# Migration validation — 2026-10-10

Inspected the original Jenkinsfile, Dockerfile, downstream `sqm-autorate-rust`
workflows and package Makefile, Terraform runner definition, and live TheBeast
runner configuration before changing the repository.

## Passed

- YAML parsing; TOML parsing; `sh -n`; ShellCheck; `git diff --check`.
- actionlint 1.7.12, excluding only its unsupported `builtin:checkout` action
  syntax. The workflow uses the existing `ubuntu-latest` label. Gitea's documentation and the
  existing downstream workflow confirm built-in checkout support.
- Default matrix resolves six entries for stable 25.12.5 and oldstable 24.10.8.
  `targets=all` ran upstream target discovery inside the actual job image and
  resolved 194 entries. Empty/invalid targets fail. Every default base-image
  tag was read successfully from GHCR.
- Docker Compose configuration accepted; Redis healthy with its named volume,
  AOF enabled and successful AOF writes. Service and bounded builder were
  provisioned on TheBeast without changing the runner configuration.
- Builder inspected: eight-CPU quota, 20 GiB memory/swap limit, one BuildKit
  worker step, 50 GiB layer GC budget. A second disposable job container with
  fresh Docker client configuration reused the existing daemon and builder.
- Dockerfile build checks completed. Two expected advisory warnings: mandatory
  base-image arguments have no defaults, and Docker's secret-name heuristic
  mistakes the public `SCCACHE_REDIS_KEY_PREFIX` for a secret.
- `configured` Dockerfile stage built for x86/64 on both OpenWrt releases.
  Pinned feeds select Rust 1.94.0 on 25.12.5 and 1.90.0 on 24.10.8. Both retain
  `CONFIG_RUST_SCCACHE=y` through defconfig and contain the explicit bootstrap
  `build.ccache=sccache` setting with LLVM CI downloads disabled.
- Actual OpenWrt make-variable expansion injects sccache into host and package
  compilation, despite unexporting an inherited wrapper.
- Real Cargo library compilation in Docker BuildKit: one Redis miss. A fresh
  runtime container using the Docker-network endpoint: one hit, zero misses.
- Recreated the newly provisioned Redis container using the same named volume;
  a fresh compiler container still recorded one hit, zero misses. No existing
  infrastructure containers were restarted.
- Same source/cache namespace with GNU versus musl target: first musl build
  missed; repetition hit. Rust 1.90.0 versus 1.91.0: first 1.91 build missed;
  repetition hit. All probes reported zero cache read/write errors.
- A disposable OpenWrt package used the real `Build/Compile/Cargo` helper,
  SDK GCC/musl linker, OpenWrt LTO/optimization flags and a local Rust library
  dependency. It built successfully in two separate containers: one dependency
  miss, then one hit. The linked executable correctly remained non-cacheable.
  This used a prebuilt Rust 1.90 toolchain for the probe, not a freshly compiled
  SDK toolchain; it is not a full SDK/source-bootstrap acceptance result.
- Retained `ci/verify-cache.sh` passed its separate-container miss/hit checks
  against that prebuilt validation toolchain. Its original hardcoded SDK rustc
  path was later corrected after the live mediatek/filogic build exposed the
  target-specific staging layout; see the follow-up below.
- Publication configuration checked: original Docker Hub namespace/tag format,
  verification before push, explicit publish input, temporary credential
  directory, no automatic publication trigger. No registry login or push was
  attempted.

## Remaining acceptance

1. Enable repository Actions and configure the two Docker Hub secrets. No
   runner configuration changes are required.
2. Complete a non-publishing Gitea dispatch for the full default matrix.
   The mediatek/filogic 24.10.8 job completed Rust source bootstrap and image
   export; its corrected verification passed on the built image. Acceptance
   for the other combinations remains pending.
3. With explicit publication approval, run the publishing dispatch, pull the
   resulting tags and build the downstream OpenWrt package with the new image.
   Actual Docker Hub authorization and publication remain unverified.
4. After acceptance, disable the old Jenkins job and remove `Jenkinsfile`.
   It is deliberately retained until the replacement passes these checks.

Remote test logs and disposable probe sources are under
`/tmp/openwrt-sdk-rust-migration` in TheBeast's `gitea-runner` instance. The
Redis volume/service and BuildKit builder remain available for the replacement
pipeline; no cache volume or existing infrastructure was deleted.

## Follow-up: mediatek/filogic 24.10.8 verification

The supplied job 1602 log shows full SDK compilation and image export completed
successfully. Verification failed with exit 127 because it assumed
`staging_dir/host/bin/rustc`. Inspection of that exact built image reproduced
the failure and located Rust/Cargo in
`staging_dir/target-aarch64_cortex-a53_musl/host/bin` instead. Both the workflow
and retained cache probe now resolve the unique executable compiler from the
SDK staging tree, rather than assuming a shared host directory.

Reran the corrected verification on that image: Rust 1.90.0 and Cargo 1.90.0
execute successfully. The retained cache probe reports one Redis miss in its
first container and one hit in a fresh second container, with zero cache
read/write errors. ShellCheck, actionlint (excluding only Gitea's built-in
checkout syntax), and `git diff --check` pass. No rebuild or publication was
performed for this fix.