[Automated 🤖 ] Bump to version 2.287.1

fix(ephemeral-runner): Replace once with ephemeral

.github/workflows/base.yml

@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        release: [buster, bullseye, sid]
+        release: [bullseye, sid]
       fail-fast: false
     steps:
     - name: Copy Repo Files

.github/workflows/deploy.yml

@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        release: [buster, bullseye, sid]
+        release: [bullseye, sid]
       fail-fast: false
     steps:
     - name: Copy Repo Files
@@ -88,4 +88,4 @@ jobs:
         max_attempts: 3
         retry_on: error
         timeout_minutes: 120
-        command: docker buildx build -f Dockerfile.debian-${{ matrix.release }} -t ${ORG}/github-runner:debian-${{ matrix.release }} --output "type=image,push=true" --platform linux/amd64,linux/arm64,linux/arm/v7 .
+        command: docker buildx build -f Dockerfile.debian-${{ matrix.release }} -t ${ORG}/github-runner:debian-${{ matrix.release }} --output "type=image,push=true" --platform linux/amd64,linux/arm64,linux/arm/v7 .

.github/workflows/release.yml

@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        release: [buster, bullseye, sid]
+        release: [bullseye, sid]
       fail-fast: false
     needs: create-release
     steps:

Dockerfile

@@ -5,7 +5,7 @@ LABEL maintainer="myoung34@my.apsu.edu"
 ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
 RUN mkdir -p /opt/hostedtoolcache
 
-ARG GH_RUNNER_VERSION="2.280.2"
+ARG GH_RUNNER_VERSION="2.287.1"
 ARG TARGETPLATFORM
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -13,12 +13,15 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 WORKDIR /actions-runner
 COPY install_actions.sh /actions-runner
 
+# TODO: remove this terrible sed once
+#  https://github.com/actions/runner/pull/1585 is merged or similar
 RUN chmod +x /actions-runner/install_actions.sh \
+  && sed -i.bak 's/.\/bin\/installdependencies.sh/wget https:\/\/raw.githubusercontent.com\/myoung34\/runner\/main\/src\/Misc\/layoutbin\/installdependencies.sh -O .\/bin\/installdependencies.sh; bash .\/bin\/installdependencies.sh/g' /actions-runner/install_actions.sh \
   && /actions-runner/install_actions.sh ${GH_RUNNER_VERSION} ${TARGETPLATFORM} \
   && rm /actions-runner/install_actions.sh
 
-COPY token.sh entrypoint.sh /
-RUN chmod +x /token.sh /entrypoint.sh
+COPY token.sh entrypoint.sh ephemeral-runner.sh /
+RUN chmod +x /token.sh /entrypoint.sh /ephemeral-runner.sh
 
 ENTRYPOINT ["/entrypoint.sh"]
-CMD ["/actions-runner/bin/runsvc.sh"]
+CMD ["./bin/Runner.Listener", "run", "--startuptype", "service"]

Dockerfile.base

@@ -1,25 +1,23 @@
 FROM ubuntu:focal
 LABEL maintainer="myoung34@my.apsu.edu"
 
-# TODO: Ubuntu focal (20.04) has git v2.25, but the minimum needed for GitHub
-# Actions runners is v2.29.  For now, we build git from source.  When updating
-# to hirsute (21.04) or later, we can remove the instructions to build from
-# source in favor of the regular Ubuntu git package.
-ARG GIT_VERSION="2.29.0"
-
 ARG DUMB_INIT_VERSION="1.2.2"
+ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
 ARG DOCKER_KEY="7EA0A9C3F273FCD8"
 
