Migrate GitHub Actions to self-hosted Mac mini runners

.github/scripts/colima-stage.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Print a Colima-visible scratch directory under $HOME.
+# Colima's default virtiofs mount is the runner user home, not /opt/github-runners.
+set -eu
+
+if [ -z "${HOME:-}" ]; then
+  echo "colima-stage.sh: HOME must be set" >&2
+  exit 1
+fi
+
+id="${GITHUB_RUN_ID:-local}-${GITHUB_JOB:-job}-$$"
+dir="$HOME/.bloxwap-ci/$id"
+mkdir -p "$dir"
+printf '%s\n' "$dir"

.github/scripts/ensure-colima.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Start Colima when needed and point Docker at its socket. No sudo, no apt.
+set -eu
+
+if ! command -v colima >/dev/null 2>&1; then
+  echo "ensure-colima.sh: colima is required on this runner" >&2
+  exit 1
+fi
+if ! command -v docker >/dev/null 2>&1; then
+  echo "ensure-colima.sh: docker CLI is required on this runner" >&2
+  exit 1
+fi
+
+colima status || colima start
+
+if ! docker info >/dev/null 2>&1; then
+  sock="${HOME}/.colima/default/docker.sock"
+  if [ -S "$sock" ]; then
+    DOCKER_HOST="unix://$sock"
+    export DOCKER_HOST
+    if [ -n "${GITHUB_ENV:-}" ]; then
+      echo "DOCKER_HOST=$DOCKER_HOST" >> "$GITHUB_ENV"
+    fi
+  fi
+fi
+
+docker info >/dev/null

.github/scripts/ensure-gnu-tar.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+# actions/upload-pages-artifact requires GNU tar as `gtar` on macOS.
+set -eu
+
+add_brew_path() {
+  if [ -x /opt/homebrew/bin/brew ]; then
+    eval "$(/opt/homebrew/bin/brew shellenv)"
+    if [ -n "${GITHUB_PATH:-}" ]; then
+      echo /opt/homebrew/bin >> "$GITHUB_PATH"
+    fi
+  elif [ -x /usr/local/bin/brew ]; then
+    eval "$(/usr/local/bin/brew shellenv)"
+    if [ -n "${GITHUB_PATH:-}" ]; then
+      echo /usr/local/bin >> "$GITHUB_PATH"
+    fi
+  fi
+}
+
+add_brew_path
+
+if command -v gtar >/dev/null 2>&1; then
+  exit 0
+fi
+
+if ! command -v brew >/dev/null 2>&1; then
+  echo "Missing GNU tar (gtar)." >&2
+  echo "Install Homebrew on this Mac mini, then: brew install gnu-tar" >&2
+  echo "actions/upload-pages-artifact requires gtar on self-hosted macOS." >&2
+  exit 1
+fi
+
+brew list gnu-tar >/dev/null 2>&1 || brew install gnu-tar
+add_brew_path
+
+if ! command -v gtar >/dev/null 2>&1; then
+  echo "brew install gnu-tar did not put gtar on PATH" >&2
+  exit 1
+fi

.github/scripts/fetch-linux-bun.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+# Download a Linux Bun binary into $RUNNER_TEMP and print its directory.
+# Usage: fetch-linux-bun.sh <x64|aarch64>
+set -eu
+
+arch=${1:-}
+version=${BUN_VERSION:-1.3.10}
+
+case "$arch" in
+  x64 | amd64 | x86_64) asset=bun-linux-x64 ;;
+  aarch64 | arm64) asset=bun-linux-aarch64 ;;
+  *)
+    echo "usage: fetch-linux-bun.sh <x64|aarch64>" >&2
+    exit 2
+    ;;
+esac
+
+if [ -z "${RUNNER_TEMP:-}" ]; then
+  echo "fetch-linux-bun.sh: RUNNER_TEMP must be set" >&2
+  exit 1
+fi
+
+dest="$RUNNER_TEMP/$asset"
+mkdir -p "$dest"
+
+if [ ! -x "$dest/bun" ]; then
+  zip="$RUNNER_TEMP/$asset.zip"
+  curl -fsSL -o "$zip" \
+    "https://github.com/oven-sh/bun/releases/download/bun-v${version}/${asset}.zip"
+  extract="$RUNNER_TEMP/extract-$asset"
+  mkdir -p "$extract"
+  unzip -o "$zip" -d "$extract" >/dev/null
+  if [ -f "$extract/$asset/bun" ]; then
+    mv "$extract/$asset/bun" "$dest/bun"
+  elif [ -f "$extract/bun" ]; then
+    mv "$extract/bun" "$dest/bun"
+  else
+    echo "fetch-linux-bun.sh: bun executable not found in $asset.zip" >&2
+    exit 1
+  fi
+  chmod +x "$dest/bun"
+fi
+
+printf '%s\n' "$dest"

