From a20b2ad3c636989c9049694a1c5a2cd97a41eeec Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 13:10:21 +0800 Subject: [PATCH 01/13] ci: switch to gitea.com action mirrors + rustup inline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The self-hosted act_runner cannot reach github.com (network timeout on actions/checkout clone). Replace: - actions/checkout@v4 -> https://gitea.com/actions/checkout@v4 (3 sites) - actions/cache@v4 -> https://gitea.com/actions/cache@v4 - dtolnay/rust-toolchain@stable -> rustup toolchain install (inline run) gitea.com maintains official mirrors of the actions/* org. dtolnay's rust-toolchain is third-party (no gitea.com mirror), so replaced with a direct rustup invocation — the act_runner ubuntu image has rustup pre-installed. This unblocks CI which has been red since the original PR #26 was opened 6 weeks ago. No code changes. --- .github/workflows/ci.yml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5255d07..e8bff81 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,12 +35,10 @@ jobs: name: Build + Clippy + Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: https://gitea.com/actions/checkout@v4 - name: Install Rust toolchain (stable) - uses: dtolnay/rust-toolchain@stable - with: - components: clippy + run: rustup toolchain install stable --profile minimal --component clippy && rustup default stable - name: Install system dependencies run: | @@ -81,7 +79,7 @@ jobs: echo "LIBCLANG_PATH=$LIBDIR" >> "$GITHUB_ENV" - name: Cache cargo registry + build artifacts - uses: actions/cache@v4 + uses: https://gitea.com/actions/cache@v4 with: path: | ~/.cargo/registry @@ -106,10 +104,10 @@ jobs: # Keep separate from build-test so a vulnerability advisory fails the # check independently of compile state. steps: - - uses: actions/checkout@v4 + - uses: https://gitea.com/actions/checkout@v4 - name: Install Rust toolchain (stable) - uses: dtolnay/rust-toolchain@stable + run: rustup toolchain install stable --profile minimal && rustup default stable - name: Install cargo-audit run: cargo install cargo-audit --locked From cbe410534e977649d27fea06fe8e96e45ee0b7a5 Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 13:17:17 +0800 Subject: [PATCH 02/13] ci: add rsproxy.cn cargo mirror for crates.io index access The act_runner network also blocks crates.io index access (both sparse and git protocols). Previous workaround used git protocol to github.com, which is also blocked. Replace with rsproxy.cn sparse mirror, accessible from China networks. Added to both build-test and audit jobs. Config is written to ~/.cargo/config.toml at runtime (CI-only; does not affect local dev). --- .github/workflows/ci.yml | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e8bff81..d2fd0ac 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,10 +25,6 @@ on: env: CARGO_TERM_COLOR: always - # The self-hosted act_runner network can terminate index.crates.io with a - # certificate that does not match the sparse-index hostname. Use Cargo's git - # index path in CI; GitHub access is already required for the actions above. - CARGO_REGISTRIES_CRATES_IO_PROTOCOL: git jobs: build-test: @@ -78,6 +74,16 @@ jobs: echo "Resolved LIBCLANG_PATH=$LIBDIR (found $LIBCL)" echo "LIBCLANG_PATH=$LIBDIR" >> "$GITHUB_ENV" + - name: Configure cargo mirror (CI-only) + run: | + mkdir -p ~/.cargo + cat > ~/.cargo/config.toml <<'EOF' + [source.crates-io] + replace-with = "rsproxy-sparse" + [source.rsproxy-sparse] + registry = "sparse+https://rsproxy.cn/index/" + EOF + - name: Cache cargo registry + build artifacts uses: https://gitea.com/actions/cache@v4 with: @@ -109,6 +115,16 @@ jobs: - name: Install Rust toolchain (stable) run: rustup toolchain install stable --profile minimal && rustup default stable + - name: Configure cargo mirror (CI-only) + run: | + mkdir -p ~/.cargo + cat > ~/.cargo/config.toml <<'EOF' + [source.crates-io] + replace-with = "rsproxy-sparse" + [source.rsproxy-sparse] + registry = "sparse+https://rsproxy.cn/index/" + EOF + - name: Install cargo-audit run: cargo install cargo-audit --locked From 93c331f11e4fb517965e1c1ac6c41e351c27039f Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 