 ENV DOCKER_COMPOSE_VERSION="1.27.4"
 ENV LANG=en_US.UTF-8
-ENV LANGUAGE=en_US:en
-ENV LC_ALL=en_US.UTF-8 
+ENV LANGUAGE=en_US.UTF-8
+ENV LC_ALL=en_US.UTF-8
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
-# hadolint ignore=DL3003,DL4001
-RUN apt-get update && \
-  apt-get install -y --no-install-recommends \
-    awscli \
+# hadolint ignore=DL3003,DL4001,SC2086
+RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends gnupg \
+  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends \
     curl \
     tar \
     unzip \
@@ -27,13 +25,11 @@ RUN apt-get update && \
     ca-certificates \
     sudo \
     gpg-agent \
-    gnupg \
     software-properties-common \
     build-essential \
     zlib1g-dev \
     zstd \
     gettext \
-    liblttng-ust0 \
     libcurl4-openssl-dev \
     inetutils-ping \
     jq \
@@ -42,23 +38,24 @@ RUN apt-get update && \
     openssh-client \
     locales \
     python3-pip \
-    python \
+    python3 \
     dumb-init \
-  && pip3 install --no-cache-dir awscliv2 \
-  && locale-gen en_US.UTF-8 \
-  && dpkg-reconfigure locales \
-  && c_rehash \
-  && cd /tmp \
-  && curl -sL https://www.kernel.org/pub/software/scm/git/git-${GIT_VERSION}.tar.gz -o git.tgz \
-  && tar zxf git.tgz \
-  && cd git-${GIT_VERSION} \
-  && ./configure --prefix=/usr \
-  && make \
-  && make install \
-  && cd / \
+  && echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu $([[ $(grep -E '^ID=' /etc/os-release | sed 's/.*=//g') == "ubuntu" ]] && (grep VERSION_CODENAME /etc/os-release | sed 's/.*=//g') || echo bionic) main>/etc/apt/sources.list.d/git-core.list \
+  && apt-get update \
+  && ( apt-get install -y --no-install-recommends git || apt-get install -t stable -y --no-install-recommends git || apt-get install -y --no-install-recommends git=1:2.33.1-0ppa1~ubuntu18.04.1 git-man=1:2.33.1-0ppa1~ubuntu18.04.1 ) \
+  && ( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] && apt-get install -y --no-install-recommends liblttng-ust0 || : ) \
+  && ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
+  && curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" \
+  && unzip awscliv2.zip -d /tmp/ \
+  && /tmp/aws/install \
+  # Determine the Distro name (Debian, Ubuntu, etc)
+  && distro=$(lsb_release -is | awk '{print tolower($0)}') \
+  # Determine the Distro version (bullseye, xenial, etc)
+  # Note: sid is aliased to bullseye, because Docker doesn't have a matching apt repo
   && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${DOCKER_KEY} \
-  && curl -fsSL https://download.docker.com/linux/$(lsb_release -is | awk '{print tolower($0)}')/gpg | apt-key add - \
-  && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(lsb_release -is | awk '{print tolower($0)}') $(lsb_release -cs) stable" ) \
+  && curl -fsSL https://download.docker.com/linux/${distro}/gpg | apt-key add - \
+  && version=$(lsb_release -cs | awk '{gsub("sid", "bullseye"); print $0}') \
+  && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/${distro} ${version} stable" ) \
   && apt-get update \
   && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends --allow-unauthenticated \
   && [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose ) \

README.md

@@ -7,6 +7,10 @@ This will run the [new self-hosted github actions runners](https://help.github.c
 
 ## Notes ##
 
+### Auto Update Issues ###
+
+There is a [known issue with auto updates in docker](https://github.com/actions/runner/issues/246). If one is running a version that has an update it will try to auto update and fail. The only current workaround is to run `latest` which in theory is always up to date and wont update/throttle.
+
 ### Docker Support ###
 
 Please note that while this runner installs and allows docker, github actions itself does not support using docker from a self hosted runner yet.
@@ -28,9 +32,9 @@ A workaround exists, please see [here](https://github.com/myoung34/docker-github
 | --- | --- | --- | --- | --- | --- |
 | ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` | [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. | Tags without an OS name *before* 9/17/2020 are `eoan`. `armv7` support stopped 9/18/2020 due to inconsistent docker-ce packaging |
 | ubuntu bionic | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
-| debian buster | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | This is the latest build from buster (Rebuilt nightly and on master merges). Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
-| debian bullseye | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-bullseye/` | [debian-bullseye](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bullseye) | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with `-debian-bullseye` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Debian Bullseye will be the next stable release of Debian Linux. |
-| debian sid | `x86_64`,`arm64`,`admv7` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Debian sid is considered unstable by Debian. |
+| debian buster (now deprecated) | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Buster is Debians current old-stable release. |
+| debian bullseye | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-bullseye/` | [debian-bullseye](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bullseye) | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with `-debian-bullseye` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Bullseye is Debians current stable release. |
+| debian sid | `x86_64`,`arm64`,`admv7` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Sid is considered unstable by Debian. |
 | ubuntu xenial | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). | This is deprecated as of 7/15/2021 and will no longer receive tags. |
 
