From 86ab15bc32203e91fc98d04dc1ecb28f09f3599a Mon Sep 17 00:00:00 2001 From: Xiaoguang Sun Date: Mon, 10 Aug 2026 09:13:35 +0800 Subject: [PATCH 1/4] Migrate CI to AWS runners Use canonical arch:amd64 constraints and dynamic vCPU labels. Add a disk guard and a five-round canary before joining the shared runner pool. --- .github/actionlint.yaml | 2 + .github/actions/sys9-disk-guard/action.yml | 65 ++++++++ .github/workflows/ci.yml | 7 +- .github/workflows/runner-canary.yml | 173 +++++++++++++++++++++ 4 files changed, 246 insertions(+), 1 deletion(-) create mode 100644 .github/actionlint.yaml create mode 100644 .github/actions/sys9-disk-guard/action.yml create mode 100644 .github/workflows/runner-canary.yml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 0000000..617f0f0 --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,2 @@ +self-hosted-runner: + labels: [self-hosted, linux, "arch:amd64", "arch:arm64", default, on-demand, ghr-ec2-vcpus:1, ghr-ec2-vcpus:2, ghr-ec2-vcpus:4, ghr-ec2-vcpus:8, ghr-ec2-vcpus:16, ghr-ec2-memory-gib:8, ghr-ec2-memory-gib:16, ghr-ec2-memory-gib:32, ghr-ec2-memory-gib:64] diff --git a/.github/actions/sys9-disk-guard/action.yml b/.github/actions/sys9-disk-guard/action.yml new file mode 100644 index 0000000..5c7760e --- /dev/null +++ b/.github/actions/sys9-disk-guard/action.yml @@ -0,0 +1,65 @@ +name: Sys9 disk guard +description: Ensure a workspace filesystem has enough free space, optionally cleaning it once before a job continues. + +inputs: + path: + description: Filesystem path whose available space should be checked. + required: false + default: ${{ github.workspace }} + minimum_free_gib: + description: Minimum available space required after cleanup, in GiB. + required: false + default: "15" + cleanup_command: + description: Optional shell command used once when available space is below the minimum. + required: false + default: "" + +runs: + using: composite + steps: + - name: Check workspace disk space + shell: bash + env: + DISK_GUARD_PATH: ${{ inputs.path }} + DISK_GUARD_MINIMUM_FREE_GIB: ${{ inputs.minimum_free_gib }} + DISK_GUARD_CLEANUP_COMMAND: ${{ inputs.cleanup_command }} + run: | + set -euo pipefail + + if [[ ! "${DISK_GUARD_MINIMUM_FREE_GIB}" =~ ^[1-9][0-9]*$ ]]; then + echo "disk guard: minimum_free_gib must be a positive integer" >&2 + exit 1 + fi + if [[ ! -e "${DISK_GUARD_PATH}" ]]; then + echo "disk guard: path does not exist: ${DISK_GUARD_PATH}" >&2 + exit 1 + fi + + minimum_free_kb=$((DISK_GUARD_MINIMUM_FREE_GIB * 1024 * 1024)) + available_kb() { + local value + value="$(df -Pk "${DISK_GUARD_PATH}" | awk 'NR == 2 {print $4}')" + if [[ ! "${value}" =~ ^[0-9]+$ ]]; then + echo "disk guard: unable to read free space for ${DISK_GUARD_PATH}" >&2 + return 1 + fi + printf '%s\n' "${value}" + } + + free_kb="$(available_kb)" + if (( free_kb < minimum_free_kb )); then + if [[ -z "${DISK_GUARD_CLEANUP_COMMAND}" ]]; then + echo "disk guard: free space ${free_kb}KiB is below ${minimum_free_kb}KiB and no cleanup command was supplied" >&2 + exit 1 + fi + echo "disk guard: free space ${free_kb}KiB is below ${minimum_free_kb}KiB; running targeted cleanup" >&2 + bash -euo pipefail -c "${DISK_GUARD_CLEANUP_COMMAND}" + free_kb="$(available_kb)" + if (( free_kb < minimum_free_kb )); then + echo "disk guard: free space remains ${free_kb}KiB after cleanup; refusing to continue" >&2 + exit 1 + fi + fi + + echo "disk guard: ${free_kb}KiB available at ${DISK_GUARD_PATH}" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1521199..2415e5b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,9 +7,14 @@ on: jobs: test: - runs-on: