CI: run Linux jobs on Jog runners

.dw/config.yml

@@ -0,0 +1,9 @@
+# softfac (the Rust factory) reads this block from the default branch on every pass.
+# Design and plan: factory/docs/design.md once issue #1 lands; issues #1 to #21.
+factory:
+  instructors: [tomkaczocha, rawphp]
+  base: main
+  provision: [vp i]
+  gate: [factory/scripts/check.sh]
+  limits: { gate_retries: 2 }
+  autonomy: pr

.github/workflows/cursor-hygiene-webhook.yml

@@ -16,7 +16,7 @@ permissions:
 jobs:
   forward:
     name: POST to Cursor
-    runs-on: ubuntu-24.04
+    runs-on: jog
     steps:
       - name: POST to Cursor
         env:

.github/workflows/desktop-macos-preview-publish.yml

@@ -36,7 +36,7 @@ jobs:
       github.event.workflow_run.conclusion == 'success'
     # The build workflow completes for every PR push (its label gate is on the
     # job), so this runs often and usually finds nothing. Keep it cheap.
-    runs-on: ubuntu-24.04
+    runs-on: jog
     timeout-minutes: 10
     permissions:
       actions: read
@@ -500,7 +500,7 @@ jobs:
       (github.event.action == 'closed' ||
       (github.event.action == 'unlabeled' && github.event.label.name == 'preview:mac'))
     # Runs on every PR close and usually finds nothing. Keep it cheap.
-    runs-on: ubuntu-24.04
+    runs-on: jog
     timeout-minutes: 10
     # Cleanup runs must complete: a close event right after an unlabel queues
     # behind the running cleanup instead of canceling it mid-delete.

.github/workflows/factory-ci.yml

@@ -0,0 +1,71 @@
+name: Factory CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: factory-ci-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+# This is the fork's own workflow. Upstream's workflows are disabled on this repo.
+jobs:
+  check:
+    name: Check
+    runs-on: jog
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Install
+        run: vp i
+
+      - name: Check
+        run: factory/scripts/check.sh
+
+  # Runs the command upstream's ci.yml Lint job runs. check.sh and the factory gate do not run it.
+  lint:
+    name: Lint
+    runs-on: jog
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Install
+        run: vp i
+
+      - name: Lint
+        run: vp check

.github/workflows/factory-sync.yml

@@ -0,0 +1,81 @@
+name: Factory sync
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: factory-sync
+
+# This is the fork's own workflow. It merges upstream's newest nightly tag into
+# main through a pull request; factory/scripts/sync.sh says how. Upstream's code
+# (install scripts, the route generator, the checks) runs only in `prepare`,
+# which has no write token. `publish` holds the token and runs git and gh only.
+jobs:
+  prepare:
+    name: Merge and check
+    runs-on: jog
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          # No cache: this job runs upstream's install scripts, and a cache it
+          # saves would be restored by the fork's other workflows.
+          cache: false
+
+      - name: Merge and check
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          factory/scripts/sync.sh prepare "$RUNNER_TEMP/sync"
+
+      - name: Upload the prepared sync
+        uses: actions/upload-artifact@v7
+        with:
+          name: sync
+          path: ${{ runner.temp }}/sync
+          retention-days: 7
+          if-no-files-found: error
+
+  publish:
+    name: Push, land or file
+    needs: prepare
+    runs-on: jog
+    timeout-minutes: 15
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          # git push uses gh's credential helper instead.
+          persist-credentials: false
+
+      - name: Download the prepared sync
+        uses: actions/download-artifact@v8
+        with:
+          name: sync
+          path: ${{ runner.temp }}/sync
+
+      - name: Publish
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh auth setup-git
+          factory/scripts/sync.sh publish "$RUNNER_TEMP/sync"

.github/workflows/issue-labels.yml

@@ -15,7 +15,7 @@ permissions:
 jobs:
   sync:
     name: Sync issue labels
-    runs-on: ubuntu-24.04
+    runs-on: jog
     steps:
       - name: Ensure managed issue labels exist
         uses: actions/github-script@v7

.github/workflows/pr-size.yml

@@ -10,7 +10,7 @@ permissions:
 jobs:
   prepare-config:
     name: Prepare PR size config
-    runs-on: ubuntu-24.04
+    runs-on: jog
     outputs:
       labels_json: ${{ steps.config.outputs.labels_json }}
     steps:
@@ -58,7 +58,7 @@ jobs:
     name: Sync PR size label definitions
     needs: prepare-config
     if: github.event_name != 'pull_request_target'
-    runs-on: ubuntu-24.04
+    runs-on: jog
     permissions:
       contents: read
       issues: write
@@ -115,7 +115,7 @@ jobs:
     name: Label PR size
     needs: prepare-config
     if: github.event_name == 'pull_request_target'
-    runs-on: ubuntu-24.04
+    runs-on: jog
     permissions:
       contents: read
       issues: read

.github/workflows/pr-vouch.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   collect-targets:
     name: Collect PR targets
-    runs-on: ubuntu-24.04
+    runs-on: jog
     outputs:
       targets: ${{ steps.collect.outputs.targets }}
     steps:
@@ -66,7 +66,7 @@ jobs:
     name: Label PR ${{ matrix.target.number }}
     needs: collect-targets
     if: ${{ needs.collect-targets.outputs.targets != '[]' }}
-    runs-on: ubuntu-24.04
+    runs-on: jog
     concurrency:
       group: pr-vouch-${{ matrix.target.number }}
       cancel-in-progress: true

.github/workflows/release.yml

@@ -708,7 +708,7 @@ jobs:
         desktop_win_arm64,
       ]
     if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.result == 'success' && needs.quality.result == 'success' && needs.test.result == 'success' && needs.test_server.result == 'success' && needs.desktop_mac_arm64.result == 'success' && needs.desktop_linux_x64.result == 'success' && needs.desktop_linux_arm64.result == 'success' && needs.desktop_win_x64.result == 'success' && needs.desktop_win_arm64.result == 'success' }}
-    runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
+    runs-on: jog # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 15
     permissions:
       contents: read

.github/workflows/thread-transfer-report.yml

@@ -14,7 +14,7 @@ jobs:
   publish:
     name: Publish PR comment
     if: github.event.workflow_run.event == 'pull_request'
-    runs-on: ubuntu-24.04
+    runs-on: jog
     concurrency:
       group: thread-transfer-report-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.id }}
       cancel-in-progress: true

.gitignore

@@ -16,6 +16,7 @@ build/
 release/
 release-mock/
 .t3
+.worktrees/
 .idea/
 apps/web/.playwright
 apps/web/playwright-report