feat: custom toolchain image for host-mode Gitea Actions runner

Adds the Dockerfile (FROM code.forgejo.org/forgejo/runner:12.11.1, plus node/git/bash/coreutils/curl/tar/make/ca-certificates) and a README with the multi-arch build/push workflow. Built and pushed as gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci; consumed by flux-config applications/forgejo-runner. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-06-16 11:54:04 +02:00
commit 9886437b2f
@@ -0,0 +1,43 @@
+# Custom toolchain image for the self-hosted Gitea Actions (Forgejo) runner.
+#
+# The cluster runs act_runner in *host mode* (docker disabled), so workflow steps
+# execute INSIDE this image. The stock forgejo/runner image is minimal and lacks
+# node (needed by JS actions: actions/checkout, setup-go, ...), git, make, etc.
+# The runner pod is non-root with all caps dropped, so it cannot apt/apk-add at
+# runtime -- the tools must be baked in here.
+#
+# Build multi-arch (cluster is mixed amd64/arm64) and push to the Gitea registry:
+#
+#   docker buildx create --use --name zegit-ci 2>/dev/null || true
+#   docker login gitea.langenoja.se        # username + a Gitea personal access token
+#   docker buildx build --platform linux/amd64,linux/arm64 \
+#     -t gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci --push .
+#
+# Then in flux-config set both containers' image: to the tag above and commit.
+# Package visibility is PUBLIC, so the runner namespace pulls without a secret.
+FROM code.forgejo.org/forgejo/runner:12.11.1
+
+USER root
+
+# nodejs   -> JS actions runtime (actions/checkout, actions/setup-go, ...)
+# git      -> checkout
+# bash     -> `shell: bash` steps and many action entrypoints
+# coreutils-> GNU userland (alpine busybox tools trip up some scripts)
+# curl,tar -> setup-go / gitleaks download + extract their own arch-specific binaries
+# make     -> zegit Makefile targets
+# ca-certificates -> trusted roots for HTTPS to gitea/github/goproxy
+#
+# Go is intentionally NOT baked in: actions/setup-go fetches the pinned version
+# per-run (node + tar are present), so the image needs no rebuild on Go bumps.
+RUN apk add --no-cache \
+      nodejs \
+      git \
+      bash \
+      coreutils \
+      curl \
+      tar \
+      make \
+      ca-certificates
+
+# Match the runner pod's runAsUser (1000); keep the image non-root by default.
+USER 1000