[Automated 🤖 ] Bump to version 2.299.1

Fix ephemeral support

.github/workflows/base.yml

@@ -3,89 +3,106 @@ on:
   push:
     paths:
       - Dockerfile.base
+      - .github/workflows/base.yml
     branches:
       - master
       - develop
   schedule:
     - cron:  '0 22 * * *'
 
-
 jobs:
   ubuntu_base_latest_deploy:
     runs-on: ubuntu-latest
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.base -t ${ORG}/github-runner-base:latest --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_base_bionic_deploy:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.base
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner-base:latest
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  ubuntu_base_deploy:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile.base Dockerfile.base.ubuntu-bionic; sed -i.bak 's/FROM.*/FROM ubuntu:bionic/' Dockerfile.base.ubuntu-bionic
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.base.ubuntu-bionic -t ${ORG}/github-runner-base:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_base_xenial_deploy:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.base.ubuntu-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  debian_base_deploy:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bullseye, sid]
+      fail-fast: false
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile.base Dockerfile.base.ubuntu-xenial; sed -i.bak 's/FROM.*/FROM ubuntu:xenial/' Dockerfile.base.ubuntu-xenial
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.base.ubuntu-xenial -t ${ORG}/github-runner-base:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_base_focal_deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile.base Dockerfile.base.ubuntu-focal; sed -i.bak 's/FROM.*/FROM ubuntu:focal/' Dockerfile.base.ubuntu-focal
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.base.ubuntu-focal -t ${ORG}/github-runner-base:ubuntu-focal --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.base.debian-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/deploy.yml

@@ -10,82 +10,123 @@ on:
   schedule:
     - cron:  '59 23 * * *'
 
+permissions: 
+  contents: read
+  packages: write 
+
 jobs:
   ubuntu_latest_deploy:
     runs-on: ubuntu-latest
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile -t ${ORG}/github-runner:latest --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_bionic_deploy:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Update Dockerfile FROM org
+        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:latest,ghcr.io/${{ github.repository }}:latest
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  ubuntu_deploy:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-bionic; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-bionic/" Dockerfile.ubuntu-bionic
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_xenial_deploy:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.ubuntu-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{env.ORG}}/github-runner:ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  debian_deploy:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bullseye, sid]
+      fail-fast: false
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-xenial; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-xenial/" Dockerfile.ubuntu-xenial
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_focal_deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-focal; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-focal/" Dockerfile.ubuntu-focal
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-focal -t ${ORG}/github-runner:ubuntu-focal --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.debian-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:debian-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/release.yml

@@ -4,6 +4,10 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   create-release:
     name: Create Release
@@ -21,93 +25,128 @@ jobs:
         release_name: Release ${{ github.ref }}
         draft: false
         prerelease: false
+
   ubuntu_latest_tag:
     runs-on: ubuntu-latest
     needs: create-release
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile -t ${ORG}/github-runner:${TAG} --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_bionic_tag:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: get version
+        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Update Dockerfile FROM org
+        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }},ghcr.io/${{ github.repository }}:${{ env.TAG }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  ubuntu_tag:
     runs-on: ubuntu-latest
     needs: create-release
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-bionic; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-bionic/" Dockerfile.ubuntu-bionic
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:${TAG}-ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_xenial_tag:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: get version
+        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.ubuntu-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  debian_tag:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bullseye, sid]
+      fail-fast: false
     needs: create-release
     steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-xenial; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-xenial/" Dockerfile.ubuntu-xenial
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:${TAG}-ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_focal_tag:
-    runs-on: ubuntu-latest
-    needs: create-release
-    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
-    - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-focal; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-focal/" Dockerfile.ubuntu-focal
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-focal -t ${ORG}/github-runner:${TAG}-ubuntu-focal --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: get version
+        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.debian-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-debian-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/test.yml

@@ -0,0 +1,15 @@
+on:
+  pull_request:
+
+name: "Trigger: Push action"
+
+jobs:
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-python@v3
+      - uses: pre-commit/action@v3.0.0
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master

.pre-commit-config.yaml

@@ -1,8 +1,13 @@
 repos:
-- repo: git://github.com/detailyang/pre-commit-shell
-  rev: 1.0.2
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.3.0
   hooks:
-  - id: shell-lint
+  - id: check-yaml
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
+  - id: check-case-conflict
+  - id: check-merge-conflict
+  - id: detect-private-key
 - repo: https://github.com/stratasan/hadolint-pre-commit
   rev: cdefcb096e520a6daa9552b1d4636f5f1e1729cd
   hooks:

.tool-versions

@@ -0,0 +1 @@
+shellcheck 0.7.0

CONTRIBUTING.md

@@ -0,0 +1,17 @@
+# Welcome to docker-github-actions-runner contributing guide <!-- omit in toc -->
+
+Welcome!
+
+## Code of conduct
+
+Be kind, research before asking/contributing.
+
+Please remember that my time is limited and my resources are as well. Solving "nuances" will likely require external contributions but I'm happy to help and guide.
+
+### Issues
+
+#### Create a new issue
+
+If you spot an issue, [search if an issue already exists](https://docs.github.com/en/github/searching-for-information-on-github/searching-on-github/searching-issues-and-pull-requests#search-by-the-title-body-or-comments). If a related issue doesn't exist, you can open a new issue using a relevant issue.
+
+Also use [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki) and contribute to it

Dockerfile

@@ -2,7 +2,10 @@
 FROM myoung34/github-runner-base:latest
 LABEL maintainer="myoung34@my.apsu.edu"
 
-ARG GH_RUNNER_VERSION="2.273.4"
+ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
+RUN mkdir -p /opt/hostedtoolcache
+
+ARG GH_RUNNER_VERSION="2.299.1"
 ARG TARGETPLATFORM
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -12,11 +15,11 @@ COPY install_actions.sh /actions-runner
 
 RUN chmod +x /actions-runner/install_actions.sh \
   && /actions-runner/install_actions.sh ${GH_RUNNER_VERSION} ${TARGETPLATFORM} \
-  && rm /actions-runner/install_actions.sh
+  && rm /actions-runner/install_actions.sh \
+  && chown runner /_work /actions-runner /opt/hostedtoolcache
 
-COPY token.sh /
-RUN chmod +x /token.sh
+COPY token.sh entrypoint.sh /
+RUN chmod +x /token.sh /entrypoint.sh
 
-COPY entrypoint.sh /
-RUN chmod +x /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
+CMD ["./bin/Runner.Listener", "run", "--startuptype", "service"]

Dockerfile.base

@@ -1,44 +1,79 @@
-FROM ubuntu:eoan
+FROM ubuntu:focal
 LABEL maintainer="myoung34@my.apsu.edu"
 
-ARG GIT_VERSION="2.26.2"
-ENV DOCKER_COMPOSE_VERSION="1.26.2"
+ARG DUMB_INIT_VERSION="1.2.2"
+ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
 