 These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.
@@ -53,6 +57,7 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `GITHUB_HOST` | Optional URL of the Github Enterprise server e.g github.mycompany.com. Defaults to `github.com`. |
 | `DISABLE_AUTOMATIC_DEREGISTRATION` | Optional flag to disable signal catching for deregistration. Default is `false`. Any value other than exactly `false` is considered `true`. See [here](https://github.com/myoung34/docker-github-actions-runner/issues/94) |
 | `CONFIGURED_ACTIONS_RUNNER_FILES_DIR` | Path to use for runner data. It allows avoiding reregistration each the start of the runner. No default value. |
+| `EPHEMERAL` | Optional flag to configure runner with [`--ephemeral` option](https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling). Ephemeral runners are suitable for autoscaling. |
 
 ## Examples ##
 
@@ -315,3 +320,70 @@ docker run -d --restart always --name github-runner \
   -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
   myoung34/github-runner:latest
 ```
+
+## Ephemeral mode
+
+GitHub's hosted runners are completely ephemeral.  You can remove all its data without breaking all future jobs.
+
+To achieve the same resilience in a self-hosted runner:
+  1. override the command for your runner with `/ephemeral-runner.sh` (which will terminate after one job executes)
+  2. don't mount a local folder into `RUNNER_WORKDIR` (to ensure no filesystem persistence)
+  3. run the container with `--rm` (to delete it after termination)
+  4. wrap the container execution in a system service that restarts (to start a fresh container after each job)
+
+Here's an example service definition for systemd:
+
+```
+# Install with:
+#   sudo install -m 644 ephemeral-github-actions-runner.service /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable ephemeral-github-actions-runner
+# Run with:
+#   sudo systemctl start ephemeral-github-actions-runner
+# Stop with:
+#   sudo systemctl stop ephemeral-github-actions-runner
+# See live logs with:
+#   journalctl -f -u ephemeral-github-actions-runner.service --no-hostname --no-tail
+
+[Unit]
+Description=Ephemeral GitHub Actions Runner Container
+After=docker.service
+Requires=docker.service
+
+[Service]
+TimeoutStartSec=0
+Restart=always
+ExecStartPre=-/usr/bin/docker stop %n
+ExecStartPre=-/usr/bin/docker rm %n
+ExecStartPre=-/usr/bin/docker pull myoung34/github-runner:latest
+ExecStart=/usr/bin/docker run --rm --env-file /etc/ephemeral-github-actions-runner.env --name %n myoung34/github-runner:latest /ephemeral-runner.sh
+
+[Install]
+WantedBy=multi-user.target
+```
+
+And an example of the corresponding env file that the service reads from:
+
+```
+# Install with:
+#   sudo install -m 600 ephemeral-github-actions-runner.env /etc/
+REPO_URL=https://github.com/your-org/your-repo
+RUNNER_NAME=your-runner-name-here
+ACCESS_TOKEN=foo-access-token
+RUNNER_WORKDIR=/tmp/runner/work
+LABELS=any-custom-labels-go-here
+EPHEMERAL=true
+```
+
+## Proxy Support
+
+To run the github runners behind a proxy, you need to pass the [proxy parameters required for the GitHub Runner](https://docs.github.com/en/actions/hosting-your-own-runners/using-a-proxy-server-with-self-hosted-runners) as environment variables. 
+Note: The `http://` as prefix is required by the GitHub Runner.
+
+```shell
+docker run -d --restart always --name github-runner \
+  -e https_proxy="http://myproxy:3128" \