ubuntu-latest + runs-on: [self-hosted, linux, default, 'arch:amd64', 'ghr-ec2-vcpus:2'] steps: - uses: actions/checkout@v4 + - name: Guard workspace disk + uses: ./.github/actions/sys9-disk-guard + with: + path: ${{ github.workspace }} + minimum_free_gib: "15" - uses: actions/setup-go@v5 with: go-version: "1.25.x" diff --git a/.github/workflows/runner-canary.yml b/.github/workflows/runner-canary.yml new file mode 100644 index 0000000..ef128c4 --- /dev/null +++ b/.github/workflows/runner-canary.yml @@ -0,0 +1,173 @@ +name: Runner canary + +on: + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + round-1: + name: Runner canary 1 + runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + timeout-minutes: 3 + steps: + - name: Check out repository + uses: actions/checkout@v6 + + - name: Guard workspace disk + uses: ./.github/actions/sys9-disk-guard + with: + path: ${{ github.workspace }} + minimum_free_gib: "15" + + - name: Record sanitized runner evidence + shell: bash + env: + CANARY_ROUND: "1" + EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + run: | + set -euo pipefail + if [[ "${RUNNER_ARCH}" != "X64" ]]; then + echo "runner canary: expected X64 architecture, got ${RUNNER_ARCH}" >&2 + exit 1 + fi + available_kb="$(df -Pk "${GITHUB_WORKSPACE}" | awk 'NR == 2 {print $4}')" + if [[ ! "${available_kb}" =~ ^[0-9]+$ ]]; then + echo "runner canary: unable to read workspace free space" >&2 + exit 1 + fi + echo "round=${CANARY_ROUND} labels=${EXPECTED_LABELS} architecture=${RUNNER_ARCH} available_kb=${available_kb} status=success" + + round-2: + name: Runner canary 2 + needs: round-1 + runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + timeout-minutes: 3 + steps: + - name: Check out repository + uses: actions/checkout@v6 + + - name: Guard workspace disk + uses: ./.github/actions/sys9-disk-guard + with: + path: ${{ github.workspace }} + minimum_free_gib: "15" + + - name: Record sanitized runner evidence + shell: bash + env: + CANARY_ROUND: "2" + EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + run: | + set -euo pipefail + if [[ "${RUNNER_ARCH}" != "X64" ]]; then + echo "runner canary: expected X64 architecture, got ${RUNNER_ARCH}" >&2 + exit 1 + fi + available_kb="$(df -Pk "${GITHUB_WORKSPACE}" | awk 'NR == 2 {print $4}')" + if [[ ! "${available_kb}" =~ ^[0-9]+$ ]]; then + echo "runner canary: unable to read workspace free space" >&2 + exit 1 + fi + echo "round=${CANARY_ROUND} labels=${EXPECTED_LABELS} architecture=${RUNNER_ARCH} available_kb=${available_kb} status=success" + + round-3: + name: Runner canary 3 + needs: round-2 + runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + timeout-minutes: 3 + steps: + - name: Check out repository + uses: actions/checkout@v6 + + - name: Guard workspace disk + uses: ./.github/actions/sys9-disk-guard + with: + path: ${{ github.workspace }} + minimum_free_gib: "15" + + - name: Record sanitized runner evidence + shell: bash + env: + CANARY_ROUND: "3" + EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + run: | + set -euo pipefail + if [[ "${RUNNER_ARCH}" != "X64" ]]; then + echo "runner canary: expected X64 architecture, got ${RUNNER_ARCH}" >&2 + exit 1 + fi + available_kb="$(df -Pk "${GITHUB_WORKSPACE}" | awk 'NR == 2 {print $4}')" + if [[ ! "${available_kb}" =~ ^[0-9]+$ ]]; then + echo "runner canary: unable to read workspace free space" >&2 + exit 1 + fi + echo "round=${CANARY_ROUND} labels=${EXPECTED_LABELS} architecture=${RUNNER_ARCH} available_kb=${available_kb} status=success" + + round-4: + name: Runner canary 4 + needs: round-3 + runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + