ci: migrate copr publish to reusable action

Replace the in-repo .gitea/scripts/copr-build.sh and per-job
copr-cli configuration with the shared composite action at
https://git.lair.cafe/actions/copr-publish@v1. Behaviour is
identical — submit, watch, dump per-chroot logs — but the logic
now lives in a single place that other projects can consume.

Removes the actions/checkout step from both COPR jobs since the
build script is no longer local to this repo.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -2,11 +2,21 @@ name: CI
 
 on:
   push:
-    branches: ['**']
+    branches: ["**"]
-    tags: ['v*']
+    tags: ["v*"]
   pull_request:
     branches: [main]
 
+env:
+  CARGO_INCREMENTAL: "0"
+  RUSTC_WRAPPER: sccache
+  SCCACHE_BUCKET: sccache
+  SCCACHE_ENDPOINT: http://caveman.kosherinata.internal:9000
+  SCCACHE_REGION: auto
+  SCCACHE_S3_USE_SSL: "false"
+  AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_S3_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_S3_SECRET_KEY }}
+
 jobs:
   check:
     name: Format, lint, build, test
@@ -14,18 +24,41 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Cache cargo registry and target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Ensure sccache with S3 support
+        env:
+          RUSTC_WRAPPER: ""
+        run: |
+          if sccache --version 2>/dev/null && sccache --show-stats 2>/dev/null; then
+            echo "sccache with S3 support already installed"
+          else
+            cargo install sccache --features s3 --locked
+          fi
+
       - name: Check formatting
         run: cargo fmt --check --all
 
       - name: Clippy
         run: cargo clippy --workspace -- -D warnings
 
-      - name: Build
-        run: cargo build --workspace
-
       - name: Test
         run: cargo test --workspace
 
+      - name: Show sccache stats
+        run: sccache --show-stats
+
   srpm-cortex:
     name: Build cortex SRPM
     runs-on: fedora
@@ -76,7 +109,7 @@ jobs:
         uses: actions/upload-artifact@v3
         with:
           name: srpm-cortex
-          path: '*.src.rpm'
+          path: "*.src.rpm"
 
   srpm-neuron:
     name: Build neuron SRPM
@@ -128,7 +161,7 @@ jobs:
         uses: actions/upload-artifact@v3
         with:
           name: srpm-neuron
-          path: '*.src.rpm'
+          path: "*.src.rpm"
 
   copr-cortex:
     name: Publish cortex to COPR
@@ -140,13 +173,12 @@ jobs:
         with:
           name: srpm-cortex
 
-      - name: Configure copr-cli
+      - name: Publish to COPR
-        run: |
+        uses: https://git.lair.cafe/actions/copr-publish@v1
-          mkdir -p ~/.config
+        with:
-          echo "${{ secrets.COPR_CONFIG }}" > ~/.config/copr
+          project: helexa/cortex
-
+          srpm: "*.src.rpm"
-      - name: Submit build to COPR
+          copr-config: ${{ secrets.COPR_CONFIG }}
-        run: copr-cli build helexa/cortex *.src.rpm
 
   copr-neuron:
     name: Publish neuron to COPR
@@ -158,13 +190,12 @@ jobs:
         with:
           name: srpm-neuron
 
-      - name: Configure copr-cli
+      - name: Publish to COPR
-        run: |
+        uses: https://git.lair.cafe/actions/copr-publish@v1
-          mkdir -p ~/.config
+        with:
-          echo "${{ secrets.COPR_CONFIG }}" > ~/.config/copr
+          project: helexa/neuron
-
+          srpm: "*.src.rpm"
-      - name: Submit build to COPR
+          copr-config: ${{ secrets.COPR_CONFIG }}
-        run: copr-cli build helexa/neuron *.src.rpm
 
   bump-version:
     name: Bump version in source

Cargo.lock

@@ -351,7 +351,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cortex-cli"
-version = "0.1.0"
+version = "0.1.3"
 dependencies = [
  "anyhow",
  "clap",
@@ -366,7 +366,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-core"
-version = "0.1.0"
+version = "0.1.3"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -381,7 +381,7 @@ dependencies = [
 
 [[package]]
 name = "cortex-gateway"
-version = "0.1.0"
+version = "0.1.3"
 dependencies = [
  "anyhow",
  "axum",
@@ -1184,7 +1184,7 @@ dependencies = [
 
 [[package]]
 name = "neuron"
-version = "0.1.0"
+version = "0.1.3"
 dependencies = [
  "anyhow",
  "async-trait",

Cargo.toml

@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.0"
+version = "0.1.3"
 edition = "2024"
 license = "GPL-3.0-or-later"
 repository = "https://git.lair.cafe/helexa/cortex"

cortex.spec

@@ -1,5 +1,5 @@
 Name:           cortex
-Version:        0.1.0
+Version:        0.1.3
 Release:        1%{?dist}
 Summary:        Inference gateway for multi-node GPU clusters
 