.github/scripts/linux-run.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+# Run a command in a Linux container via Colima.
+# Usage: linux-run.sh <platform> <image> <command> [args...]
+# Mounts LINUX_HOST_DIR (must live under $HOME so Colima virtiofs can see it) at /work.
+set -eu
+
+usage() {
+  echo "usage: linux-run.sh <platform> <image> <command> [args...]" >&2
+  exit 2
+}
+
+[ "$#" -ge 3 ] || usage
+
+platform=$1
+image=$2
+shift 2
+
+if [ -z "${LINUX_HOST_DIR:-}" ]; then
+  echo "linux-run.sh: LINUX_HOST_DIR must be a Colima-visible host directory" >&2
+  exit 1
+fi
+
+script_dir=$(CDPATH= cd -- "$(dirname "$0")" && pwd)
+# shellcheck disable=SC1091
+. "$script_dir/ensure-colima.sh"
+
+mkdir -p "$LINUX_HOST_DIR/tmp" "$LINUX_HOST_DIR/home"
+
+envfile="$LINUX_HOST_DIR/linux-run.env"
+: > "$envfile"
+[ -n "${BLOXWAP_SMOKE_BUN:-}" ] && printf 'BLOXWAP_SMOKE_BUN=%s\n' "$BLOXWAP_SMOKE_BUN" >> "$envfile"
+[ -n "${BLOXWAP_SMOKE_TARBALL:-}" ] && printf 'BLOXWAP_SMOKE_TARBALL=%s\n' "$BLOXWAP_SMOKE_TARBALL" >> "$envfile"
+[ -n "${BLOXWAP_SMOKE_REGISTRY:-}" ] && printf 'BLOXWAP_SMOKE_REGISTRY=%s\n' "$BLOXWAP_SMOKE_REGISTRY" >> "$envfile"
+
+path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+if [ -x "$LINUX_HOST_DIR/bun/bun" ]; then
+  path="/work/bun:$path"
+fi
+
+exec docker run --rm \
+  --platform "$platform" \
+  --env-file "$envfile" \
+  -e TMPDIR=/work/tmp \
+  -e HOME=/work/home \
+  -e RUNNER_TEMP=/work/tmp \
+  -e npm_config_cache=/work/tmp/npm-cache \
+  -e npm_config_update_notifier=false \
+  -e PATH="$path" \
+  -v "$LINUX_HOST_DIR:/work" \
+  -w /work \
+  "$image" \
+  "$@"

.github/workflows/ci.yml

@@ -5,7 +5,7 @@ on:
   pull_request:
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.github/workflows/docs.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64]
     env:
       NEXT_PUBLIC_BASE_PATH: /agent-cli
       NEXT_PUBLIC_SITE_URL: https://bloxwap.github.io
@@ -42,16 +42,18 @@ jobs:
           sparse-checkout: scripts/drift.mjs
           sparse-checkout-cone-mode: false
       - run: node .hig/scripts/drift.mjs --root . --config hig-drift.json
-      - run: npx playwright install --with-deps chromium
+      - run: npx playwright install chromium
       - run: npm run docs:smoke
+      - name: Ensure GNU tar
+        run: .github/scripts/ensure-gnu-tar.sh
       - uses: actions/upload-pages-artifact@v5
         with:
           path: apps/docs/out
 
   deploy:
     if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64]
     permissions:
       pages: write
       id-token: write

