Use Pants'-managed runs-on runners for Linux aarch64 CI (#427)

This replaces our use of Circle CI's arm64 Linux runners for both
testing and releasing with the runs-on runners that Pantsbuild
configures (and pays for) in AWS, via https://runs-on.com

This has a few benefits:

- single tool to learn for configuring CI
- single source of credentials (currently the release build is failing
due to a token seemingly being invalid, but it's not obvious to me how
to fix this)
- more atomicity, e.g. instead of the release needing to trigger a
separate Circle CI build that runs in the background, we can just use
the normal GitHub "wait for another job" rules

It also has downsides: we're going from free resources to paid. However,
the incremental cost for the scie-pants repo should be quite small,
compared to the main pants repo:

- this repo is low volume (over the last 12 months we've done about 220
CI runs total)
- things run quickly (in this PR, ~7 minutes without a cache, ~4 minutes
with)

I estimated cost based on US$0.1344/hour for a on-demand t4g.xlarge 4
core instance in us-east-1 (I'm not sure this is our exact
configuration). Prices in practice may be cheaper, because Runs-On
attempts to use [spot
instances](https://runs-on.com/configuration/spot-instances/)).

- per build, we're looking at US$0.0090 (with cache) to US$0.016
(without cache)
- per month, we're looking at ~20 builds, so US$0.18 to US$0.32 (but
likely cheaper given this is on-demand costs)

If this starts adding up a lot, we can likely optimise. For instance:
optimise spot-instance selection for lowest cost not "PCO", and use more
caching (whether that's coarse-grained `actions/cache` or fine-grained
`sccache`).

Fixes #422, fixes #430

.github/workflows/ci.yml

@@ -23,12 +23,27 @@ jobs:
       - name: Noop
         run: "true"
   ci:
-    name: (${{ matrix.os }}) CI
+    name: (${{ matrix.name }}) CI
     needs: org-check
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, macOS-10.15-X64, macOS-11-ARM64, windows-2022]
+        include:
+          - os: ubuntu-22.04
+            name: ubuntu-22.04
+
+          - os: [runs-on, runner=4cpu-linux-arm64, image=ubuntu22-full-arm64-python3.7-3.13, "run-id=${{ github.run_id }}"]
+            name: linux-arm64
+
+          - os: macOS-10.15-X64
+            name: macOS-10.15-X64
+
+          - os: macOS-11-ARM64
+            name: macOS-11-ARM64
+
+          - os: windows-2022
+            name: windows-2022
+
     env:
       PY: python3.9
       SCIE_PANTS_DEV_CACHE: .scie_pants_dev_cache
@@ -64,7 +79,7 @@ jobs:
       # required for the PANTS_SOURCE tests, which build a version of Pants that requires an external protoc
       - name: Install Protoc
         uses: arduino/setup-protoc@9b1ee5b22b0a3f1feb8c2ff99b32c89b3c3191e9
-        if: ${{ matrix.os == 'macOS-10.15-X64' || matrix.os == 'macOS-11-ARM64' || matrix.os == 'ubuntu-22.04' }}
+        if: ${{ matrix.os == 'macOS-10.15-X64' || matrix.os == 'macOS-11-ARM64' || matrix.os == 'ubuntu-22.04' || matrix.name == 'linux-arm64' }}
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           version: 23.x
@@ -85,7 +100,7 @@ jobs:
           PANTS_BOOTSTRAP_GITHUB_API_BEARER_TOKEN=${{ secrets.GITHUB_TOKEN }} \
             cargo run -p package -- test --check --tools-pex-mismatch-warn
       - name: Build, Package & Integration Tests (Ubuntu)
-        if: ${{ matrix.os == 'ubuntu-22.04' }}
+        if: ${{ matrix.os == 'ubuntu-22.04' || matrix.name == 'linux-arm64' }}
         run: |
           cargo run -p package -- --dest-dir dist/ tools
           docker run --rm \

.github/workflows/release.yml

@@ -54,23 +54,34 @@ jobs:
             exit 1
           fi
   github-release:
-    name: (${{ matrix.os }}) Create Github Release
+    name: (${{ matrix.name }}) Create Github Release
     needs: determine-tag
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ ubuntu-22.04, macOS-10.15-X64, macOS-11-ARM64 ]
+        include:
+          - os: ubuntu-22.04
+            name: ubuntu-22.04
+
+          - os: [runs-on, runner=4cpu-linux-arm64, image=ubuntu22-full-arm64-python3.7-3.13, "run-id=${{ github.run_id }}"]
+            name: linux-arm64
+
+          - os: macOS-10.15-X64
+            name: macOS-10.15-X64
+
+          - os: macOS-11-ARM64
+            name: macOS-11-ARM64
     environment: Release
     steps:
       - name: Checkout scie-pants ${{ needs.determine-tag.outputs.release-tag }}
         uses: actions/checkout@v3
         with:
           ref: ${{ needs.determine-tag.outputs.release-tag }}
       - name: Package scie-pants ${{ needs.determine-tag.outputs.release-tag }} binary
-        if: ${{ matrix.os != 'ubuntu-22.04' }}
+        if: ${{ matrix.os != 'ubuntu-22.04' && matrix.name != 'linux-arm64' }}
         run: cargo run -p package -- --dest-dir dist/ scie
       - name: Package scie-pants ${{ needs.determine-tag.outputs.release-tag }} binary
-        if: ${{ matrix.os == 'ubuntu-22.04' }}
+        if: ${{ matrix.os == 'ubuntu-22.04' || matrix.name == 'linux-arm64' }}
         run: |
           cargo run -p package -- --dest-dir dist/ tools
           docker run --rm \
@@ -103,25 +114,11 @@ jobs:
           files: dist/scie-pants-*
           fail_on_unmatched_files: true
           discussion_category_name: Announcements
-  aarch64-release-trigger:
-    name: Trigger Circle CI Linux aarch64 Github Release
-    needs:
-      - determine-tag
-      - github-release
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Trigger aarch64 release
-        uses: CircleCI-Public/[email protected]
-        with:
-          GHA_Meta: "${{ needs.determine-tag.outputs.release-tag }}"
-        env:
-          CCI_TOKEN: ${{ secrets.CCI_TOKEN }}
   announce-release:
     name: Announce Release
     needs:
       - determine-tag
       - github-release
-      - aarch64-release-trigger
     runs-on: ubuntu-22.04
     steps:
       - name: Post Release Announcement to Pants Slack `#announce`
@@ -141,13 +138,6 @@ jobs:
                     "type": "mrkdwn",
                     "text": "The `pants` launcher binary (scie-pants) ${{ needs.determine-tag.outputs.release-tag }} is released:\n* https://github.com/pantsbuild/scie-pants/releases/tag/${{ needs.determine-tag.outputs.release-tag }}\n* https://www.pantsbuild.org/docs/installation"
                   }
-                },
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "_N.B.: The Linux aarch64 release will lag by ~15 minutes._"
-                  }
                 }
               ]
             }