ci: migrate Linux x64 jobs to AgentOS ARC

.github/workflows/ci.yml

@@ -11,15 +11,15 @@ permissions:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: akua-x64-ci-v2
     steps:
       - uses: actions/checkout@v7
       - uses: jdx/mise-action@v2
       - run: bun install --frozen-lockfile
       - run: mise run check
 
   package-release:
-    runs-on: ubuntu-24.04
+    runs-on: akua-heavy-ci-v2
     outputs:
       matrix: ${{ steps.release-matrix.outputs.matrix }}
     steps:

.github/workflows/release-please.yml

@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   release-please:
-    runs-on: ubuntu-latest
+    runs-on: akua-x64-ci-v2
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}

.github/workflows/release.yml

@@ -39,7 +39,7 @@ concurrency:
 
 jobs:
   package:
-    runs-on: ubuntu-24.04
+    runs-on: akua-heavy-ci-v2
     outputs:
       matrix: ${{ steps.release-matrix.outputs.matrix }}
       commit: ${{ steps.release-ref.outputs.commit }}
@@ -103,7 +103,7 @@ jobs:
 
   publish:
     needs: [package, install-smoke]
-    runs-on: ubuntu-24.04
+    runs-on: akua-x64-ci-v2
     env:
       EXPECTED_COMMIT: ${{ needs.package.outputs.commit }}
     permissions:
@@ -153,7 +153,7 @@ jobs:
 
   tap-update:
     needs: publish
-    runs-on: ubuntu-24.04
+    runs-on: akua-x64-ci-v2
     permissions:
       contents: read
     steps:

.github/workflows/update-openapi.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: akua-x64-ci-v2
     steps:
       - uses: actions/checkout@v7
       - uses: jdx/mise-action@v2

scripts/release.ts

@@ -57,7 +57,7 @@ export const RELEASE_TARGETS: readonly ReleaseTarget[] = [
     arch: "x64",
     archive: "tar.gz",
     executable: "akua",
-    runner: "ubuntu-24.04",
+    runner: "akua-x64-ci-v2",
     homebrew: { os: "linux", arch: "intel" },
   },
   {
@@ -321,7 +321,13 @@ export async function packageExistingExecutables(input: PackageExistingExecutabl
 
 export async function packageRelease(input: PackageReleaseInput): Promise<void> {
   validateVersion(input.version);
-  const binaryRoot = await mkdtemp(join(tmpdir(), "akua-release-build-"));
+  // Bun's compiled output is memory-mapped. Under Kata, output created on the
+  // guest-local /tmp filesystem was observed as correctly sized but entirely
+  // sparse/zero-filled. Keep compilation on the Actions workspace's virtiofs
+  // volume, then validate the native executable header before packaging it.
+  const binaryBuildParent = join(process.cwd(), "dist");
+  await mkdir(binaryBuildParent, { recursive: true });
+  const binaryRoot = await mkdtemp(join(binaryBuildParent, ".tmp-akua-release-build-"));
   const binaries: Record<string, string> = {};
   try {
     for (const target of RELEASE_TARGETS) {
@@ -337,6 +343,7 @@ export async function packageRelease(input: PackageReleaseInput): Promise<void>
         "--no-compile-autoload-bunfig",
         `--outfile=${binaryPath}`,
       ]);
+      assertCompiledExecutable(target, await readFile(binaryPath));
       binaries[target.id] = binaryPath;
     }
     await packageExistingExecutables({ version: input.version, outputDir: input.outputDir, binaries });
@@ -345,6 +352,17 @@ export async function packageRelease(input: PackageReleaseInput): Promise<void>
   }
 }
 
+export function assertCompiledExecutable(target: Pick<ReleaseTarget, "id" | "os">, bytes: Uint8Array): void {
+  const expectedMagic = target.os === "darwin"
+    ? [0xcf, 0xfa, 0xed, 0xfe]
+    : target.os === "linux"
+      ? [0x7f, 0x45, 0x4c, 0x46]
+      : [0x4d, 0x5a];
+  if (bytes.length < expectedMagic.length || expectedMagic.some((byte, index) => bytes[index] !== byte)) {
+    throw new Error(`Compiled executable has an invalid ${target.os} header for ${target.id}`);
+  }
+}
+
 export function hostTargetId(platform = process.platform, arch = process.arch): ReleaseTargetId {
   const normalizedPlatform = platform === "win32" ? "windows" : platform;
   const id = `${normalizedPlatform}-${arch}`;

test/release.test.ts

@@ -67,7 +67,7 @@ describe("release target contract", () => {
         arch: "x64",
         archive: "tar.gz",
         executable: "akua",
-        runner: "ubuntu-24.04",
+        runner: "akua-x64-ci-v2",
         homebrew: { os: "linux", arch: "intel" },
       },
       {
@@ -91,7 +91,7 @@ describe("release target contract", () => {
         { target: "darwin-arm64", runner: "macos-15" },
         { target: "darwin-x64", runner: "macos-15-intel" },
         { target: "linux-arm64", runner: "ubuntu-24.04-arm" },
-        { target: "linux-x64", runner: "ubuntu-24.04" },
+        { target: "linux-x64", runner: "akua-x64-ci-v2" },
         { target: "windows-x64", runner: "windows-2025" },
       ],
     });
@@ -124,6 +124,23 @@ describe("release target contract", () => {
     );
   });
 
+  test("rejects zero-filled compiled outputs before release packaging", async () => {
+    const release = await import("../scripts/release") as Record<string, unknown>;
+    const assertCompiledExecutable = release.assertCompiledExecutable as (
+      target: { id: string; os: "darwin" | "linux" | "windows" },
+      bytes: Uint8Array,
+    ) => void;
+
+    expect(() => assertCompiledExecutable(
+      { id: "linux-x64", os: "linux" },
+      new Uint8Array(64),
+    )).toThrow("invalid linux header");
+    expect(() => assertCompiledExecutable(
+      { id: "linux-x64", os: "linux" },
+      new Uint8Array([0x7f, 0x45, 0x4c, 0x46]),
+    )).not.toThrow();
+  });
+
   test("plans uploads for only release assets missing from an identical existing subset", async () => {
     const release = await import("../scripts/release") as Record<string, unknown>;
     expect(typeof release.planReleaseUploads).toBe("function");

test/workflows.test.ts

@@ -2,6 +2,19 @@ import { describe, expect, test } from "bun:test";
 import { readFile } from "node:fs/promises";
 
 describe("distribution workflows", () => {
+  test("Linux x64 jobs use the audited AgentOS ARC pools", async () => {
+    const workflows = await Promise.all([
+      readFile(".github/workflows/ci.yml", "utf8"),
+      readFile(".github/workflows/release-please.yml", "utf8"),
+      readFile(".github/workflows/release.yml", "utf8"),
+      readFile(".github/workflows/update-openapi.yml", "utf8"),
+    ]);
+
+    for (const workflow of workflows) {
+      expect(workflow).not.toMatch(/^\s+runs-on: (?:ubuntu-latest|ubuntu-24\.04|ubuntu-22\.04)$/m);
+    }
+  });
+
   test("the release workflow consumes the complete release target matrix", async () => {
     const workflow = await readFile(".github/workflows/release.yml", "utf8");