ci: add ARM64 cross-compilation and unit test workflow

[tomassrnka]

Summary

• Add pr-tests-arm64.yml workflow with a cross-compile job (ubuntu-24.04, GOARCH=arm64) and a native ARM64 unit test matrix (ubuntu-24.04-arm) covering api, orchestrator, envd, shared, and db packages
• Wire the new arm64-tests workflow into pull-request.yml as a required status check
• Add setup-arm64-runner.sh bootstrap script for provisioning self-hosted ARM64 runners with Go, Docker, and dependencies

Part of #1875. This PR should be merged after the corresponding code PRs land (the workflow references packages that need ARM64-compatible build tags and test fixes).

Test plan

• Verify pr-tests-arm64.yml triggers on PRs that modify Go files or workflow configs
• Confirm the cross-compile job builds all five packages with GOARCH=arm64 on an x86 runner
• Confirm the native ARM64 test matrix runs unit tests on ubuntu-24.04-arm runners
• Verify pull-request.yml correctly gates on the new arm64-tests workflow
• Review setup-arm64-runner.sh installs correct Go version and dependencies

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Moderate risk because it adds a new required ARM64 CI gate and introduces host-level runner setup steps (sysctl/hugepages/nbd) that could cause flaky CI or misconfigured self-hosted runners if assumptions differ. The Go changes are small but touch concurrency/logging behavior in NBD handling and a timing-sensitive test.

Overview
Adds a new PR workflow that cross-compiles all Go packages for arm64 on x86 and runs an arm64 unit-test matrix on ARM runners (including extra setup for envd/orchestrator), and wires it into the main pull-request workflow as an additional check. Also introduces a bootstrap script for provisioning ARM64 self-hosted runners (KVM check, sysctls, hugepages, NBD module/udev rules, fd limits), fixes a goroutine closure capture issue in orchestrator NBD direct-path mounting, and makes the post-processor logging test safe for concurrent writes by using a mutex-protected buffer.

^{Written by Cursor Bugbot for commit fca173f. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Inconsistent checkout action version across workflows
  • Updated both occurrences of actions/checkout@v4 to actions/checkout@v5 in pr-tests-arm64.yml to match the version used in all other workflow files.

Or push these changes by commenting:

@cursor push d5995dfe75

Preview (d5995dfe75)

diff --git a/.github/workflows/pr-tests-arm64.yml b/.github/workflows/pr-tests-arm64.yml
--- a/.github/workflows/pr-tests-arm64.yml
+++ b/.github/workflows/pr-tests-arm64.yml
@@ -11,7 +11,7 @@
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Go
         uses: ./.github/actions/go-setup-cache
@@ -67,7 +67,7 @@
       fail-fast: false
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Go
         uses: ./.github/actions/go-setup-cache

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4b424a7b03

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[claude]

This PR adds ARM64 as a required status check using self-hosted runners — if those runners aren't provisioned before merging, all future PRs will be blocked; also worth confirming the prerequisite code PRs have landed as the description notes.

Extended reasoning...

Overview

Adds a new pr-tests-arm64.yml workflow (cross-compile on x86 + native ARM64 unit test matrix), wires it into pull-request.yml as a required check, and provides a setup-arm64-runner.sh bootstrap script. The one bug found is a nit: actions/checkout@v4 in the new workflow vs @v5 used everywhere else.

Security Risks

No security concerns — this is purely CI/CD infrastructure for testing purposes. The setup script runs as root on self-hosted runners (expected for provisioning).

Level of Scrutiny

Medium. The change is additive CI config, but adding arm64-tests as a required status check without path filters means it will gate every PR. If ubuntu-24.04-arm self-hosted runners are not reliably available, this will block all future PRs. The PR description explicitly states it should be merged after corresponding code PRs — that sequencing dependency deserves human verification.

Other Factors

The environment-specific setup (hugepages, nbd, userfaultfd) in the workflow steps can be flaky on GitHub-hosted ARM runners. The checkout@v4 nit is minor. The overall structure looks sound, but the operational risk of making a potentially-unavailable runner a merge gate is significant enough for a human to validate readiness.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}