timeout-minutes: 3 + steps: + - name: Check out repository + uses: actions/checkout@v6 + + - name: Guard workspace disk + uses: ./.github/actions/sys9-disk-guard + with: + path: ${{ github.workspace }} + minimum_free_gib: "15" + + - name: Record sanitized runner evidence + shell: bash + env: + CANARY_ROUND: "4" + EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + run: | + set -euo pipefail + if [[ "${RUNNER_ARCH}" != "X64" ]]; then + echo "runner canary: expected X64 architecture, got ${RUNNER_ARCH}" >&2 + exit 1 + fi + available_kb="$(df -Pk "${GITHUB_WORKSPACE}" | awk 'NR == 2 {print $4}')" + if [[ ! "${available_kb}" =~ ^[0-9]+$ ]]; then + echo "runner canary: unable to read workspace free space" >&2 + exit 1 + fi + echo "round=${CANARY_ROUND} labels=${EXPECTED_LABELS} architecture=${RUNNER_ARCH} available_kb=${available_kb} status=success" + + round-5: + name: Runner canary 5 + needs: round-4 + runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + timeout-minutes: 3 + steps: + - name: Check out repository + uses: actions/checkout@v6 + + - name: Guard workspace disk + uses: ./.github/actions/sys9-disk-guard + with: + path: ${{ github.workspace }} + minimum_free_gib: "15" + + - name: Record sanitized runner evidence + shell: bash + env: + CANARY_ROUND: "5" + EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + run: | + set -euo pipefail + if [[ "${RUNNER_ARCH}" != "X64" ]]; then + echo "runner canary: expected X64 architecture, got ${RUNNER_ARCH}" >&2 + exit 1 + fi + available_kb="$(df -Pk "${GITHUB_WORKSPACE}" | awk 'NR == 2 {print $4}')" + if [[ ! "${available_kb}" =~ ^[0-9]+$ ]]; then + echo "runner canary: unable to read workspace free space" >&2 + exit 1 + fi + echo "round=${CANARY_ROUND} labels=${EXPECTED_LABELS} architecture=${RUNNER_ARCH} available_kb=${available_kb} status=success" From 518f31eddbe634b920af216ec3116e34fe1d9867 Mon Sep 17 00:00:00 2001 From: Xiaoguang Sun Date: Mon, 10 Aug 2026 09:28:07 +0800 Subject: [PATCH 2/4] Keep fork PRs off self-hosted runners Run untrusted fork tests on GitHub-hosted capacity. Limit the canary to internal pull requests and explicit dispatches. --- .github/workflows/ci.yml | 8 +++++++- .github/workflows/runner-canary.yml | 3 +++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2415e5b..5912604 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,7 +7,13 @@ on: jobs: test: - runs-on: [self-hosted, linux, default, 'arch:amd64', 'ghr-ec2-vcpus:2'] + runs-on: >- + ${{ + github.event_name == 'pull_request' && + github.event.pull_request.head.repo.fork && + 'ubuntu-latest' || + fromJSON('["self-hosted","linux","default","arch:amd64","ghr-ec2-vcpus:2"]') + }} steps: - uses: actions/checkout@v4 - name: Guard workspace disk diff --git a/.github/workflows/runner-canary.yml b/.github/workflows/runner-canary.yml index ef128c4..4d8f549 100644 --- a/.github/workflows/runner-canary.yml +++ b/.github/workflows/runner-canary.yml @@ -10,6 +10,9 @@ permissions: jobs: round-1: name: Runner canary 1 + if: >- + github.event_name == 'workflow_dispatch' || + github.event.pull_request.head.repo.full_name == github.repository runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] timeout-minutes: 3 steps: From 9d1b756d60e8bf72a32544db43ce29105f638550 Mon Sep 17 00:00:00 2001 From: Xiaoguang Sun Date: Mon, 10 Aug 2026 09:29:34 +0800 Subject: [PATCH 3/4] Restrict self-hosted jobs to main Run pull request tests on GitHub-hosted capacity. Reserve self-hosted execution for main pushes and explicit canary dispatches. --- .github/workflows/ci.yml | 1 - .github/workflows/runner-canary.yml | 4 ---- 2 files changed, 