worklyn / zukapublic
Agent-first git hosting. One Rust binary: git over HTTP and SSH, a REST API, MCP, CI, and multi-tenant isolation.
Get a copy:
git clone https://zuka.worklyn.com/worklyn/zuka.git
| 1 | # zuka builds and deploys itself. |
| 2 | # |
| 3 | # This runs on the build instance — a second zuka on the same host, separate from the |
| 4 | # control plane. That separation is not tidiness: the last step restarts the control |
| 5 | # plane, and a build running inside the thing it restarts would kill itself half way |
| 6 | # through its own deploy. |
| 7 | |
| 8 | [run] |
| 9 | # A cold Rust build plus the live suite. The default 600s is not close to enough, and |
| 10 | # a timeout that trips on a clean build teaches everyone to ignore red. |
| 11 | timeout_secs = 2400 |
| 12 | |
| 13 | steps = [ |
| 14 | # Cheapest first: formatting and lints fail in seconds, so a badly formatted commit |
| 15 | # does not occupy the host for twenty minutes before saying so. |
| 16 | "cargo fmt --check", |
| 17 | "cargo clippy --all-targets -- -D warnings", |
| 18 | "cargo test", |
| 19 | |
| 20 | # The live suite is where the wire protocol and the REST contract are actually |
| 21 | # proven. It self-skips without this flag, and a proof that never runs is not one. |
| 22 | "deno task test:live", |
| 23 | |
| 24 | # musl, statically linked. The host runs glibc 2.39 and the tenant containers 2.36, |
| 25 | # so a glibc build made here will not start in a container. One static binary runs |
| 26 | # in both places, which is also what makes the control plane and its tenants able |
| 27 | # to be the same build. |
| 28 | "cargo build --release --target x86_64-unknown-linux-musl", |
| 29 | |
| 30 | # Hand the binary to the deploy step. This directory is writable by the CI user, so |
| 31 | # the deploy script treats it as untrusted and copies it somewhere root-only before |
| 32 | # looking at it. |
| 33 | "mkdir -p /var/lib/zuka-build/staging && cp target/x86_64-unknown-linux-musl/release/zuka /var/lib/zuka-build/staging/zuka", |
| 34 | |
| 35 | # Deploy, but only from main. The guard and the deploy are one step on purpose: an |
| 36 | # `exit 0` only ends its own step, so a guard in a step of its own would skip |
| 37 | # nothing and every branch would deploy. |
| 38 | # |
| 39 | # zuka-deploy is root-owned, installed by hand, and reachable through a single |
| 40 | # sudoers rule. It restarts the service, waits for it to report the new build, and |
| 41 | # puts the old binary back if it does not. |
| 42 | "if [ \"$ZUKA_REF\" = refs/heads/main ]; then sudo /usr/local/bin/zuka-deploy; else echo \"$ZUKA_REF is not main — built and tested, not deployed\"; fi", |
| 43 | ] |