+  -e http_proxy="http://myproxy:3128" \
+  -e RUNNER_NAME_PREFIX="myrunner" \
+  # ...
+  myoung34/github-runner:latest

entrypoint.sh

@@ -3,10 +3,17 @@
 export RUNNER_ALLOW_RUNASROOT=1
 export PATH=$PATH:/actions-runner
 
+# Un-export these, so that they must be passed explicitly to the environment of
+# any command that needs them.  This may help prevent leaks.
+export -n ACCESS_TOKEN
+export -n RUNNER_TOKEN
+
 deregister_runner() {
   echo "Caught SIGTERM. Deregistering runner"
-  _TOKEN=$(bash /token.sh)
-  RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  if [[ -n "${ACCESS_TOKEN}" ]]; then
+    _TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" bash /token.sh)
+    RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  fi
   ./config.sh remove --token "${RUNNER_TOKEN}"
   exit
 }
@@ -53,11 +60,18 @@ esac
 
 configure_runner() {
   if [[ -n "${ACCESS_TOKEN}" ]]; then
-    echo "Obtaining the token of the runnet"
-    _TOKEN=$(bash /token.sh)
+    echo "Obtaining the token of the runner"
+    _TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" bash /token.sh)
     RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
   fi
 
+  if [ -n "${EPHEMERAL}" ]; then
+    echo "Ephemeral option is enabled"
+    _EPHEMERAL="--ephemeral"
+  else
+    _EPHEMERAL=""
+  fi
+
   echo "Configuring"
   ./config.sh \
       --url "${_SHORT_URL}" \
@@ -67,7 +81,7 @@ configure_runner() {
       --labels "${_LABELS}" \
       --runnergroup "${_RUNNER_GROUP}" \
       --unattended \
-      --replace
+      --replace ${_EPHEMERAL}
 }
 
 
@@ -98,11 +112,8 @@ if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
 fi
 
 if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
-  trap deregister_runner SIGINT SIGQUIT SIGTERM
+  trap deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
 fi
 
-unset ACCESS_TOKEN
-unset RUNNER_TOKEN
-
 # Container's command (CMD) execution
 "$@"

ephemeral-runner.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+echo "*** Starting ephemeral runner. ***"
+/actions-runner/run.sh --ephemeral
+rv=$?
+
+# See exit code constants in the runner source here:
+# https://github.com/actions/runner/blob/be96323/src/Runner.Common/Constants.cs#L135
+if [[ $rv == 4 ]]; then
+  # The runner software was updated.
+  echo "*** Software update detected. ***"
+
+  echo "*** Waiting for update to complete. ***"
+  # Hard-coded sleep.  Without some delay, the update is still in progress in
+  # the background, leading to failures when we re-launch.
+  sleep 10
+
+  # Now add an adaptive delay, where we loop and check if the Runner is usable
+  # yet.  As soon as it is, break.
+  for i in $(seq 10); do
+    if /actions-runner/bin/Runner.Listener --version &>/dev/null; then
+      break
+    fi
+
+    echo "*** Update still in progress... ***"
+    sleep 5
+  done
+
+  # Now re-launch the script.
+  echo "*** Re-launching runner. ***"
+  exec "$0"
+fi
+
+# For any other return value, let the script and the Docker container terminate.
+echo "*** Exit code $rv ***"
+exit $rv

token.sh

@@ -12,6 +12,7 @@ fi
 API_VERSION=v3
 API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
 AUTH_HEADER="Authorization: token ${ACCESS_TOKEN}"
+CONTENT_LENGTH_HEADER="Content-Length: 0"
 
 case ${RUNNER_SCOPE} in
   org*)
@@ -34,6 +35,7 @@ case ${RUNNER_SCOPE} in
 esac
 
 RUNNER_TOKEN="$(curl -XPOST -fsSL \
+  -H "${CONTENT_LENGTH_HEADER}" \
   -H "${AUTH_HEADER}" \
   -H "${API_HEADER}" \
   "${_FULL_URL}" \