CI is live: Gitea Actions + host act_runner, first green run

docs/ci.md updated to reflect the running state + the one sudo command to
make the runner a permanent systemd service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015jtxAiu5dAW4WxCNdGkrkJ

docs/ci.md

@@ -3,74 +3,48 @@
 `.gitea/workflows/checkpoint.yml` runs the full checkpoint suite
 (`scripts/run_checkpoint_tests.py`: migrations on a fresh DB, backend
 `pytest`, all Godot smoke tests, the 2-player multiplayer test, and the
-fresh-clone boot check) on every push to `main` and every PR.
+fresh-clone boot check) on **every push to `main` and every PR**.
 
-**It does not run yet** — the self-hosted Gitea instance (`git.cloudbison…`,
+## Status: live
-Gitea 1.26) has Actions disabled and no runner registered. This is a
-one-time operator setup on the AGP host.
 
-## Enabling it
+Set up 2026-09-05:
 
-### 1. Turn on Actions in Gitea
+- Gitea Actions enabled (`[actions] ENABLED = true` in
+  `/DATA/AppData/forgejo/gitea/conf/app.ini`, container restarted; a
+  timestamped `.bak` is next to it).
+- `act_runner` v0.2.13 registered as **`agp-host`** with label **`host`**
+  (host execution mode — jobs run directly on the AGP box, which already
+  has Docker, `~/godot/godot`, and Python). Lives in `~/act-runner/`.
+- Green on the first successful run (`d76bf4d`).
 
-Add to `/data/gitea/conf/app.ini` inside the `forgejo` container
+The workflow uses **no JavaScript actions** (no `actions/checkout`), so the
-(host path `/DATA/AppData/forgejo/gitea/conf/app.ini`):
+host needs no Node: checkout is a shallow `git fetch` from the local Gitea
+using the injected `${{ github.token }}`, and the suite runs in a venv the
+job builds (host Python is PEP-668 externally-managed).
 
-```ini
+## Make the runner permanent (one command, needs sudo)
-[actions]
-ENABLED = true
-```
 
-then `docker restart forgejo`.
+The runner currently runs as a plain background process — it won't survive a
-
+reboot. A unit file is ready at `~/act-runner/act-runner.service`:
-### 2. Register a `host` runner
-
-The suite starts Docker containers and runs the Godot binary, so a container
-runner would need docker-in-docker + a Godot image. `act_runner` in **host
-execution mode** runs jobs directly on the AGP box — where Docker,
-`~/godot/godot`, and Python already live.
 
 ```bash
-# on the AGP host
+sudo cp ~/act-runner/act-runner.service /etc/systemd/system/
-cd ~   # or wherever you keep the runner
+sudo systemctl daemon-reload
-
+pkill -f 'act_runner daemon'          # stop the temporary background one
-# 2a. binary
+sudo systemctl enable --now act-runner
-curl -sL -o act_runner \
-  https://gitea.com/gitea/act_runner/releases/download/v0.2.13/act_runner-0.2.13-linux-amd64
-chmod +x act_runner
-
-# 2b. registration token (no web UI needed)
-TOKEN=$(docker exec forgejo gitea --config /data/gitea/conf/app.ini \
-          actions generate-runner-token)
-
-# 2c. register (host label -> jobs run directly on this machine)
-./act_runner register --no-interactive \
-  --instance http://localhost:3000 \
-  --token "$TOKEN" \
-  --name agp-host \
-  --labels host:host
-
-# 2d. run it (add a systemd unit for persistence)
-./act_runner daemon
 ```
 
-`--labels host:host` means "a label called `host`, executed on the host".
+## Interim / local
-The workflow's `runs-on: host` then matches it.
-
-**Security note:** a host-mode runner executes whatever a workflow says,
-directly on the box, as the runner's user (which needs `docker` group
-membership). Fine for a single-maintainer private repo; revisit if the repo
-ever gets outside contributors.
-
-### 3. Push a commit
-
-The `checkpoint` workflow appears under the repo's **Actions** tab and gates
-merges.
-
-## Interim: run it by hand
 
 ```bash
 python scripts/run_checkpoint_tests.py
 ```
 
 — also what `/checkpoint/<PC>` on the dashboard runs before a playtest build.
+
+## Security note
+
+A host-mode runner executes whatever a workflow says, directly on the box,
+as `daddy` (in the `docker` group). Fine for a single-maintainer private
+repo; revisit if the repo gets outside contributors (switch to a
+docker-mode runner or an isolated VM).