Manifest

The runner executes what the manifest declares and knows no language: Cargo, pnpm, CMake and Gradle repositories onboard with this one file. ciresk ci init writes a first version for the toolchain it detects; this page is the reference for everything in it.

Rules that apply to the whole file

Fields

Top level

A version range such as "24.x" is resolved to an exact version by mise on the worker at the first lease; the resolved version enters the key and the report as toolchains_resolved. Unpinned values (stable, latest, nightly, lts, *) and an empty value are refused by the CLI before anything is uploaded (exit 2).

A name with a backend prefix installs a tool through that backend: "cargo:cargo-nextest": "0.9.148" (what ciresk ci init writes for Rust) builds cargo-nextest with cargo, and npm:, pipx:, aqua: and asdf: work the same. A tool your run line calls must be in toolchains: with no rust entry, cargo is not on the task's PATH and the task fails with exit 127 (cargo: not found).

A version mise cannot install, such as a Rust release that does not exist, is not caught before the run today: each worker that tries it refuses the task with toolchain_unavailable, and after three workers the job ends as infra_error (CLI exit 8) although nothing is wrong with the workers. The tail of the task names mise's error; fix the version and run again.

An image entry (a container image pinned by digest) passes the parser, but no worker runs container toolchains yet: a task that needs one fails with toolchain_unavailable.

globals

A name in pass_env may not also appear in env, and CIRESK_GIT_CREDENTIAL may not appear at all (the cell holds git credentials, never a task); the parser rejects both.

workspace

tasks.<id>

Variables a task can use

The Rust pattern: archive once, shard the run

Cargo's incremental state is bound to a path, so the compile happens once on the warm worker and the test binaries travel as a nextest archive to as many shards as you want. Nothing recompiles per shard.

version: 1

toolchains:
  rust: "1.95.0"

globals:
  inputs: ["Cargo.lock", "rust-toolchain.toml", ".config/nextest.toml", ".ciresk/*.sh"]
  env: { CI: "true" }

workspace:
  warm: true
  keep: ["target"]

tasks:
  check:
    run: "cargo check --all-targets"
    inputs: ["crates/**", "Cargo.toml"]
    env: { RUSTFLAGS: "-D warnings" }
    affected: { strategy: cargo, targets_arg: "-p {crate}" }
    timeout: "10m"

  archive:
    run: "cargo nextest archive --workspace --cargo-profile ci --archive-file $CIRESK_ARCHIVE"
    inputs: ["crates/**", "Cargo.toml"]
    outputs: ["$CIRESK_ARCHIVE"]
    affected: { strategy: cargo, targets_arg: "-p {crate}" }
    timeout: "20m"

  test:
    run: "cargo nextest run --archive-file $CIRESK_ARCHIVE --workspace-remap . --profile ci --partition slice:$CIRESK_SHARD_INDEX/$CIRESK_SHARD_COUNT"
    depends_on: ["archive"]
    affected: { strategy: cargo, targets_arg: "-E 'rdeps({crate})'" }
    shards: 4
    timeout: "15m"
    report: { junit: "target/nextest/ci/junit.xml" }

cargo nextest archive needs a ci profile in Cargo.toml and a nextest profile in .config/nextest.toml that writes JUnit.

TypeScript example (pnpm, vitest)

version: 1

toolchains:
  node: "24.x"
  pnpm: "10.33"

globals:
  inputs: ["pnpm-lock.yaml", "pnpm-workspace.yaml", "tsconfig.base.json", ".ciresk/*.sh"]
  env: { CI: "true" }

workspace:
  warm: true
  keep: ["node_modules", "**/node_modules", ".pnpm-store"]

tasks:
  check:
    run: "pnpm install --frozen-lockfile --store-dir $PWD/.pnpm-store && pnpm -r typecheck"
    inputs: ["package.json", "apps/**", "packages/**", "tsconfig*.json"]
    affected: { strategy: files }

  lint:
    run: "pnpm install --frozen-lockfile --store-dir $PWD/.pnpm-store && pnpm -r lint"
    inputs: ["package.json", "apps/**", "packages/**", "biome.json"]
    affected: { strategy: files }

  test:
    run: "pnpm install --frozen-lockfile --store-dir $PWD/.pnpm-store && pnpm -r test"
    inputs: ["package.json", "apps/**", "packages/**", "vitest.config.*"]
    affected: { strategy: files }
    report: { junit: "**/junit.xml" }

Each task installs for itself: tasks of one job can run in different workspaces, so a separate install task with depends_on would leave the others without node_modules. In a warm workspace the kept store and node_modules make the second install a no-op. The JUnit file comes from each package's own test script, for example "test": "vitest run --reporter=default --reporter=junit --outputFile.junit=junit.xml"; pnpm test -- --reporter=junit ... hands vitest a literal -- before the options, so vitest ignores them and writes no report. A report.junit glob that matches no file is not an error today: the task passes and ciresk ci tests lists no tests.

CMake example (C++)

mise provides cmake; the C and C++ compiler is the one installed on the worker host.

version: 1

toolchains:
  cmake: "3.31"

globals:
  inputs: ["CMakeLists.txt", "cmake/**", "conanfile.lock", ".ciresk/*.sh"]
  env: { CI: "true" }

workspace:
  warm: true
  keep: ["build"]

tasks:
  build:
    run: "cmake -S . -B build -DCMAKE_BUILD_TYPE=RelWithDebInfo && cmake --build build"
    inputs: ["src/**", "include/**", "CMakeLists.txt", "cmake/**"]
    outputs: ["build/bin/**"]
    affected: { strategy: none }
    timeout: "30m"

  test:
    run: "ctest --test-dir build --output-junit junit.xml --output-on-failure"
    depends_on: ["build"]
    inputs: ["tests/**"]
    affected: { strategy: none }
    report: { junit: "build/junit.xml" }

What goes into a cache key is in Caching and tree sync.

Tests that start their own Postgres

A suite that brings up its own database servers (initdb, pg_ctl start, twenty instances on 127.0.0.1 under one cargo test) needs three things from the manifest: the server binaries on PATH, room for the data directories, and a loopback that works. All three are declared; none needs a worker change.

version: 1

toolchains:
  rust: "1.95.0"
  postgres: "17"          # newest 17.x portable build; initdb, pg_ctl, postgres and psql on PATH

globals:
  inputs: ["Cargo.lock", "rust-toolchain.toml", ".ciresk/*.sh"]
  env: { CI: "true" }

workspace:
  warm: true
  keep: ["target"]

tasks:
  test:
    run: "cargo test --workspace"
    inputs: ["crates/**", "Cargo.toml"]
    resources: { memory: "16G", cpus: 8, tmp: "20G" }
    timeout: "20m"

• postgres: "17" does not compile PostgreSQL. The worker resolves it to a relocatable build for its platform; "17" resolves to the newest 17.x, "17.9" to the newest 17.9.x. The resolved version is reported and enters the cache key like any other toolchain.
• Tasks run as an unprivileged user, never root, so initdb works. Put every data directory under $TMPDIR (initdb -D "$TMPDIR/pg-$i"): it is a private, empty directory per task, deleted afterwards, and resources.tmp makes the worker check that the data volume has that much free before the run.
• Bind to 127.0.0.1 on any free port. Loopback works in every egress mode: a trusted_* task shares the host's loopback, and an untrusted task runs in its own network namespace where loopback is up before the task starts and nothing else is reachable except the egress proxy. Ports are per namespace, so two untrusted tasks on one worker never collide.
• resources lowers the task's limits to what the suite needs, never above the worker's own. Size memory for the test binary plus the servers, not for the worker.