+ENV DOCKER_COMPOSE_VERSION="1.27.4"
+ENV GIT_LFS_VERSION="3.2.0"
+ENV LANG=en_US.UTF-8
+ENV LANGUAGE=en_US.UTF-8
+ENV LC_ALL=en_US.UTF-8
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
-# hadolint ignore=DL3003
-RUN apt-get update && \
-  apt-get install -y --no-install-recommends \
-    awscli \
+# hadolint ignore=SC2086,DL3015,DL3008,DL3013
+RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends gnupg \
+  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends \
+    gnupg \
+    lsb-release \
     curl \
     tar \
     unzip \
     apt-transport-https \
     ca-certificates \
     sudo \
-    gnupg-agent \
+    gpg-agent \
     software-properties-common \
     build-essential \
     zlib1g-dev \
+    zstd \
     gettext \
-    liblttng-ust0 \
     libcurl4-openssl-dev \
     inetutils-ping \
     jq \
-  && c_rehash \
-  && cd /tmp \
-  && curl -sL https://www.kernel.org/pub/software/scm/git/git-${GIT_VERSION}.tar.gz -o git.tgz \
-  && tar zxf git.tgz \
-  && cd git-${GIT_VERSION} \
-  && ./configure --prefix=/usr \
-  && make \
-  && make install \
-  && cd / \
-  && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
-  && [[ $(lsb_release -cs) == "eoan" ]] && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu disco stable" ) || ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" ) \
+    wget \
+    dirmngr \
+    openssh-client \
+    locales \
+    python3-pip \
+    python3-setuptools \
+    python3 \
+    dumb-init \
+    nodejs \
+    rsync \
+    gosu \
+  && DPKG_ARCH="$(dpkg --print-architecture)" \
+  && LSB_RELEASE_CODENAME="$(lsb_release --codename | cut -f2)" \
+  && sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers \
+  && echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu $([[ $(grep -E '^ID=' /etc/os-release | sed 's/.*=//g') == "ubuntu" ]] && (grep VERSION_CODENAME /etc/os-release | sed 's/.*=//g') || echo bionic) main>/etc/apt/sources.list.d/git-core.list \
   && apt-get update \
-  && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends \
-  && curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose \
-  && chmod +x /usr/local/bin/docker-compose \
+  && ( apt-get install -y --no-install-recommends git || apt-get install -t stable -y --no-install-recommends git || apt-get install -y --no-install-recommends git=1:2.33.1-0ppa1~ubuntu18.04.1 git-man=1:2.33.1-0ppa1~ubuntu18.04.1 ) \
+  && ( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] && apt-get install -y --no-install-recommends liblttng-ust0 || : ) \
+  && ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
+  && ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install && rm awscliv2.zip) || pip3 install --no-cache-dir awscli ) \
+  && ( curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz && tar -xzf /tmp/lfs.tar.gz -C /tmp && /tmp/git-lfs-${GIT_LFS_VERSION}/install.sh && rm -rf /tmp/lfs.tar.gz  /tmp/git-lfs-${GIT_LFS_VERSION}) \
+  && distro=$(lsb_release -is | awk '{print tolower($0)}') \
+  && mkdir -p /etc/apt/keyrings \
+  && ( curl -fsSL https://download.docker.com/linux/${distro}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg ) \
+  && version=$(lsb_release -cs | sed 's/bookworm\|n\/a/bullseye/g') \
+  && ( echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${distro} ${version} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null ) \
+  && apt-get update \
+  && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends --allow-unauthenticated \
+  && ( [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose ) ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/Release.key" | apt-key add - && apt-get update) || : ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" || "${LSB_RELEASE_CODENAME}" == "jammy" || "${LSB_RELEASE_CODENAME}" == "sid" || "${LSB_RELEASE_CODENAME}" == "bullseye" ]] && apt-get install -y --no-install-recommends podman buildah skopeo || : ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "jammy" ]] && echo "Ubuntu Jammy is marked as beta. Please see https://github.com/actions/virtual-environments/issues/5490" || : ) \
+  && GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
+  && GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" | jq -r '.browser_download_url') \
+  && curl -sSLo /tmp/ghcli.deb ${GH_CLI_DOWNLOAD_URL} && apt-get -y install /tmp/ghcli.deb && rm /tmp/ghcli.deb \
   && rm -rf /var/lib/apt/lists/* \
-  && rm -rf /tmp/*
+  && rm -rf /tmp/* \
+  && groupadd -g 121 runner \
+  && useradd -mr -d /home/runner -u 1001 -g 121 runner \
+  && usermod -aG sudo runner \
+  && usermod -aG docker runner \
+  && echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers

README.md

@@ -1,18 +1,51 @@
 Docker Github Actions Runner
 ============================
 
-[![Docker Pulls](https://img.shields.io/docker/pulls/myoung34/github-runner.svg)](https://hub.docker.com/r/myoung34/github-runner)
+[![Docker Pulls](https://img.shields.io/docker/pulls/myoung34/github-runner.svg)](https://hub.docker.com/r/myoung34/github-runner) [![awesome-runners](https://img.shields.io/badge/listed%20on-awesome--runners-blue.svg)](https://github.com/jonico/awesome-runners)
 
 This will run the [new self-hosted github actions runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/hosting-your-own-runners).
 
+## Quick-Start (Examples and Usage) ##
+
+Please see [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage)
+Please read [the contributing guidelines](https://github.com/myoung34/docker-github-actions-runner/blob/master/CONTRIBUTING.md)
+
+## Notes ##
+
+### Security ###
+
+It is known that currently tokens (ACCESS_TOKEN / RUNNER_TOKEN ) are not safe from exfiltration.
+If you are using this runner make sure that any workflow changes are gated by a verification process (in the actions settings) so that malicious PR's cannot exfiltrate these.
+
+### Docker Support ###
+
+Please note that while this runner installs and allows docker, github actions itself does not support using docker from a self hosted runner yet.
+For more information:
+
+* https://github.com/actions/runner/issues/406
+* https://github.com/actions/runner/issues/367
+
+Also, some GitHub Actions Workflow features, like [Job Services](https://docs.github.com/en/actions/guides/about-service-containers), won't be usable and [will result in an error](https://github.com/myoung34/docker-github-actions-runner/issues/61).
+
+### Containerd Support ###
+
+Currently runners [do not support containerd](https://github.com/actions/runner/issues/1265)
+
+### Docker-Compose on ARM ###
+
+Please note `docker-compose` does not currently work on ARM ([see issue](https://github.com/docker/compose/issues/6831)) so it is not installed on ARM based builds here.
+A workaround exists, please see [here](https://github.com/myoung34/docker-github-actions-runner/issues/72#issuecomment-804723656)
+
 ## Docker Artifacts ##
 
