ci: local-ci workflow — affected-port push gate + nightly full matrix on self-hosted runner

Author: claude

.github/workflows/local-ci.yml

@@ -0,0 +1,121 @@
+# Local CI — runs on the maintainer's self-hosted runner at ZERO Actions cost.
+#
+# SECURITY (public repo + self-hosted runner): this workflow must NEVER gain a
+# `pull_request` trigger. Push events to main can only come from users with
+# write access, so fork-submitted code cannot reach the runner. Keep it that way.
+#
+# Tiers:
+#   push to main        -> affected ports only (scripts/ci-affected-ports.sh)
+#   nightly + dispatch  -> full matrix
+name: local-ci
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 8 * * *'
+  workflow_dispatch:
+    inputs:
+      tier:
+        description: 'full = all ports; affected = ports touched by HEAD~1..HEAD'
+        type: choice
+        options: [full, affected]
+        default: full
+
+concurrency:
+  group: local-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  detect:
+    runs-on: [self-hosted, linux]
+    outputs:
+      ports: ${{ steps.sel.outputs.ports }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - id: sel
+        env:
+          BASE: ${{ github.event.before }}
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            ports="$(scripts/ci-affected-ports.sh "$BASE" "$GITHUB_SHA")"
+          elif [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.tier }}" = "affected" ]; then
+            ports="$(scripts/ci-affected-ports.sh "$GITHUB_SHA~1" "$GITHUB_SHA")"
+          else
+            ports="ts java python csharp"
+          fi
+          echo "selected ports: '$ports'"
+          echo "ports=$ports" >> "$GITHUB_OUTPUT"
+
+  gates:
+    needs: detect
+    runs-on: [self-hosted, linux]
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0          # leak-scan diffs against origin/main
+          persist-credentials: false
+      - run: scripts/ci-local.sh --only gates --strict-toolchains
+
+  ts:
+    needs: detect
+    if: contains(needs.detect.outputs.ports, 'ts')
+    runs-on: [self-hosted, linux]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: scripts/ci-local.sh --only ts --strict-toolchains
+
+  java:
+    needs: detect
+    if: contains(needs.detect.outputs.ports, 'java')
+    runs-on: [self-hosted, linux]
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: scripts/ci-local.sh --only java --strict-toolchains
+
+  python:
+    needs: detect
+    if: contains(needs.detect.outputs.ports, 'python')
+    runs-on: [self-hosted, linux]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: scripts/ci-local.sh --only python --strict-toolchains
+
+  csharp:
+    needs: detect
+    if: contains(needs.detect.outputs.ports, 'csharp')
+    runs-on: [self-hosted, linux]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: scripts/ci-local.sh --only csharp --strict-toolchains
+
+  notify:
+    needs: [detect, gates, ts, java, python, csharp]
+    if: always() && contains(needs.*.result, 'failure')
+    runs-on: [self-hosted, linux]
+    steps:
+      - env:
+          # env-indirection: head_commit.message is untrusted text — never
+          # interpolate ${{ }} directly into the script body.
+          HEAD_MSG: ${{ github.event.head_commit.message }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          export DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(id -u)/bus"
+          notify-send -u critical "local-ci FAILED: metaobjects" \
+            "$(printf '%s' "$HEAD_MSG" | head -n1)
+          $RUN_URL" || echo "notify-send unavailable; GitHub email still fires"