Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Marcus Young
|
27b20ef23f | ||
|
Marcus Young
|
a43abf4730 | ||
|
Marcus Young
|
07f5b31b2c |
+12
-12
@@ -19,16 +19,16 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v1
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile.base
|
||||
@@ -51,18 +51,18 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Copy Dockerfile
|
||||
run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v1
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile.base.ubuntu-${{ matrix.release }}
|
||||
@@ -85,18 +85,18 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Copy Dockerfile
|
||||
run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v1
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile.base.debian-${{ matrix.release }}
|
||||
|
||||
@@ -10,9 +10,9 @@ on:
|
||||
schedule:
|
||||
- cron: '59 23 * * *'
|
||||
|
||||
permissions:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
packages: write
|
||||
|
||||
jobs:
|
||||
ubuntu_latest_deploy:
|
||||
@@ -23,24 +23,24 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Update Dockerfile FROM org
|
||||
run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile
|
||||
@@ -63,24 +63,24 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Copy Dockerfile
|
||||
run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile.ubuntu-${{ matrix.release }}
|
||||
@@ -103,24 +103,24 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Copy Dockerfile
|
||||
run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile.debian-${{ matrix.release }}
|
||||
|
||||
@@ -4,9 +4,9 @@ on:
|
||||
tags:
|
||||
- '*'
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
jobs:
|
||||
create-release:
|
||||
@@ -14,7 +14,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
|
||||
uses: actions/checkout@v2
|
||||
- name: Create Release
|
||||
id: create_release
|
||||
uses: actions/create-release@v1
|
||||
@@ -37,24 +37,24 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Update Dockerfile FROM org
|
||||
run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile
|
||||
@@ -80,24 +80,24 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Copy Dockerfile
|
||||
run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile.ubuntu-${{ matrix.release }}
|
||||
@@ -123,24 +123,24 @@ jobs:
|
||||
- name: Get GitHub organization or user
|
||||
run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
uses: docker/setup-qemu-action@v1
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
uses: docker/setup-buildx-action@v1
|
||||
- name: Copy Dockerfile
|
||||
run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: ${{ secrets.DOCKER_USER }}
|
||||
password: ${{ secrets.DOCKER_TOKEN }}
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v5
|
||||
uses: docker/build-push-action@v2
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile.debian-${{ matrix.release }}
|
||||
|
||||
@@ -8,8 +8,8 @@ jobs:
|
||||
name: Tests
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
|
||||
- uses: actions/setup-python@v4
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v3
|
||||
- uses: pre-commit/action@v3.0.0
|
||||
- name: Run ShellCheck
|
||||
uses: ludeeus/action-shellcheck@master
|
||||
|
||||
+1
-1
@@ -1 +1 @@
|
||||
shellcheck 0.9.0
|
||||
shellcheck 0.7.0
|
||||
|
||||
+3
-4
@@ -5,8 +5,7 @@ LABEL maintainer="myoung34@my.apsu.edu"
|
||||
ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
|
||||
RUN mkdir -p /opt/hostedtoolcache
|
||||
|
||||
ARG GH_RUNNER_VERSION="2.310.2"
|
||||
|
||||
ARG GH_RUNNER_VERSION="2.285.2"
|
||||
ARG TARGETPLATFORM
|
||||
|
||||
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||
@@ -19,8 +18,8 @@ RUN chmod +x /actions-runner/install_actions.sh \
|
||||
&& rm /actions-runner/install_actions.sh \
|
||||
&& chown runner /_work /actions-runner /opt/hostedtoolcache
|
||||
|
||||
COPY token.sh entrypoint.sh app_token.sh /
|
||||
RUN chmod +x /token.sh /entrypoint.sh /app_token.sh
|
||||
COPY token.sh entrypoint.sh /
|
||||
RUN chmod +x /token.sh /entrypoint.sh
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
CMD ["./bin/Runner.Listener", "run", "--startuptype", "service"]
|
||||
|
||||
+11
-12
@@ -4,13 +4,14 @@ LABEL maintainer="myoung34@my.apsu.edu"
|
||||
ARG DUMB_INIT_VERSION="1.2.2"
