callisto instructions

callisto.liw.fi is a Radicle CI instance that runs CI using Ambient for open source software, for free. That means your project must have a Radicle repository, but it’s OK for it to be a mirror where you push when you want CI to run on callisto. Your projects also needs to be set up to use Ambient.

Radicle is an open source, peer-to-peer code collaboration stack built on Git.

Ambient is a CI engine that runs any code from the project under test in a virtual machine without network access. It has been developed to make it safe and secure to run CI for other people’s code.

Contact information

Email: liw@liw.fi
Fediverse: @liw@toot.liw.fi
Zulip: https://radicle.zulipchat.com/ and the #radicle-ci channel.

Radicle

A very terse summary of how to start using Radicle:

Download a release binary from https://radicle.dev/download, there’s ones for Linux and macOS.
Run rad auth to initialize a Radicle node on your machine.
Switch to your project Git checkout.
Run rad init to create a Radicle repository out of the Git repository. This will not affect how you use Git in the future, but there will be a new rqd remote.
To push changes to your Radicle node, so they get synced with other nodes, run git push rad HEAD in your Git repository. You need to do this so the changes reach callisto eventually and it can run CI on them.

Project set up for Ambient

See the Ambient user guide and the Radicle CI adapter for Ambient for the full story.

To use https://callisto.liw.fi/:

Your project must be using Rust.
CI will run in Ambient, which runs actions in a virtual machine that has no network access.

Create a file .radicle/ambient.yaml at the root of your repository with content like the following:

pre_plan:
  - action: cargo_fetch
plan:
  - action: cargo_fmt
  - action: cargo_clippy
  - action: cargo_test

Here, pre_plan is a list of actions to run in a VM with network access. The cargo_fetch action downloads Rust Cargo crates. These will be made available for the plan.
The actions in plan are executed in a VM without network access. The VM isolates them so that the actions can’t do any damage apart from spending time.
Available actions:
- cargo_build, cargo_clippy, cargo_fmt, cargo_test - run the corresponding cargo command
- custom - run named executable located in .ambient in the repository, with the arguments serialized as JSON in stdin; in the example above, .ambient/dch
- deb - build a deb package
- shell - run arbitrary shell snippet with Bash
- see the user guide for a complete list
Ambient also supports post_plan actions, but they aren’t enabled on callisto and ignored instead.
There is a limit on CPUs, RAM, and run time, and disk space used for cache (/workspace/cache in the VM), dependencies (/workspace/deps), and artifacts (/workspace/artifacts), and the run will fail end (possibly with mysterious error messages) if those limits are exceeded.