-| Container Base | Supported Architectures | Tag Regex | Docker Tags | Description |
-| --- | --- | --- | --- | --- |
-| ubuntu eoan | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+/` | [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. |
-| ubuntu bionic | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | 
-| ubuntu xenial | `x86_64`,`armv7`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). |
-| ubuntu focal | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-focal/` | [ubuntu-focal](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-focal) | This is the latest build from focal (Rebuilt nightly and on master merges). Tags with `-ubuntu-focal` are included and created on [upstream tags](https://github.com/actions/runner/tags). |
+| Container Base | Supported Architectures | Tag Regex | Docker Tags | Description | Notes |
+| --- | --- | --- | --- | --- | --- |
+| ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` `/\d\.\d{3}\.\d+-ubuntu-focal/`| [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) [ubuntu-focal](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-focal) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. Tags with `-ubuntu-focal` are included and created on [upstream tags](https://github.com/actions/runner/tags).|
+| ubuntu jammy | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-jammy/` | [ubuntu-jammy](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-jammy) | This is the latest build from jammy (Rebuilt nightly and on master merges). Tags with `-ubuntu-jammy` are included and created on [upstream tags](https://github.com/actions/runner/tags). | There is [currently an issue with jammy from inside a 20.04LTS host](https://github.com/myoung34/docker-github-actions-runner/issues/219) which is why this is not `latest` |
+| ubuntu bionic | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian bullseye | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-bullseye/` | [debian-bullseye](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bullseye) | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with `-debian-bullseye` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian sid | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 
 These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.
 
