From 0fb98a6f4c9f1f0895f9ba33ff67df8de1c8984d Mon Sep 17 00:00:00 2001
From: John Coffey <johnellis@linux.com>
Date: Sun, 20 Sep 2026 20:17:24 -0700
Subject: [PATCH] Run CI on the self-hosted GitLab

Ports .github/workflows/ci.yml after the GitHub account was suspended and
Actions stopped being reachable. Same checks, same order, with the image
pinned by digest in place of the workflow's SHA-pinned actions.

cleanup.yml is not ported: it pruned GHCR through an action, and GitLab
keeps that as a container registry cleanup policy on the project rather
than as a pipeline. publish.yml and release.yml are larger and follow
separately.

The Actions workflows stay in the tree as the reference.

.gitignore blanket-ignores dotfiles, so .gitlab-ci.yml is negated there the
same way .github already is.
---
 .gitignore     |  1 +
 .gitlab-ci.yml | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 .gitlab-ci.yml

diff --git a/.gitignore b/.gitignore
index a7183dd..c85ed4c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@ run.sh
 !.gitignore
 !.gitattributes
 !.github
+!.gitlab-ci.yml
 CLAUDE.md
 
 # The cutover rehearsal writes its fixture and state here.
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..6033a18
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,50 @@
+# CI on the self-hosted GitLab, ported from .github/workflows/ci.yml when the
+# GitHub account was suspended on 2026-09-20. The Actions file stays in the
+# tree: it is the reference this was written from and works unchanged if the
+# appeal succeeds.
+#
+# The image is pinned by digest, with its tag in the trailing comment. That
+# replaces the SHA-pinned `uses:` in the workflow -- GitLab has no action
+# allowlist, so the digest is the only thing fixing what actually runs.
+#
+# Not ported here:
+#   * cleanup.yml pruned GHCR with dataaxiom/ghcr-cleanup-action. GitLab has
+#     no equivalent action because it does not need one: the container
+#     registry has a cleanup policy on the project itself, which is where that
+#     job's settings now live.
+#   * publish.yml and release.yml still need doing; they are larger and are
+#     being handled separately.
+
+stages: [build]
+
+default:
+  interruptible: true
+
+build:
+  stage: build
+  image: rust:1-bookworm@sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e # 1-bookworm
+  # This is a big workspace and a cold build is expensive, so the registry and
+  # the target directory are cached between runs. Both are kept inside the
+  # project directory because that is the only path the runner will cache --
+  # and deliberately not on /tmp, which on this host is a tmpfs that a Rust
+  # build of this size has filled before.
+  variables:
+    CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
+    CARGO_TARGET_DIR: "$CI_PROJECT_DIR/target"
+    CARGO_INCREMENTAL: "0"
+  cache:
+    key:
+      files: [Cargo.lock]
+    paths:
+      - .cargo/registry/
+      - target/
+  before_script:
+    - apt-get update -qq && apt-get install -y -qq --no-install-recommends clang >/dev/null
+  script:
+    - cargo build -p inbuxa --locked
+    # --no-run: the workflow compiled every test target without running them,
+    # which catches a test that no longer builds without paying for the suite.
+    - cargo test --workspace --locked --no-run
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-- 
2.54.0