13:38:48 +0800 Subject: [PATCH 03/13] ci: remove actions/cache step (gitea.com clone hangs 12+ min) The actions/cache@v4 clone from gitea.com has been hanging for 12+ minutes in run 17. The actions/checkout clone took 2.5 min (slow but completed), but actions/cache is stuck indefinitely. Removing the cache step entirely. Trade-off: CI recompiles from scratch each run (slower), but actually progresses past the action-clone phase. Can re-add once gitea.com access is faster or actions are pre-cached on the runner. --- .github/workflows/ci.yml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d2fd0ac..f55edcf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -84,17 +84,6 @@ jobs: registry = "sparse+https://rsproxy.cn/index/" EOF - - name: Cache cargo registry + build artifacts - uses: https://gitea.com/actions/cache@v4 - with: - path: | - ~/.cargo/registry - ~/.cargo/git - target - key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock', 'Cargo.toml') }} - restore-keys: | - ${{ runner.os }}-cargo- - - name: Clippy (release, all targets) run: cargo clippy --release --all-targets From b6e4ed195657d4672436cb84ebfaebc5753072df Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 13:44:11 +0800 Subject: [PATCH 04/13] ci: install rustup via official script (not pre-installed in image) The catthehacker/ubuntu:act-latest image does not have rustup in PATH ('rustup: command not found', exit 127). Replace the direct rustup invocation with the official install script from sh.rustup.rs, which installs rustup + the stable toolchain in one step. Also adds ~/.cargo/bin to GITHUB_PATH so subsequent steps (cargo clippy, cargo build, cargo test, cargo audit) can find cargo/rustc. --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f55edcf..766b64a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,7 +34,9 @@ jobs: - uses: https://gitea.com/actions/checkout@v4 - name: Install Rust toolchain (stable) - run: rustup toolchain install stable --profile minimal --component clippy && rustup default stable + run: | + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal --component clippy + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - name: Install system dependencies run: | From 586b043267e9ba2d5bc2d817510c6de00b31b5bb Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 14:18:14 +0800 Subject: [PATCH 05/13] ci: trigger rerun after proxy configuration From 985c8f9cd2b68999ab7b67fd9e80849e616120a1 Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 14:25:10 +0800 Subject: [PATCH 06/13] ci: trigger rerun after config.yaml container.env proxy From 3d0062551890940291b6864438815f4844828ff3 Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 14:39:40 +0800 Subject: [PATCH 07/13] ci: use rsproxy.cn for rustup component downloads rustup components (~60MB) from static.rust-lang.org are slow even through proxy. Switch to rsproxy.cn/rustup mirror (domestic, direct connection via NO_PROXY). --- .github/workflows/ci.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 766b64a..237b131 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,6 +35,8 @@ jobs: - name: Install Rust toolchain (stable) run: | + export RUSTUP_DIST_SERVER=https://rsproxy.cn/rustup + export RUSTUP_UPDATE_ROOT=https://rsproxy.cn/rustup/rustup curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal --component clippy echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" @@ -104,7 +106,9 @@ jobs: - uses: https://gitea.com/actions/checkout@v4 - name: Install Rust toolchain (stable) - run: rustup toolchain install stable --profile minimal && rustup default stable + run: | + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal + echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - name: Configure cargo mirror (CI-only) run: | From 56feb64b10b441fd6e91c62ce397fb23c89a2bd9 Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 14:43:32 +0800 Subject: [PATCH 08/13] ci: use USTC mirror for rustup (rsproxy.cn 404 on dist path) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rsproxy.cn/rustup returns 404 for /dist/x86_64-unknown-linux-gnu/ rustup-init — different path structure from static.rust-lang.org. Switch to mirrors.ustc.edu.cn/rust-static which is a full mirror with identical path structure. