-
-      - name: Run clippy without default features
-        run: |
-          cargo clippy \
-            --workspace \
-            --all-targets \
-            --no-default-features \
-            --locked \
-            -- -D warnings
-
-  verify:
-    name: cargo ${{ matrix.task }} (${{ matrix.target }})
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - task: check
-            runner: ubuntu-24.04
-            target: x86_64-unknown-linux-gnu
-            musl: false
-
-          - task: test
-            runner: ubuntu-24.04
-            target: x86_64-unknown-linux-gnu
-            musl: false
-
-          - task: check
-            runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            musl: true
-
-          - task: test
-            runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            musl: true
-
-          - task: check
-            runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-gnu
-            musl: false
-
-          - task: test
-            runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-gnu
-            musl: false
-
-          - task: check
-            runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            musl: true
-
-          - task: test
-            runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            musl: true
-
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 25
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: Install musl toolchain
-        if: matrix.musl
-        run: |
-          sudo apt-get update
-          sudo apt-get install --no-install-recommends musl-tools
-
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
-        with:
-          target: ${{ matrix.target }}
-          cache-key: ${{ matrix.task }}-${{ matrix.target }}
-
-      - name: Run ${{ matrix.task }} with all features
-        run: |
-          cargo ${{ matrix.task }} \
-            --workspace \
-            --all-targets \
-            --all-features \
-            --target ${{ matrix.target }} \
-            --locked
-
-      - name: Run ${{ matrix.task }} without default features
-        run: |
-          cargo ${{ matrix.task }} \
-            --workspace \
-            --all-targets \
-            --no-default-features \
-            --target ${{ matrix.target }} \
-            --locked
-
-  docs:
-    name: cargo doc
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    env:
-      RUSTDOCFLAGS: "-D warnings"
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
-        with:
-          cache-key: docs
-
-      - name: Check docs
-        run: |
-          cargo doc \
-            --workspace \
-            --all-features \
-            --no-deps \
-            --locked

.github/workflows/fuzz.yml

@@ -1,67 +0,0 @@
-name: Proto Fuzz Smoke
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-  # Pinned for reproducibility; bump deliberately alongside `fuzz/Cargo.lock`.
-  CARGO_FUZZ_VERSION: 0.13.1
-
-jobs:
-  fuzz-smoke:
-    name: cargo fuzz smoke
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: Install stable Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
-        with:
-          cache-key: fuzz
-
-      - name: Install nightly Rust toolchain
-        # Installed alongside, but deliberately not made the directory
-        # default: cargo-fuzz itself is built with the default stable
-        # toolchain below, and only `fuzz build`/`fuzz run` are run with
-        # `+nightly`. Building cargo-fuzz's own dependency tree under a
-        # nightly override can trip build scripts (e.g. rustix) that gate
-        # unstable internal attributes on detecting a nightly compiler.
-        run: rustup toolchain install nightly --profile minimal --no-self-update
-
-      - name: Install cargo-fuzz
-        run: cargo install cargo-fuzz --locked --version "${CARGO_FUZZ_VERSION}"
-
-      - name: Build all fuzz targets
-        run: cargo +nightly fuzz build
-        working-directory: fuzz
-
-      - name: Run bounded fuzz smoke for every target
-        # A single job building once and running each target sequentially
-        # avoids recompiling the fuzz workspace per target. Ten seconds per
-        # target is enough to catch a broken harness or an obvious
-        # regression; this is not meant to be exhaustive fuzzing.
-        run: |
-          set -euo pipefail
-          for target in decode_request decode_open_reply decode_echo_reply decode_params decode_varint; do
-            echo "::group::fuzz smoke: ${target}"
-            cargo +nightly fuzz run "${target}" -- \
-              -max_total_time=10 \
-              -timeout=5
-            echo "::endgroup::"
-          done
-        working-directory: fuzz

.github/workflows/interop-netem.yml

@@ -1,75 +0,0 @@
-name: Netem Interop
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-  GOBIN: ${{ github.workspace }}/.tools/bin
-  IRTT_UPSTREAM_VERSION: v0.9.1
-
-jobs:
-  netem:
-    name: netem interop
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
-        with:
-          cache-key: interop-netem
-
-      - name: Check host tools
-        run: |
-          ip -V
-          tc -V
-          go version
-
-      - name: Install upstream irtt
-        run: |
-          mkdir -p "$GOBIN"
-          go install "github.com/heistp/irtt/cmd/irtt@${IRTT_UPSTREAM_VERSION}"
-          "$GOBIN/irtt" version
-
-      - name: Build irtt-rs client
-        run: cargo build -p irtt-rs --bin irtt-client --locked
-
-      - name: Run netem interop comparisons
-        run: |
-          python3 scripts/run_netem_interop_ci.py \
-            --all \
-            --skip-build \
-            --upstream-irtt "$GOBIN/irtt" \
-            --irtt-rs-command "$PWD/target/debug/irtt-client"
-
-      - name: Append netem interop summary
-        if: always()
-        run: |
-          latest_summary="$(find target/interop-netem -mindepth 2 -maxdepth 2 -name github-step-summary.md -type f -print 2>/dev/null | sort | tail -n 1)"
-          if [ -n "$latest_summary" ]; then
-            cat "$latest_summary" >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "No netem interop github-step-summary.md found." >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-      - name: Upload netem interop artifacts
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: interop-netem
-          path: target/interop-netem

.github/workflows/semver.yml

@@ -1,31 +0,0 @@
-name: Semver
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - "irtt-proto/v*.*.*"
-      - "irtt-client/v*.*.*"
-      - "irtt-server/v*.*.*"
-      - "irtt-stats/v*.*.*"
-      - "irtt-rs/v*.*.*"
-
-permissions:
-  contents: read
-
-jobs:
-  semver:
-    name: cargo-semver-checks
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: Check semver compatibility
-        uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2
-        with:
-          feature-group: all-features

.github/workflows/supply-chain.yml

@@ -1,79 +0,0 @@
-name: Supply chain
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  merge_group:
-  schedule:
-    - cron: "41 2 * * 1"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  cargo-deny:
-    name: cargo-deny ${{ matrix.checks }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # Advisories can appear after code was merged. Keep this visible,
-          # but don't let a surprise upstream advisory nuke every unrelated PR.
-          - checks: advisories
-            continue-on-error: true
-
-          # These are policy choices in this repo. They should block PRs.
-          - checks: bans licenses sources
-            continue-on-error: false
-
-    continue-on-error: ${{ matrix.continue-on-error }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: Run cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
-        with:
-          command: check
-          arguments: --all-features
-          command-arguments: ${{ matrix.checks }}
-
-  actionlint:
-    name: actionlint
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-
-      - name: actionlint handwritten workflows
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
-        with:
-          files: >-
-            .github/workflows/actions-security.yml,
-            .github/workflows/ci.yml,
-            .github/workflows/interop-netem.yml,
-            .github/workflows/osv-scanner.yml,
-            .github/workflows/rust-clippy.yml,
-            .github/workflows/semver.yml,
-            .github/workflows/supply-chain.yml
-
-      - name: actionlint generated release workflow
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
-        with:
-          files: .github/workflows/irtt-rs-release.yml
-          shellcheck: false