.github/workflows/e2e.yml

@@ -10,7 +10,7 @@ concurrency:
   cancel-in-progress: false
 jobs:
   testnet:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64]
     timeout-minutes: 15
     environment: testnet
     env:
@@ -29,7 +29,11 @@ jobs:
       - run: npm ci
       - run: npm run build
       - name: Verify the live testnet lifecycle (Relay mocked)
-        run: npm run test:e2e
+        env:
+          HOME: ${{ runner.temp }}/e2e-home
+        run: |
+          mkdir -p "$HOME"
+          npm run test:e2e
       - name: Record testnet coverage and outcome
         if: always()
         run: |

.github/workflows/install.yml

@@ -6,10 +6,29 @@ on:
 jobs:
   install:
     strategy:
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
-        node: ['22.12.0', '24']
-    runs-on: ${{ matrix.os }}
+        include:
+          - name: macOS Node 22.12
+            node: '22.12.0'
+            target: macos
+          - name: macOS Node 24
+            node: '24'
+            target: macos
+          - name: Linux Node 22.12
+            node: '22.12.0'
+            target: linux
+            docker_platform: linux/amd64
+            bun_arch: x64
+            node_image: node:22.12.0-bookworm
+          - name: Linux Node 24
+            node: '24'
+            target: linux
+            docker_platform: linux/amd64
+            bun_arch: x64
+            node_image: node:24-bookworm
+    name: ${{ matrix.name }}
+    runs-on: [self-hosted, macOS, ARM64]
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -22,9 +41,48 @@ jobs:
       - run: npm ci
       - run: npm run build
       - uses: actions/setup-node@v4
+        if: matrix.target == 'macos'
         with:
           node-version: ${{ matrix.node }}
       - name: Install the packed artifact with lifecycle scripts disabled
+        if: matrix.target == 'macos'
         run: npm run test:package
         env:
           BLOXWAP_SMOKE_BUN: '1'
+      - name: Pack the install artifact
+        if: matrix.target == 'linux'
+        run: |
+          mkdir -p "$RUNNER_TEMP/pack"
+          npm pack --workspace @bloxwap/agent-cli --ignore-scripts --pack-destination "$RUNNER_TEMP/pack"
+      - name: Install the packed artifact in a Linux container
+        if: matrix.target == 'linux'
+        env:
+          BLOXWAP_SMOKE_BUN: '1'
+          BUN_VERSION: '1.3.10'
+          DOCKER_PLATFORM: ${{ matrix.docker_platform }}
+          BUN_ARCH: ${{ matrix.bun_arch }}
+          NODE_IMAGE: ${{ matrix.node_image }}
+        run: |
+          bun_dir=$(.github/scripts/fetch-linux-bun.sh "$BUN_ARCH")
+          tarball=
+          for candidate in "$RUNNER_TEMP/pack"/*.tgz; do
+            tarball=$candidate
+          done
+          if [ ! -f "$tarball" ]; then
+            echo "packed tarball not found in $RUNNER_TEMP/pack" >&2
+            exit 1
+          fi
+          host_dir=$(.github/scripts/colima-stage.sh)
+          cleanup() { rm -rf "$host_dir"; }
+          trap cleanup EXIT
+          mkdir -p "$host_dir/pack" "$host_dir/bun"
+          cp "$bun_dir/bun" "$host_dir/bun/bun"
+          chmod +x "$host_dir/bun/bun"
+          cp "$tarball" "$host_dir/pack/"
+          cp packages/agent-cli/package.json "$host_dir/package.json"
+          cp packages/agent-cli/scripts/package-smoke.mjs "$host_dir/package-smoke.mjs"
+          BLOXWAP_SMOKE_TARBALL=/work/pack/$(basename "$tarball")
+          export BLOXWAP_SMOKE_TARBALL BLOXWAP_SMOKE_BUN
+          export LINUX_HOST_DIR="$host_dir"
+          .github/scripts/linux-run.sh "$DOCKER_PLATFORM" "$NODE_IMAGE" \
+            node package-smoke.mjs