@@ -20,227 +53,20 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 
 | Environment Variable | Description |
 | --- | --- |
+| `RUN_AS_ROOT` | Boolean to run as root. If `true`: will run as root. If `True` and the user is overridden it will error. If any other value it will run as the `runner` user and allow an optional override. Default is `true` |
 | `RUNNER_NAME` | The name of the runner to use. Supercedes (overrides) `RUNNER_NAME_PREFIX` |
 | `RUNNER_NAME_PREFIX` | A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide `RUNNER_NAME`. Defaults to `github-runner` |
 | `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
-| `ORG_RUNNER` | Only valid if using `ACCESS_TOKEN`. This will set the runner to an org runner. Default is 'false'. Valid values are 'true' or 'false'. If this is set to true you must also set `ORG_NAME` and makes `REPO_URL` unneccesary |
-| `ORG_NAME` | The organization name for the runner to register under. Requires `ORG_RUNNER` to be 'true'. No default value. |
+| `RUNNER_SCOPE` | The scope the runner will be registered on. Valid values are `repo`, `org` and `ent`. For 'org' and 'enterprise', `ACCESS_TOKEN` is required and `REPO_URL` is unnecessary. If 'org', requires `ORG_NAME`; if 'enterprise', requires `ENTERPRISE_NAME`. Default is 'repo'. |
+| `ORG_NAME` | The organization name for the runner to register under. Requires `RUNNER_SCOPE` to be 'org'. No default value. |
+| `ENTERPRISE_NAME` | The enterprise name for the runner to register under. Requires `RUNNER_SCOPE` to be 'enterprise'. No default value. |
 | `LABELS` | A comma separated string to indicate the labels. Default is 'default' |
 | `REPO_URL` | If using a non-organization runner this is the full repository url to register under such as 'https://github.com/myoung34/repo' |
 | `RUNNER_TOKEN` | If not using a PAT for `ACCESS_TOKEN` this will be the runner token provided by the Add Runner UI (a manual process). Note: This token is short lived and will change frequently. `ACCESS_TOKEN` is likely preferred. |
 | `RUNNER_WORKDIR` | The working directory for the runner. Runners on the same host should not share this directory. Default is '/_work'. This must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files. |
-
-## Examples ##
-
-### Note ###
-
-If you're using a RHEL based OS with SELinux, add `--security-opt=label=disable` to prevent [permission denied](https://github.com/myoung34/docker-github-actions-runner/issues/9)
-
-### Manual ###
-
-```
-# org runner 
-docker run -d --restart always --name github-runner \
-  -e RUNNER_NAME_PREFIX="myrunner" \
-  -e ACCESS_TOKEN="footoken" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e ORG_RUNNER="true" \
-  -e ORG_NAME="octokode" \
-  -e LABELS="my-label,other-label" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-# per repo
-docker run -d --restart always --name github-runner \
-  -e REPO_URL="https://github.com/myoung34/repo" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_TOKEN="footoken" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-Or shell wrapper:
-
-```
-function github-runner {
-    name=github-runner-${1//\//-}
-    org=$(dirname $1)
-    repo=$(basename $1)
-    tag=${3:-latest}
-    docker rm -f $name
-    docker run -d --restart=always \
-        -e REPO_URL="https://github.com/${org}/${repo}" \
-        -e RUNNER_TOKEN="$2" \
-        -e RUNNER_NAME="linux-${repo}" \
-        -e RUNNER_WORKDIR="/tmp/github-runner-${repo}" \
-        -e LABELS="my-label,other-label" \
-        -v /var/run/docker.sock:/var/run/docker.sock \
-        -v /tmp/github-runner-${repo}:/tmp/github-runner-${repo} \
-        --name $name ${org}/github-runner:${tag}
-}
-
-github-runner your-account/your-repo       AARGHTHISISYOURGHACTIONSTOKEN
-github-runner your-account/some-other-repo ARGHANOTHERGITHUBACTIONSTOKEN ubuntu-xenial
-```
-
-Or `docker-compose.yml`:
-```yml
-version: '2.3'
-
-services:
-  worker:
-    build: .
-    image: myoung34/github-runner:latest
-    environment:
-      REPO_URL: https://github.com/example/repo
-      RUNNER_NAME: example-name
-      RUNNER_TOKEN: someGithubTokenHere
-      RUNNER_WORKDIR: /tmp/runner/work
-      ORG_RUNNER: 'false'
-      LABELS: linux,x64,gpu
-    security_opt:
-      # needed on SELinux systems to allow docker container to manage other docker containers
-      - label:disable
-    volumes:
-      - '/var/run/docker.sock:/var/run/docker.sock'
-      - '/tmp/runner:/tmp/runner'
-      # note: a quirk of docker-in-docker is that this path 
-      # needs to be the same path on host and inside the container,
-      # docker mgmt cmds run outside of docker but expect the paths from within
-```
-
-### Nomad ###
-
-```
-job "github_runner" {
-  datacenters = ["home"]
-  type = "system"
-
-  task "runner" {
-    driver = "docker"
-
-    env {
-      ACCESS_TOKEN       = "footoken"
-      RUNNER_NAME_PREFIX = "myrunner" \
-      RUNNER_WORKDIR     = "/tmp/github-runner-your-repo"
-      ORG_RUNNER         = "true"
-      ORG_NAME           = "octokode"
-      LABELS             = "my-label,other-label"
-    }
-
-    config {
-      privileged = true
-      image = "myoung34/github-runner:latest"
-      volumes = [
-        "/var/run/docker.sock:/var/run/docker.sock",
-        "/tmp/github-runner-your-repo:/tmp/github-runner-your-repo",
-      ]
-    }
-  }
-}
-```
-
-### Kubernetes ###
-
-```
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: actions-runner
-  namespace: runners
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: actions-runner
-  template:
-    metadata:
-      labels:
-        app: actions-runner
-    spec:
-      volumes:
-      - name: dockersock
-        hostPath:
-          path: /var/run/docker.sock
-      - name: workdir
-        hostPath:
-          path: /tmp/github-runner-your-repo
-      containers:
-      - name: runner
-        image: myoung34/github-runner:latest
-        env:
-        - name: ORG_RUNNER
-          value: true
-        - name: ORG_NAME
-          value: octokode
-        - name: LABELS
-          value: my-label,other-label
-        - name: RUNNER_TOKEN
-          value: footoken
-        - name: REPO_URL
-          value: https://github.com/your-account/your-repo
-        - name: RUNNER_NAME_PREFIX
-          value: foo
-        - name: RUNNER_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: RUNNER_WORKDIR
-          value: /tmp/github-runner-your-repo
-        volumeMounts:
-        - name: dockersock
-          mountPath: /var/run/docker.sock
-        - name: workdir
-          mountPath: /tmp/github-runner-your-repo
-```
-
-## Usage From GH Actions Workflow ##
-
-```
-name: Package
-
-on:
-  release:
-    types: [created]
-
-jobs:
-  build:
-    runs-on: self-hosted
-    steps:
-    - uses: actions/checkout@v1
-    - name: build packages
-      run: make all
-```
-
-## Automatically Acquiring a Runner Token  ##
-
-A runner token can be automatically acquired at runtime if `ACCESS_TOKEN` (a GitHub personal access token) is a supplied. This uses the [GitHub Actions API](https://developer.github.com/v3/actions/self_hosted_runners/#create-a-registration-token). e.g.:
-
-```
-docker run -d --restart always --name github-runner \
-  -e ACCESS_TOKEN="footoken" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e ORG_RUNNER="true" \
-  -e ORG_NAME="octokode" \
-  -e LABELS="my-label,other-label" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-## Create GitHub personal access token  ##
-
-Creating GitHub personal access token (PAT) for using by self-hosted runner make sure the following scopes are selected:
-
-* repo (all)
-* admin:org (all) **_(mandatory for organization-wide runner)_**
-* admin:public_key - read:public_key
-* admin:repo_hook - read:repo_hook
-* admin:org_hook
-* notifications
-* workflow
- 
-Also, when creating a PAT for self-hosted runner which will process events from several repositories of the particular organization, create the PAT using organization owner account. Otherwise your new PAT will not have sufficient privileges for all repositories.
+| `RUNNER_GROUP` | Name of the runner group to add this runner to (defaults to the default runner group) |
+| `GITHUB_HOST` | Optional URL of the Github Enterprise server e.g github.mycompany.com. Defaults to `github.com`. |
+| `DISABLE_AUTOMATIC_DEREGISTRATION` | Optional flag to disable signal catching for deregistration. Default is `false`. Any value other than exactly `false` is considered `true`. See [here](https://github.com/myoung34/docker-github-actions-runner/issues/94) |
+| `CONFIGURED_ACTIONS_RUNNER_FILES_DIR` | Path to use for runner data. It allows avoiding reregistration each the start of the runner. No default value. |
+| `EPHEMERAL` | Optional flag to configure runner with [`--ephemeral` option](https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling). Ephemeral runners are suitable for autoscaling. |
+| `DISABLE_AUTO_UPDATE` | Optional environment variable to [disable auto updates](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/). Auto updates are enabled by default to preserve past behavior. Any value is considered truthy and will disable them. |

