Move off rust-lang-ci

[Kobzol]

We would like to get rid of the rust-lang-ci organization, which should no longer be needed:

• We can now configure secrets on GH per branch, so we can configure secrets only for the auto and try branches, not for all CI.
• We get 500 concurrent jobs across all repos in the rust-lang organization, so that should be enough to run all CI in a single org.
• We no longer use self-hosted runners.

The following (probably non-exhaustive) list below tracks what needs to be done to get rid of rust-lang-ci:

• Configure secrets for the auto and try branches on rust-lang/rust.
  • This could be done either using GitHub environments or using AWS OIDC.
  • Once we get rid of homu, we could get rid of all secrets and use AWS OIDCS for everything.
• Make sure that the homu bors GitHub account has access to the auto and try branches on rust-lang/rust.
• Create try-perf and perf-tmp branches/branch protections in rust-lang/rust.
  • (Maybe move the unrolling logic from rustc-perf into rustbot or bots? But that's unrelated.)
• Switch CI to use Docker ghcr.io caches from the rust-lang organization
  • Make CI more agnostic of the owning GitHub organization rust#127312 (needs to be reapplied, it was reverted in the meantime!)
  • https://github.com/rust-lang/rust/blob/822c3203c65a16bbe14c1b92894ad7fd72ebb432/src/ci/docker/run.sh#L97
• Reconfigure homu to avoid using the rust-lang-ci fork (configured here) and redeploy homu - probably the scariest part.
• Update downstream projects
  • https://github.com/rust-lang/rustc-perf
    • [do not merge] Use rust-lang instead of rust-lang-ci for all commits rustc-perf#2023
    • I think that we can proactively switch to rust-lang here. Old try build links will not work (because these will be only in rust-lang-ci), but old merge links should work, as the merge commits should be both in rust-lang and rust-lang-ci.
  • https://github.com/rust-lang/team
    • https://github.com/rust-lang/team/blob/f97d54dfe99a73bc3fe13cda348a77fac3feaa9b/teams/infra.toml#L33

This idea was discussed on Zulip.

[pietroalbini]

A missing thing is that rustup also refers to the docker images built by rust-lang/rust's CI.

[Kobzol]

That's the same thing as Switch CI to use Docker ghcr.io caches from the rust-lang organization; rust's CI writes the image tag into a file stored at S3, and rustup downloads it. Whatever is written by Rust's CI into that file will determine from where rustup downloads the Docker images (be it rust-lang or rust-lang-ci's ghcr.io hub).

[Mark-Simulacrum]

Just to check, even if we did use self-hosted runners I think those are also fine in a single org now (GitHub upstream made changes for that), right?

[pietroalbini]

Just to check, even if we did use self-hosted runners I think those are also fine in a single org now (GitHub upstream made changes for that), right?

Yes. If the runners are placed in a runner group, it's possible to restrict which workflows can access them. We could then restrict them to rust-lang/rust/.github/workflows/ci.yml@auto to only allow them to execute ci.yml on the auto branch.