@@ -13,9 +13,20 @@ ExclusiveArch:  x86_64
 BuildRequires:  rust >= 1.85
 BuildRequires:  cargo
 BuildRequires:  gcc
+BuildRequires:  gcc-c++
+BuildRequires:  cmake
+BuildRequires:  perl-interpreter
+BuildRequires:  pkgconfig(openssl)
 BuildRequires:  systemd-rpm-macros
 
 Requires(pre):  shadow-utils
+Requires:       systemd
+
+# rpm's sysusers provides-generator only emits versioned user(cortex) when
+# the u-line has GECOS/home/shell fields. %attr(,,cortex) in %files emits
+# an unversioned Requires: user(cortex), so we provide it explicitly.
+Provides:       user(cortex)
+Provides:       group(cortex)
 
 %description
 Cortex is a Rust reverse-proxy that sits in front of multiple inference
@@ -41,13 +52,13 @@ cargo build --release -p cortex-cli
 %install
 install -Dm755 target/release/cortex %{buildroot}%{_bindir}/cortex
 install -Dm644 data/cortex.service %{buildroot}%{_unitdir}/cortex.service
+install -Dm644 data/cortex-sysusers.conf %{buildroot}%{_sysusersdir}/cortex.conf
 install -dm750 %{buildroot}%{_sysconfdir}/cortex
 install -Dm640 cortex.example.toml %{buildroot}%{_sysconfdir}/cortex/cortex.toml
 install -Dm640 models.example.toml %{buildroot}%{_sysconfdir}/cortex/models.toml
 
 %pre
-getent group cortex >/dev/null || groupadd -r cortex
+%sysusers_create_compat %{_builddir}/%{name}-%{version}/data/cortex-sysusers.conf
-getent passwd cortex >/dev/null || useradd -r -g cortex -d /var/lib/cortex -s /sbin/nologin cortex
 
 %post
 %systemd_post cortex.service
@@ -63,6 +74,7 @@ getent passwd cortex >/dev/null || useradd -r -g cortex -d /var/lib/cortex -s /s
 %doc README.md
 %{_bindir}/cortex
 %{_unitdir}/cortex.service
+%{_sysusersdir}/cortex.conf
 %dir %attr(750,root,cortex) %{_sysconfdir}/cortex
 %config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/cortex.toml
 %config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/models.toml

data/cortex-sysusers.conf

@@ -0,0 +1,3 @@
+g cortex - -
+u cortex - "Cortex inference cluster" /var/lib/cortex /sbin/nologin
+m cortex cortex

neuron.spec

@@ -1,5 +1,5 @@
 Name:           neuron
-Version:        0.1.0
+Version:        0.1.3
 Release:        1%{?dist}
 Summary:        Per-node GPU discovery and harness management daemon for cortex
 
@@ -13,9 +13,20 @@ ExclusiveArch:  x86_64
 BuildRequires:  rust >= 1.85
 BuildRequires:  cargo
 BuildRequires:  gcc
+BuildRequires:  gcc-c++
+BuildRequires:  cmake
+BuildRequires:  perl-interpreter
+BuildRequires:  pkgconfig(openssl)
 BuildRequires:  systemd-rpm-macros
 
 Requires(pre):  shadow-utils
+Requires:       systemd
+
+# rpm's sysusers provides-generator only emits versioned user(cortex) when
+# the u-line has GECOS/home/shell fields. %attr(,,cortex) in %files emits
+# an unversioned Requires: user(cortex), so we provide it explicitly.
+Provides:       user(cortex)
+Provides:       group(cortex)
 
 %description
 Neuron is a per-node daemon for cortex inference clusters. It discovers
@@ -40,12 +51,12 @@ cargo build --release -p neuron
 %install
 install -Dm755 target/release/neuron %{buildroot}%{_bindir}/neuron
 install -Dm644 data/neuron.service %{buildroot}%{_unitdir}/neuron.service
+install -Dm644 data/cortex-sysusers.conf %{buildroot}%{_sysusersdir}/neuron.conf
 install -dm750 %{buildroot}%{_sysconfdir}/cortex
 install -Dm640 neuron.example.toml %{buildroot}%{_sysconfdir}/cortex/neuron.toml
 
 %pre
-getent group cortex >/dev/null || groupadd -r cortex
+%sysusers_create_compat %{_builddir}/%{name}-%{version}/data/cortex-sysusers.conf
-getent passwd cortex >/dev/null || useradd -r -g cortex -d /var/lib/cortex -s /sbin/nologin cortex
 
 %post
 %systemd_post neuron.service
@@ -61,6 +72,7 @@ getent passwd cortex >/dev/null || useradd -r -g cortex -d /var/lib/cortex -s /s
 %doc README.md
 %{_bindir}/neuron
 %{_unitdir}/neuron.service
+%{_sysusersdir}/neuron.conf
 %dir %attr(750,root,cortex) %{_sysconfdir}/cortex
 %config(noreplace) %attr(640,root,cortex) %{_sysconfdir}/cortex/neuron.toml