SECURITY.md

@@ -4,7 +4,7 @@ If you believe you have found a security vulnerability, please report it to me a
 
 ## Reporting Security Issues
 
-**Please do not report security vulnerabilities through public GitHub issues.** Instead, please report them to me directly at [myoung34@my.apsu.edu](mailto:myoung34@my.apsu.edu).  
+**Please do not report security vulnerabilities through public GitHub issues.** Instead, please report them to me directly at [myoung34@my.apsu.edu](mailto:myoung34@my.apsu.edu).
 
 If you'd like to communicate securely, my keybase is [here](https://keybase.io/3vilpenguin)
 

entrypoint.sh

@@ -1,42 +1,147 @@
-#!/bin/bash
+#!/usr/bin/dumb-init /bin/bash
+# shellcheck shell=bash
 
 export RUNNER_ALLOW_RUNASROOT=1
 export PATH=$PATH:/actions-runner
 
+# Un-export these, so that they must be passed explicitly to the environment of
+# any command that needs them.  This may help prevent leaks.
+export -n ACCESS_TOKEN
+export -n RUNNER_TOKEN
+
 deregister_runner() {
   echo "Caught SIGTERM. Deregistering runner"
-  _TOKEN=$(bash /token.sh)
-  RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  if [[ -n "${ACCESS_TOKEN}" ]]; then
+    _TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" bash /token.sh)
+    RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  fi
   ./config.sh remove --token "${RUNNER_TOKEN}"
   exit
 }
 
+_DISABLE_AUTOMATIC_DEREGISTRATION=${DISABLE_AUTOMATIC_DEREGISTRATION:-false}
+
 _RUNNER_NAME=${RUNNER_NAME:-${RUNNER_NAME_PREFIX:-github-runner}-$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 13 ; echo '')}
 _RUNNER_WORKDIR=${RUNNER_WORKDIR:-/_work}
 _LABELS=${LABELS:-default}
-_SHORT_URL=${REPO_URL}
+_RUNNER_GROUP=${RUNNER_GROUP:-Default}
+_GITHUB_HOST=${GITHUB_HOST:="github.com"}
+_RUN_AS_ROOT=${RUN_AS_ROOT:="true"}
 