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 237b131..f00c08a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,8 +35,7 @@ jobs: - name: Install Rust toolchain (stable) run: | - export RUSTUP_DIST_SERVER=https://rsproxy.cn/rustup - export RUSTUP_UPDATE_ROOT=https://rsproxy.cn/rustup/rustup + export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal --component clippy echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" @@ -107,6 +106,7 @@ jobs: - name: Install Rust toolchain (stable) run: | + export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" From e5317bf4c8a6a84a6080dcc8f75c3e8453713f8a Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 19:53:27 +0800 Subject: [PATCH 09/13] ci: remove unreachable domestic mirrors, use official sources directly Network testing revealed: - static.rust-lang.org: direct 200/0.24s (fast, no proxy needed) - sh.rustup.rs: direct 200/0.11s (fast) - gitea.com: direct 303/0.68s (fast) - mirrors.ustc.edu.cn: UNREACHABLE (5s timeout) - rsproxy.cn: UNREACHABLE (5s timeout) The machine has good direct internet access to official Rust/crates servers. Domestic mirrors are the ones that are blocked. Remove all mirror config and use defaults. --- .github/workflows/ci.yml | 36 ------------------------------------ 1 file changed, 36 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f00c08a..f2f5a86 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,7 +35,6 @@ jobs: - name: Install Rust toolchain (stable) run: | - export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal --component clippy echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" @@ -57,18 +56,6 @@ jobs: libclang-dev clang - name: Resolve LIBCLANG_PATH - # bindgen needs libclang on the LD path. The actual install location - # varies by Debian/Ubuntu version (llvm-14, llvm-15, ...), so we - # discover it dynamically instead of hardcoding /usr/lib/llvm-14/lib. - # Writing to $GITHUB_ENV propagates the value to subsequent steps - # inside the act_runner Docker container; the workflow-level `env:` - # block is not reliably visible there. - # - # Find pattern note: Debian Bookworm installs the runtime library as - # `libclang-14.so.1` (versioned, no plain libclang.so.* symlink), - # so a strict 'libclang.so.*' pattern returns nothing. The broader - # 'libclang*.so*' matches every bindgen-compatible filename variant: - # libclang.so, libclang-14.so, libclang.so.1, libclang-14.so.1. run: | set -e LIBCL=$(find /usr -name 'libclang*.so*' 2>/dev/null | head -1) @@ -77,16 +64,6 @@ jobs: echo "Resolved LIBCLANG_PATH=$LIBDIR (found $LIBCL)" echo "LIBCLANG_PATH=$LIBDIR" >> "$GITHUB_ENV" - - name: Configure cargo mirror (CI-only) - run: | - mkdir -p ~/.cargo - cat > ~/.cargo/config.toml <<'EOF' - [source.crates-io] - replace-with = "rsproxy-sparse" - [source.rsproxy-sparse] - registry = "sparse+https://rsproxy.cn/index/" - EOF - - name: Clippy (release, all targets) run: cargo clippy --release --all-targets @@ -99,27 +76,14 @@ jobs: audit: name: Security audit (RUSTSEC) runs-on: ubuntu-latest - # Keep separate from build-test so a vulnerability advisory fails the - # check independently of compile state. steps: - uses: https://gitea.com/actions/checkout@v4 - name: Install Rust toolchain (stable) run: | - export RUSTUP_DIST_SERVER=https://mirrors.ustc.edu.cn/rust-static curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - - name: Configure cargo mirror (CI-only) - run: | - mkdir -p ~/.cargo - cat > ~/.cargo/config.toml <<'EOF' - [source.crates-io] - replace-with = "rsproxy-sparse" - [source.rsproxy-sparse] - registry = "sparse+https://rsproxy.cn/index/" - EOF - - name: Install cargo-audit run: cargo install cargo-audit --locked From 17c01a040a35774e224c6d3db5d1a72c952b49d1 Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 20:08:55 +0800 Subject: [PATCH 10/13] ci: set proxy env at job level (container.env not supported by act_runner) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit act_runner does not support container.env in config.yaml — job containers get NO proxy env vars. Set HTTP_PROXY/HTTPS_PROXY/NO_PROXY directly in the workflow's job-level env block. NO_PROXY includes gitea.com (actions checkout goes direct, faster) and gitea.dailz.cn (self-hosted Gitea, internal). --- .github/workflows/ci.