Add more GitHub Actions runners

[lrettig]

Ideally we'd like arm64 runners for both Linux and macOS, to test go-spacemesh and other critical infrastructure on. I set up a Linux-based self-hosted runner already, but the main task is to make it secure, since GitHub strongly recommends not enabling these for public repos. For more see:

• https://docs.github.com/en/actions/hosting-your-own-runners/adding-self-hosted-runners
• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners

CC @andres-spacemesh @fasmat

[fasmat]

Some ideas regarding security on self-hosted runners:

• If feasible we should spin up a new VM for every CI run ensuring a clean environment for every build
• Changes need to be approved before they can trigger a CI build on self-hosted runners
• We can look into using OpenID Connect see here to be able to use short lived tokens for access to the infrastructure.

[aktech]

@fasmat Sorry for jumping on this. "GitHub Actions runners" got my attention.

You can achieve the above mentioned requirements with https://cirun.io It creates on demand runners for GitHub Actions on your cloud and manages the complete lifecycle. You simply connect your cloud provider and define what runners you need in a simple yaml file and that's it.

See https://docs.cirun.io/reference/examples.html#aws for example.

[lrettig]

@aktech I don't think any of these cloud providers currently support Apple Silicon VMs do they?

[aktech]

Ah, I see I didn't notice the mention on Silicon VM, only linux at the moment.

[lrettig]

Good to know, thanks

[pigmej]

Changes need to be approved before they can trigger a CI build on self-hosted runners

This is definitely must have :) I would, however, not go for approval but rather a comment (or similar) like "ok to test" that is valid only for a given subset of changes. (so pushing again invalidates).

[pigmej]

The runners have been added. So far the only security measurement that we can have is to make sure that

is marked in any repo that requires self-hosted runner.

There are M1 runners and linux arm64 available. Examples of use in poet repo.