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5912604..f935d9a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,7 +10,6 @@ jobs: runs-on: >- ${{ github.event_name == 'pull_request' && - github.event.pull_request.head.repo.fork && 'ubuntu-latest' || fromJSON('["self-hosted","linux","default","arch:amd64","ghr-ec2-vcpus:2"]') }} diff --git a/.github/workflows/runner-canary.yml b/.github/workflows/runner-canary.yml index 4d8f549..013678c 100644 --- a/.github/workflows/runner-canary.yml +++ b/.github/workflows/runner-canary.yml @@ -1,7 +1,6 @@ name: Runner canary on: - pull_request: workflow_dispatch: permissions: @@ -10,9 +9,6 @@ permissions: jobs: round-1: name: Runner canary 1 - if: >- - github.event_name == 'workflow_dispatch' || - github.event.pull_request.head.repo.full_name == github.repository runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] timeout-minutes: 3 steps: From fb8dd11a419100cefaba7e438e6b30e74bb93e07 Mon Sep 17 00:00:00 2001 From: Xiaoguang Sun Date: Mon, 10 Aug 2026 09:35:32 +0800 Subject: [PATCH 4/4] Isolate public self-hosted workflows Restrict self-hosted jobs to trusted main refs and a dedicated runner group. Pin actions and add workflow ownership for public-repo safety. --- .github/CODEOWNERS | 2 ++ .github/actionlint.yaml | 2 +- .github/workflows/ci.yml | 45 ++++++++++++++++++++------ .github/workflows/runner-canary.yml | 50 ++++++++++++++++++++--------- 4 files changed, 74 insertions(+), 25 deletions(-) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..8537e66 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +/.github/workflows/ @c4pt0r @IANTHEREAL @shizn @sunxiaoguang +/.github/actions/ @c4pt0r @IANTHEREAL @shizn @sunxiaoguang diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index 617f0f0..9476f75 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,2 +1,2 @@ self-hosted-runner: - labels: [self-hosted, linux, "arch:amd64", "arch:arm64", default, on-demand, ghr-ec2-vcpus:1, ghr-ec2-vcpus:2, ghr-ec2-vcpus:4, ghr-ec2-vcpus:8, ghr-ec2-vcpus:16, ghr-ec2-memory-gib:8, ghr-ec2-memory-gib:16, ghr-ec2-memory-gib:32, ghr-ec2-memory-gib:64] + labels: [self-hosted, linux, "arch:amd64", "arch:arm64", default, on-demand, trusted-public-main, ghr-ec2-vcpus:1, ghr-ec2-vcpus:2, ghr-ec2-vcpus:4, ghr-ec2-vcpus:8, ghr-ec2-vcpus:16, ghr-ec2-memory-gib:8, ghr-ec2-memory-gib:16, ghr-ec2-memory-gib:32, ghr-ec2-memory-gib:64] diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f935d9a..cacec5d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,22 +5,49 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: - test: - runs-on: >- - ${{ - github.event_name == 'pull_request' && - 'ubuntu-latest' || - fromJSON('["self-hosted","linux","default","arch:amd64","ghr-ec2-vcpus:2"]') - }} + pull-request-test: + name: Pull request test + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false + - name: Guard workspace disk + uses: ./.github/actions/sys9-disk-guard + with: + path: ${{ github.workspace }} + minimum_free_gib: "15" + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + with: + go-version: "1.25.x" + - name: gofmt + run: test -z "$(gofmt -l .)" + - name: go vet + run: go vet ./... + - name: go test + run: go test -count=1 -race ./... + + main-test: + name: Main test + if: github.event_name == 'push' + runs-on: + group: auth9token-go main + labels: [self-hosted, linux, trusted-public-main, "arch:amd64", "ghr-ec2-vcpus:2"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - name: Guard workspace disk uses: ./.github/actions/sys9-disk-guard with: path: ${{ github.workspace }} minimum_free_gib: "15" - - uses: actions/setup-go@v5 