-if [[ ${ORG_RUNNER} == "true" ]]; then
-  _SHORT_URL="https://github.com/${ORG_NAME}"
+# ensure backwards compatibility
+if [[ -z $RUNNER_SCOPE ]]; then
+  if [[ ${ORG_RUNNER} == "true" ]]; then
+    echo 'ORG_RUNNER is now deprecated. Please use RUNNER_SCOPE="org" instead.'
+    export RUNNER_SCOPE="org"
+  else
+    export RUNNER_SCOPE="repo"
+  fi
 fi
 
-if [[ -n "${ACCESS_TOKEN}" ]]; then
-  _TOKEN=$(bash /token.sh)
-  RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
-  _SHORT_URL=$(echo "${_TOKEN}" | jq -r .short_url)
+RUNNER_SCOPE="${RUNNER_SCOPE,,}" # to lowercase
+
+case ${RUNNER_SCOPE} in
+  org*)
+    [[ -z ${ORG_NAME} ]] && ( echo "ORG_NAME required for org runners"; exit 1 )
+    _SHORT_URL="https://${_GITHUB_HOST}/${ORG_NAME}"
+    RUNNER_SCOPE="org"
+    ;;
+
+  ent*)
+    [[ -z ${ENTERPRISE_NAME} ]] && ( echo "ENTERPRISE_NAME required for enterprise runners"; exit 1 )
+    _SHORT_URL="https://${_GITHUB_HOST}/enterprises/${ENTERPRISE_NAME}"
+    RUNNER_SCOPE="enterprise"
+    ;;
+
+  *)
+    [[ -z ${REPO_URL} ]] && ( echo "REPO_URL required for repo runners"; exit 1 )
+    _SHORT_URL=${REPO_URL}
+    RUNNER_SCOPE="repo"
+    ;;
+esac
+
+configure_runner() {
+  ARGS=()
+  if [[ -n "${ACCESS_TOKEN}" ]]; then
+    echo "Obtaining the token of the runner"
+    _TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" bash /token.sh)
+    RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  fi
+
+  # shellcheck disable=SC2153
+  if [ -n "${EPHEMERAL}" ]; then
+    echo "Ephemeral option is enabled"
+    ARGS+=("--ephemeral")
+  fi
+
+  if [ -n "${DISABLE_AUTO_UPDATE}" ]; then
+    echo "Disable auto update option is enabled"
+    ARGS+=("--disableupdate")
+  fi
+
+  echo "Configuring"
+  ./config.sh \
+      --url "${_SHORT_URL}" \
+      --token "${RUNNER_TOKEN}" \
+      --name "${_RUNNER_NAME}" \
+      --work "${_RUNNER_WORKDIR}" \
+      --labels "${_LABELS}" \
+      --runnergroup "${_RUNNER_GROUP}" \
+      --unattended \
+      --replace \
+      "${ARGS[@]}"
+
+  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir "${_RUNNER_WORKDIR}"
+
+}
+
+
+# Opt into runner reusage because a value was given
+if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  echo "Runner reusage is enabled"
+
+  # directory exists, copy the data
+  if [[ -d "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+    echo "Copying previous data"
+    cp -p -r "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}/." "/actions-runner"
+  fi
+
+  if [ -f "/actions-runner/.runner" ]; then
+    echo "The runner has already been configured"
+  else
+    configure_runner
+  fi
+else
+  echo "Runner reusage is disabled"
+  configure_runner
 fi
 
-echo "Configuring"
-./config.sh \
-    --url "${_SHORT_URL}" \
-    --token "${RUNNER_TOKEN}" \
-    --name "${_RUNNER_NAME}" \
-    --work "${_RUNNER_WORKDIR}" \
-    --labels "${_LABELS}" \
-    --unattended \
-    --replace
+if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  echo "Reusage is enabled. Storing data to ${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+  # Quoting (even with double-quotes) the regexp brokes the copying
+  cp -p -r "/actions-runner/_diag" "/actions-runner/svc.sh" /actions-runner/.[^.]* "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+fi
 
-unset RUNNER_TOKEN
-trap deregister_runner SIGINT SIGQUIT SIGTERM
+if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
+  trap deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
+fi
 
