Compare commits

..
11 Commits
Author SHA1 Message Date
Marcus Young bdc848c9a0 Bump to version 2.273.0 2020-08-19 09:53:13 -05:00
myoung34andGitHub 26ed21bcfc Merge pull request #44 from divlv/master
Notes regarding PAT scopes and privileges.
2020-08-06 13:52:32 -05:00
Dmitrijs ZaharovsandGitHub 5357aa869c Notes regarding PAT scopes and privileges. 2020-08-06 21:44:12 +03:00
Marcus Young d68d9f6fc8 Bump to version 2.272.0 2020-07-29 15:38:28 -04:00
myoung34andGitHub abd5a962b5 Create SECURITY.md 2020-07-28 10:55:08 -05:00
Marcus Young 7ccb4ed034 Update readme 2020-07-10 10:05:59 -05:00
myoung34andGitHub 531dbeab92 Merge pull request #40 from myoung34/actions_add
Add all workflows back
2020-07-06 07:51:16 -05:00
Marcus Young 814b400daf Add all workflows back 2020-07-06 07:50:48 -05:00
myoung34andGitHub c569803c05 Merge pull request #39 from myoung34/actions_remove
Trying fix for github actions cron mod
2020-07-06 07:49:44 -05:00
Marcus Young 57fd528ae9 Trying fix for github actions cron mod 2020-07-06 07:49:06 -05:00
Marcus Young fad3705687 Add scheduled builders 2020-07-05 20:18:54 -05:00
5 changed files with 65 additions and 9 deletions
+3
View File
@@ -6,6 +6,9 @@ on:
branches:
- master
- develop
schedule:
- cron: '0 22 * * *'
jobs:
ubuntu_base_latest_deploy:
+2
View File
@@ -7,6 +7,8 @@ on:
branches:
- master
- develop
schedule:
- cron: '59 23 * * *'
jobs:
ubuntu_latest_deploy:
+1 -1
View File
@@ -2,7 +2,7 @@
FROM myoung34/github-runner-base:latest
LABEL maintainer="myoung34@my.apsu.edu"
ARG GH_RUNNER_VERSION="2.267.1"
ARG GH_RUNNER_VERSION="2.273.0"
ARG TARGETPLATFORM
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+36 -8
View File
@@ -5,15 +5,29 @@ Docker Github Actions Runner
This will run the [new self-hosted github actions runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/hosting-your-own-runners).
This has been tested and verified on:
## Docker Artifacts ##
* x86_64
* armv7
* arm64
**NOTE:**
- **Only one runner can use the same RUNNER_WORKDIR if it is shared storage.**
- **RUNNER_WORKDIR must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files.**
| Container Base | Supported Architectures | Tag Regex | Docker Tags | Description |
| --- | --- | --- | --- | --- |
| ubuntu eoan | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+/` | [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. |
| ubuntu bionic | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). |
| ubuntu xenial | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). |
These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.
## Environment Variables ##
| Environment Variable | Description |
| --- | --- |
| `RUNNER_NAME` | The name of the runner to use. Supercedes (overrides) `RUNNER_NAME_PREFIX` |
| `RUNNER_NAME_PREFIX` | A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide `RUNNER_NAME`. Defaults to `github-runner` |
| `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
| `ORG_RUNNER` | Only valid if using `ACCESS_TOKEN`. This will set the runner to an org runner. Default is 'false'. Valid values are 'true' or 'false'. If this is set to true you must also set `ORG_NAME` and makes `REPO_URL` unneccesary |
| `ORG_NAME` | The organization name for the runner to register under. Requires `ORG_RUNNER` to be 'true'. No default value. |
| `LABELS` | A comma separated string to indicate the labels. Default is 'default' |
| `REPO_URL` | If using a non-organization runner this is the full repository url to register under such as 'https://github.com/myoung34/repo' |
| `RUNNER_TOKEN` | If not using a PAT for `ACCESS_TOKEN` this will be the runner token provided by the Add Runner UI (a manual process). Note: This token is short lived and will change frequently. `ACCESS_TOKEN` is likely preferred. |
| `RUNNER_WORKDIR` | The working directory for the runner. Runners on the same host should not share this directory. Default is '/_work'. This must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files. |
## Examples ##
@@ -215,3 +229,17 @@ docker run -d --restart always --name github-runner \
-v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
myoung34/github-runner:latest
```
## Create GitHub personal access token ##
Creating GitHub personal access token (PAT) for using by self-hosted runner make sure the following scopes are selected:
* repo (all)
* admin:org (all) **_(mandatory for organization-wide runner)_**
* admin:public_key - read:public_key
* admin:repo_hook - read:repo_hook
* admin:org_hook
* notifications
* workflow
Also, when creating a PAT for self-hosted runner which will process events from several repositories of the particular organization, create the PAT using organization owner account. Otherwise your new PAT will not have sufficient privileges for all repositories.
+23
View File
@@ -0,0 +1,23 @@
## Security
If you believe you have found a security vulnerability, please report it to me as described below.
## Reporting Security Issues
**Please do not report security vulnerabilities through public GitHub issues.** Instead, please report them to me directly at [myoung34@my.apsu.edu](mailto:myoung34@my.apsu.edu).
If you'd like to communicate securely, my keybase is [here](https://keybase.io/3vilpenguin)
Please include the requested information listed below (as much as you can provide) to help better understand the nature and scope of the possible issue:
* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
* Full paths of source file(s) related to the manifestation of the issue
* The location of the affected source code (tag/branch/commit or direct URL)
* Any special configuration required to reproduce the issue
* Step-by-step instructions to reproduce the issue
* Proof-of-concept or exploit code (if possible)
* Impact of the issue, including how an attacker might exploit the issue
## Preferred Languages
I prefer all communications to be in English.