CI: run GitHub Actions on self-hosted arc-runner-set

The org IP allow list blocks GitHub-hosted runner IPs (checkout 403), so
point all jobs at the self-hosted arc-runner-set. Drop the rsync dependency
in build-site.sh (cp + bytecode prune; the ARC runner image has no rsync)
and remove the migrations-mysql job - ARC/Kubernetes has no service
containers, so that MySQL 8 coverage stays on the internal CI.

.github/workflows/ci.yml

@@ -12,13 +12,19 @@
 
 name: CI
 
+# Jobs run on the org's self-hosted "arc-runner-set" (enterprise
+# ge-aerospace-runner-group, Linux). GitHub-hosted runners are blocked by the
+# org IP allow list (hosted Azure runner IPs are not allow-listed -> checkout
+# 403), so ubuntu-latest cannot be used here. arc-runner-set checks out from an
+# internal allow-listed IP and, being Linux, still supports service containers.
+
 on:
   push:
   pull_request:
 
 jobs:
   backend:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -29,13 +35,13 @@ jobs:
       - run: python -m pytest -q
 
   naming:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     steps:
       - uses: actions/checkout@v4
       - run: bash scripts/check-naming-and-style.sh
 
   frontend:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     defaults:
       run:
         working-directory: frontend
@@ -54,7 +60,7 @@ jobs:
     # ADR-013 Phase 5: prove a per-site build carries only its chosen plugins.
     # Builds a lean site (machines + printers) and asserts an omitted plugin's
     # code is absent from the bundle - the delete-a-plugin guarantee in CI.
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -91,72 +97,10 @@ jobs:
           test ! -d /tmp/leansite/plugins/printedparts
           echo "lean build verified: only chosen plugins present"
 
-  migrations-mysql:
+  # NOTE: the MySQL-8 migration/seed job (fresh `flask db upgrade` + every
-    runs-on: ubuntu-latest
+  # plugin chain + strict-mode seeders on a real MySQL 8) runs on the internal
-    services:
+  # CI server, which supports service containers. The org's arc-runner-set is
-      mysql:
+  # Kubernetes/ARC without docker-in-docker, so GitHub Actions service
-        image: mysql:8.0
+  # containers ("services: mysql") are unavailable here ("Job Container is
-        env:
+  # required"). That coverage stays on the internal CI rather than being
-          MYSQL_ROOT_PASSWORD: root
+  # duplicated on GitHub.
-          MYSQL_DATABASE: shopdb_ci
-        ports:
-          - 3306:3306
-        options: >-
-          --health-cmd="mysqladmin ping -h localhost -uroot -proot"
-          --health-interval=5s --health-timeout=5s --health-retries=20
-    env:
-      FLASK_APP: shopdb
-      DATABASE_URL: mysql+pymysql://root:root@127.0.0.1:3306/shopdb_ci?charset=utf8mb4
-      SECRET_KEY: ci-secret
-      JWT_SECRET_KEY: ci-jwt-secret
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.13'
-          cache: pip
-      - run: pip install -r requirements.txt
-      - name: Force utf8mb4 on the CI database
-        # pymysql speaks MySQL 8's caching_sha2_password via the cryptography
-        # package (a requirements.txt dependency), so no auth-plugin change
-        # is needed here.
-        run: |
-          mysql -h 127.0.0.1 -uroot -proot -e \
-            "ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
-      - name: Fresh core upgrade from empty
-        run: flask db upgrade
-      - name: Install every bundled plugin (runs its chain)
-        run: |
-          for p in computers employees geenforce knowledgebase machines \
-                   measuringtools network notifications printedparts printers \
-                   slides usb warranty; do
-            flask plugin install "$p"
-          done
-          flask plugin upgrade-all
-      - name: Seed platform data (catches strict-mode data violations)
-        # Runs the real seeders on strict MySQL 8. A seeded row that exceeds a
-        # column width is a hard error 1406 here (not the silent truncation
-        # older/relaxed MySQL gives), so this is what catches over-length
-        # setting descriptions and similar before they reach a fresh box.
-        run: |
-          flask seed permissions
-          flask seed settings
-          flask seed reference-data
-      - name: Assert schema built + utf8mb4
-        run: |
-          python - <<'PY'
-          from shopdb import create_app
-          from shopdb.extensions import db
-          from sqlalchemy import text
-          app = create_app()
-          with app.app_context():
-              tables = db.inspect(db.engine).get_table_names()
-              assert len(tables) >= 70, f'only {len(tables)} tables built'
-              row = db.session.execute(text(
-                  "SELECT default_character_set_name FROM information_schema.schemata "
-                  "WHERE schema_name = 'shopdb_ci'")).first()
-              assert row[0] == 'utf8mb4', f'charset is {row[0]}, not utf8mb4'
-              print(f'OK: {len(tables)} tables, charset {row[0]}')
-          PY
-      - name: Second core upgrade must be a clean no-op
-        run: flask db upgrade

scripts/build-site.sh

@@ -57,12 +57,15 @@ echo "==> Building frontend (SITE_PLUGINS=$CLOSURE) ..."
 echo "==> Staging backend into $OUT ..."
 rm -rf "$OUT"
 mkdir -p "$OUT/plugins"
-rsync -a --exclude '__pycache__' --exclude '*.pyc' "$REPO/shopdb" "$OUT/"
+# cp (not rsync) so a minimal runner/deploy box without rsync can stage;
+# bytecode is pruned afterwards to match the old --exclude filters.
+cp -a "$REPO/shopdb" "$OUT/"
 for name in ${CLOSURE//,/ }; do
-  rsync -a --exclude '__pycache__' --exclude '*.pyc' \
+  cp -a "$REPO/plugins/$name" "$OUT/plugins/"
-    "$REPO/plugins/$name" "$OUT/plugins/"
 done
 cp -r "$REPO/frontend/dist" "$OUT/frontend-dist"
+find "$OUT" -type d -name '__pycache__' -prune -exec rm -rf {} +
+find "$OUT" -type f -name '*.pyc' -delete
 
 echo ""
 echo "Lean site staged at: $OUT"