-./bin/runsvc.sh
+# Container's command (CMD) execution as runner user
+
+
+if [[ ${_RUN_AS_ROOT} == "true" ]]; then
+  if [[ $(id -u) -eq 0 ]]; then
+    "$@"
+  else
+    echo "ERROR: RUN_AS_ROOT env var is set to true but the user has been overridden and is not running as root, but UID '$(id -u)'"
+    exit 1
+  fi
+else
+  if [[ $(id -u) -eq 0 ]]; then
+    [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && /usr/bin/chown -R runner "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+    /usr/bin/chown -R runner "${_RUNNER_WORKDIR}" /opt/hostedtoolcache/ /actions-runner
+    /usr/sbin/gosu runner "$@"
+  else
+    "$@"
+  fi
+fi

install_actions.sh

@@ -1,11 +1,9 @@
-#!/bin/bash -x
+#!/bin/bash -ex
 GH_RUNNER_VERSION=$1
 TARGETPLATFORM=$2
 
 export TARGET_ARCH="x64"
-if [[ $TARGETPLATFORM == "linux/arm/v7" ]]; then
-  export TARGET_ARCH="arm"
-elif [[ $TARGETPLATFORM == "linux/arm64" ]]; then
+if [[ $TARGETPLATFORM == "linux/arm64" ]]; then
   export TARGET_ARCH="arm64"
 fi
 curl -L "https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSION}/actions-runner-linux-${TARGET_ARCH}-${GH_RUNNER_VERSION}.tar.gz" > actions.tar.gz

sider.yml

@@ -0,0 +1,4 @@
+linter:
+  actionlint:
+    ignore:
+      - ".*Quote this to prevent word splitting.*"

token.sh

@@ -1,33 +1,44 @@
 #!/bin/bash
 
-_ORG_RUNNER=${ORG_RUNNER:-false}
+_GITHUB_HOST=${GITHUB_HOST:="github.com"}
+
+# If URL is not github.com then use the enterprise api endpoint
+if [[ ${GITHUB_HOST} = "github.com" ]]; then
+  URI="https://api.${_GITHUB_HOST}"
+else
+  URI="https://${_GITHUB_HOST}/api/v3"
+fi
 
-URI=https://api.github.com
 API_VERSION=v3
 API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
 AUTH_HEADER="Authorization: token ${ACCESS_TOKEN}"
+CONTENT_LENGTH_HEADER="Content-Length: 0"
 
-REPO_URL=${REPO_URL:-${URI}}
-_PROTO="$(echo "${REPO_URL}" | grep :// | sed -e's,^\(.*://\).*,\1,g')"
-# shellcheck disable=SC2116
-_URL="$(echo "${REPO_URL/${_PROTO}/}")"
-_PATH="$(echo "${_URL}" | grep / | cut -d/ -f2-)"
-_ACCOUNT="$(echo "${_PATH}" | cut -d/ -f1)"
-_REPO="$(echo "${_PATH}" | cut -d/ -f2)"
+case ${RUNNER_SCOPE} in
+  org*)
+    _FULL_URL="${URI}/orgs/${ORG_NAME}/actions/runners/registration-token"
+    ;;
 
-_FULL_URL="${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners/registration-token"
-if [[ ${_ORG_RUNNER} == "true" ]]; then
-  [[ -z ${ORG_NAME} ]] && ( echo "ORG_NAME required for org runners"; exit 1 )
-  _FULL_URL="${URI}/orgs/${ORG_NAME}/actions/runners/registration-token"
-  _SHORT_URL="${_PROTO}github.com/${ORG_NAME}"
-else
-  _SHORT_URL=$REPO_URL
-fi
+  ent*)
+    _FULL_URL="${URI}/enterprises/${ENTERPRISE_NAME}/actions/runners/registration-token"
+    ;;
+
+  *)
+    _PROTO="https://"
+    # shellcheck disable=SC2116
+    _URL="$(echo "${REPO_URL/${_PROTO}/}")"
+    _PATH="$(echo "${_URL}" | grep / | cut -d/ -f2-)"
+    _ACCOUNT="$(echo "${_PATH}" | cut -d/ -f1)"
+    _REPO="$(echo "${_PATH}" | cut -d/ -f2)"
+    _FULL_URL="${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners/registration-token"
+    ;;
+esac
 
 RUNNER_TOKEN="$(curl -XPOST -fsSL \
+  -H "${CONTENT_LENGTH_HEADER}" \
   -H "${AUTH_HEADER}" \
   -H "${API_HEADER}" \
   "${_FULL_URL}" \
 | jq -r '.token')"
 
-echo "{\"token\": \"${RUNNER_TOKEN}\", \"short_url\": \"${_SHORT_URL}\", \"full_url\": \"${_FULL_URL}\"}"
+echo "{\"token\": \"${RUNNER_TOKEN}\", \"full_url\": \"${_FULL_URL}\"}"