feat: establish standalone Argand Site Registry

.forgejo/workflows/ci.yml

@@ -0,0 +1,58 @@
+name: Standalone registry checks
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+
+jobs:
+  check:
+    # Register this label only on a disposable isolated runner. Never use an
+    # Argand production/host runner. Prerequisites are in docs/RELEASING.md.
+    runs-on: site-registry-isolated
+    timeout-minutes: 30
+    env:
+      REGISTRY_REPOSITORY_URL: ${{ forgejo.server_url }}/${{ forgejo.repository }}.git
+      REGISTRY_REVISION: ${{ forgejo.sha }}
+      CARGO_BUILD_JOBS: '2'
+      CARGO_TERM_COLOR: never
+      RUSTC_WRAPPER: ''
+    steps:
+      - name: Fetch the exact public source revision without credentials
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$REGISTRY_REVISION" =~ ^[0-9a-f]{40}$ ]]
+          mkdir checkout
+          cd checkout
+          git init --initial-branch=main
+          git remote add origin "$REGISTRY_REPOSITORY_URL"
+          git fetch --depth=1 origin "$REGISTRY_REVISION"
+          git checkout --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$REGISTRY_REVISION"
+      - name: Fetch locked build dependencies and run offline acceptance
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd checkout
+          export CARGO_TARGET_DIR="$PWD/target"
+          export CARGO_BUILD_BUILD_DIR="$PWD/build"
+          cargo fetch --locked
+          bash scripts/check.sh
+      - name: Verify deterministic source packaging and rebuild the archive
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd checkout
+          python3 scripts/source_release.py create --output ../source-release-a > ../release-a.json
+          python3 scripts/source_release.py create --output ../source-release-b > ../release-b.json
+          cmp ../source-release-a/source.tar.gz ../source-release-b/source.tar.gz
+          cmp ../source-release-a/RELEASE.json ../source-release-b/RELEASE.json
+          registry_pin="$(python3 -c 'import json; print(json.load(open("../release-a.json"))["pin"])')"
+          python3 scripts/source_release.py verify --release ../source-release-a --pin "$registry_pin"
+          mkdir ../unpacked
+          tar -xzf ../source-release-a/source.tar.gz -C ../unpacked
+          registry_prefix="$(python3 -c 'import json; print(json.load(open("../source-release-a/RELEASE.json"))["prefix"])')"
+          cd "../unpacked/$registry_prefix"
+          export CARGO_TARGET_DIR="$PWD/target"
+          export CARGO_BUILD_BUILD_DIR="$PWD/build"
+          bash scripts/check.sh