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f2f5a86..b195a4d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,6 +30,10 @@ jobs: build-test: name: Build + Clippy + Test runs-on: ubuntu-latest + env: + HTTP_PROXY: http://172.17.0.1:7897 + HTTPS_PROXY: http://172.17.0.1:7897 + NO_PROXY: localhost,127.0.0.1,server,db,gitea.dailz.cn,gitea.com steps: - uses: https://gitea.com/actions/checkout@v4 @@ -76,6 +80,10 @@ jobs: audit: name: Security audit (RUSTSEC) runs-on: ubuntu-latest + env: + HTTP_PROXY: http://172.17.0.1:7897 + HTTPS_PROXY: http://172.17.0.1:7897 + NO_PROXY: localhost,127.0.0.1,server,db,gitea.dailz.cn,gitea.com steps: - uses: https://gitea.com/actions/checkout@v4 From c000a2238d3a788e083f9715250ed7b618c89d78 Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 20:13:52 +0800 Subject: [PATCH 11/13] ci: configure apt proxy (apt doesn't respect HTTP_PROXY env var) apt-get ignores HTTP_PROXY/HTTPS_PROXY env vars and tries to connect directly to archive.ubuntu.com. Clash DNS returns fake-ip (198.18.x.x) which only works through TUN (disabled). Fix: write apt proxy config to /etc/apt/apt.conf.d/99proxy before apt-get update. --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b195a4d..b7974c9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -44,6 +44,8 @@ jobs: - name: Install system dependencies run: | + echo 'Acquire::http::Proxy "http://172.17.0.1:7897";' | sudo tee /etc/apt/apt.conf.d/99proxy + echo 'Acquire::https::Proxy "http://172.17.0.1:7897";' | sudo tee -a /etc/apt/apt.conf.d/99proxy APT_OPTS=(-o Acquire::Retries=5 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30) sudo apt-get "${APT_OPTS[@]}" update --error-on=any # NOTE: do NOT use --no-install-recommends for libclang-dev — on From ebff43d9d642ef87313e656ddb2d2fa7a30035b9 Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 20:20:42 +0800 Subject: [PATCH 12/13] ci: drop --error-on=any from apt-get update (microsoft repo unreachable) packages.microsoft.com fails through proxy after 5 retries. --error-on=any causes the whole update to fail. Drop it so apt skips the microsoft repo and continues with Ubuntu archives (which work fine via proxy). --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b7974c9..687744f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -47,7 +47,7 @@ jobs: echo 'Acquire::http::Proxy "http://172.17.0.1:7897";' | sudo tee /etc/apt/apt.conf.d/99proxy echo 'Acquire::https::Proxy "http://172.17.0.1:7897";' | sudo tee -a /etc/apt/apt.conf.d/99proxy APT_OPTS=(-o Acquire::Retries=5 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30) - sudo apt-get "${APT_OPTS[@]}" update --error-on=any + sudo apt-get "${APT_OPTS[@]}" update # NOTE: do NOT use --no-install-recommends for libclang-dev — on # Debian Bookworm (the node:20-bookworm image used by act_runner # under ubuntu-latest) the recommended toolchain bits are needed From 027e7e02e07392752a4531f65bff0d39dc426564 Mon Sep 17 00:00:00 2001 From: dailz Date: Tue, 14 Jul 2026 20:26:46 +0800 Subject: [PATCH 13/13] ci: add missing libavdevice-dev (ffmpeg-sys-next requires it) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI progressed to cargo build for the first time, revealing that libavdevice.pc was missing. The original yaml never installed libavdevice-dev — this was never caught because CI always failed at actions/checkout before reaching compilation. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 687744f..1d010a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -55,7 +55,7 @@ jobs: # are also more reliable without the flag. sudo apt-get "${APT_OPTS[@]}" install -y \ ffmpeg \ - libavcodec-dev libavfilter-dev libavformat-dev libavutil-dev libswscale-dev libva-dev \ + libavcodec-dev libavdevice-dev libavfilter-dev libavformat-dev libavutil-dev libswscale-dev libva-dev \ libwayland-dev wayland-protocols \ libdrm-dev \ libpipewire-0.3-dev \