x/build: support GitHub Actions runners as LUCI Swarming bots for windows/arm64

[qmuntal]

Background

The windows-arm64-11 builder currently runs on Azure VMs managed by the Go team. As part of expanding Windows ARM64 CI coverage and reducing reliance on Azure infrastructure, we'd like to use GitHub Actions windows-11-arm runners as LUCI Swarming bots.

GitHub Actions recently added native Windows ARM64 runners, which provide fresh, hermetic environments suitable for Go's CI needs.

Problem

LUCI Swarming expects bots to be pre-provisioned (always-on or auto-scaled VMs that run bootstrapswarm on startup). GitHub Actions runners are ephemeral — they're provisioned on demand per workflow run and destroyed afterward. There's currently no mechanism for LUCI to trigger GitHub Actions workflows when it needs a bot with specific dimensions, nor for GHA runners to authenticate with Swarming without long-lived credentials.

Proposed design

GHA workflow (golang.org/x/build)

A workflow_dispatch-triggered GitHub Actions workflow provisions a Windows 11 ARM64 runner that:

1. Installs dependencies
2. Authenticates with Google Cloud via Workload Identity Federation using GitHub's OIDC tokens (no stored secrets)
3. Runs bootstrapswarm.exe to register as a LUCI Swarming bot
4. LUCI schedules golangbuild on the bot, which handles the full build+test lifecycle

Authentication (OIDC federation)

GHA OIDC token → Workload Identity Federation → GCP service account token → Swarming identity token

• GitHub Actions provides per-job OIDC JWTs
• Workload Identity Federation in the golang-ci-luci GCP project exchanges them for GCP credentials
• bootstrapswarm uses the GCP identity token to authenticate with Swarming (same X-Luci-Gce-Vm-Token path as GCE bots)
• Attribute conditions restrict token exchange to the golang/go repository (or whatever repo end up running the workflow)

This requires a small change to bootstrapswarm to support GCP identity tokens from Workload Identity Federation (instead of only GCE metadata or luci_machine_tokend).

On-demand bot provisioning

A lightweight service (or Cloud Function) watches LUCI BuildBucket for pending builds that require windows-arm64-gha Swarming dimensions. When a pending build is detected:

1. Service dispatches a workflow_dispatch event via the GitHub API
2. GHA runner starts, runs bootstrapswarm, becomes a Swarming bot
3. Swarming assigns the pending golangbuild task to the new bot
4. Build runs; runner is destroyed when the workflow ends

This service could run alongside the existing coordinator or as a standalone Cloud Run service. The dispatch mechanism would use a GitHub App to authenticate. The service would store the GitHub App private key as a secret, and golang/go would have the app installed.

CC @golang/release @dmitshur

[qmuntal]

Note that supporting GitHub Actions would open the door to better supporting builders for platforms other than windows/arm64. For example, GitHub Actions has good support for macOS and RISC-V runners, or even swapping windows/amd64 runners to GitHub Actions for a better Windows-builder consistency.

[gabyhelp]

Related Issues

• x/build: add LUCI windows-arm64 builder #64587 (closed)
• x/build: add a windows/arm builder using a windows/arm64 host #57960 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}