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: "1.25.x" - name: gofmt diff --git a/.github/workflows/runner-canary.yml b/.github/workflows/runner-canary.yml index 013678c..c784489 100644 --- a/.github/workflows/runner-canary.yml +++ b/.github/workflows/runner-canary.yml @@ -9,11 +9,15 @@ permissions: jobs: round-1: name: Runner canary 1 - runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + runs-on: + group: auth9token-go main + labels: [self-hosted, linux, trusted-public-main, "arch:amd64", "ghr-ec2-vcpus:1"] timeout-minutes: 3 steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - name: Guard workspace disk uses: ./.github/actions/sys9-disk-guard @@ -25,7 +29,7 @@ jobs: shell: bash env: CANARY_ROUND: "1" - EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + EXPECTED_LABELS: self-hosted,linux,trusted-public-main,arch:amd64,ghr-ec2-vcpus:1 run: | set -euo pipefail if [[ "${RUNNER_ARCH}" != "X64" ]]; then @@ -42,11 +46,15 @@ jobs: round-2: name: Runner canary 2 needs: round-1 - runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + runs-on: + group: auth9token-go main + labels: [self-hosted, linux, trusted-public-main, "arch:amd64", "ghr-ec2-vcpus:1"] timeout-minutes: 3 steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - name: Guard workspace disk uses: ./.github/actions/sys9-disk-guard @@ -58,7 +66,7 @@ jobs: shell: bash env: CANARY_ROUND: "2" - EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + EXPECTED_LABELS: self-hosted,linux,trusted-public-main,arch:amd64,ghr-ec2-vcpus:1 run: | set -euo pipefail if [[ "${RUNNER_ARCH}" != "X64" ]]; then @@ -75,11 +83,15 @@ jobs: round-3: name: Runner canary 3 needs: round-2 - runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + runs-on: + group: auth9token-go main + labels: [self-hosted, linux, trusted-public-main, "arch:amd64", "ghr-ec2-vcpus:1"] timeout-minutes: 3 steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - name: Guard workspace disk uses: ./.github/actions/sys9-disk-guard @@ -91,7 +103,7 @@ jobs: shell: bash env: CANARY_ROUND: "3" - EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + EXPECTED_LABELS: self-hosted,linux,trusted-public-main,arch:amd64,ghr-ec2-vcpus:1 run: | set -euo pipefail if [[ "${RUNNER_ARCH}" != "X64" ]]; then @@ -108,11 +120,15 @@ jobs: round-4: name: Runner canary 4 needs: round-3 - runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + runs-on: + group: auth9token-go main + labels: [self-hosted, linux, trusted-public-main, "arch:amd64", "ghr-ec2-vcpus:1"] timeout-minutes: 3 steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - name: Guard workspace disk uses: ./.github/actions/sys9-disk-guard @@ -124,7 +140,7 @@ jobs: shell: bash env: CANARY_ROUND: "4" - EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + EXPECTED_LABELS: self-hosted,linux,trusted-public-main,arch:amd64,ghr-ec2-vcpus:1 run: | set -euo pipefail if [[ "${RUNNER_ARCH}" != "X64" ]]; then @@ -141,11 +157,15 @@ jobs: round-5: name: Runner canary 5 needs: round-4 - runs-on: [self-hosted, linux, default, "arch:amd64", "ghr-ec2-vcpus:1"] + runs-on: + group: auth9token-go main + labels: [self-hosted, linux, trusted-public-main, "arch:amd64", "ghr-ec2-vcpus:1"] timeout-minutes: 3 steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - name: Guard workspace disk uses: ./.github/actions/sys9-disk-guard @@ -157,7 +177,7 @@ jobs: shell: bash env: CANARY_ROUND: "5" - EXPECTED_LABELS: self-hosted,linux,default,arch:amd64,ghr-ec2-vcpus:1 + EXPECTED_LABELS: self-hosted,linux,trusted-public-main,arch:amd64,ghr-ec2-vcpus:1 run: | set -euo pipefail if [[ "${RUNNER_ARCH}" != "X64" ]]; then