|
||||
ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
|
||||
|
||||
ENV DOCKER_COMPOSE_VERSION="1.27.4"
|
||||
ENV GIT_LFS_VERSION="3.2.0"
|
||||
ENV LANG=en_US.UTF-8
|
||||
ENV LANGUAGE=en_US.UTF-8
|
||||
ENV LC_ALL=en_US.UTF-8
|
||||
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
# hadolint ignore=SC2086,DL3015,DL3008,DL3013,SC2015
|
||||
# hadolint ignore=SC2086,DL3015,DL3008,DL3013
|
||||
RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends gnupg \
|
||||
@@ -22,7 +23,6 @@ RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
|
||||
curl \
|
||||
tar \
|
||||
unzip \
|
||||
zip \
|
||||
apt-transport-https \
|
||||
ca-certificates \
|
||||
sudo \
|
||||
@@ -45,7 +45,6 @@ RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
|
||||
dumb-init \
|
||||
nodejs \
|
||||
rsync \
|
||||
libpq-dev \
|
||||
gosu \
|
||||
&& DPKG_ARCH="$(dpkg --print-architecture)" \
|
||||
&& LSB_RELEASE_CODENAME="$(lsb_release --codename | cut -f2)" \
|
||||
@@ -57,25 +56,25 @@ RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
|
||||
&& ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
|
||||
&& ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install && rm awscliv2.zip) || pip3 install --no-cache-dir awscli ) \
|
||||
&& ( curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz && tar -xzf /tmp/lfs.tar.gz -C /tmp && /tmp/git-lfs-${GIT_LFS_VERSION}/install.sh && rm -rf /tmp/lfs.tar.gz /tmp/git-lfs-${GIT_LFS_VERSION}) \
|
||||
# Determine the Distro name (Debian, Ubuntu, etc)
|
||||
&& distro=$(lsb_release -is | awk '{print tolower($0)}') \
|
||||
# Determine the Distro version (bullseye, xenial, etc)
|
||||
# Note: sid is aliased to bullseye, because Docker doesn't have a matching apt repo
|
||||
&& mkdir -p /etc/apt/keyrings \
|
||||
&& ( curl -fsSL https://download.docker.com/linux/${distro}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg ) \
|
||||
&& version=$(lsb_release -cs | sed 's/trixie\|n\/a/bookworm/g') \
|
||||
&& version=$(lsb_release -cs | awk '{gsub("sid", "bullseye"); print $0}') \
|
||||
&& ( echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${distro} ${version} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null ) \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated \
|
||||
&& echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose \
|
||||
&& ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://build.opensuse.org/projects/devel:kubic/public_key" | apt-key add -; echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://build.opensuse.org/projects/devel:kubic/public_key" | apt-key add - && apt-get update) || : ) \
|
||||
&& apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends --allow-unauthenticated \
|
||||
&& ( [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose ) ) \
|
||||
&& ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/Release.key" | apt-key add - && apt-get update) || : ) \
|
||||
&& ( [[ "${LSB_RELEASE_CODENAME}" == "focal" || "${LSB_RELEASE_CODENAME}" == "jammy" || "${LSB_RELEASE_CODENAME}" == "sid" || "${LSB_RELEASE_CODENAME}" == "bullseye" ]] && apt-get install -y --no-install-recommends podman buildah skopeo || : ) \
|
||||
&& ( [[ "${LSB_RELEASE_CODENAME}" == "jammy" ]] && echo "Ubuntu Jammy is marked as beta. Please see https://github.com/actions/virtual-environments/issues/5490" || : ) \
|
||||
&& GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/cli/cli/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
|
||||
&& GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/cli/cli/releases/latest | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" | jq -r '.browser_download_url') \
|
||||
&& curl -sSLo /tmp/ghcli.deb ${GH_CLI_DOWNLOAD_URL} && apt-get -y install /tmp/ghcli.deb && rm /tmp/ghcli.deb \
|
||||
&& GH_CLI_INSTALL_FILE="/tmp/gh-$$.deb" && curl -sSLo "${GH_CLI_INSTALL_FILE}" "https://github.com$(curl -sSL "https://github.com/cli/cli/releases/latest" | grep -Po "(?<=href=\")/cli/cli/releases/download/[^\"]*${DPKG_ARCH}[.]deb(?=\")")" && apt-get -y install "${GH_CLI_INSTALL_FILE}" \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& rm -rf /tmp/* \
|
||||
&& groupadd -g 121 runner \
|
||||
&& useradd -mr -d /home/runner -u 1001 -g 121 runner \
|
||||
&& usermod -aG sudo runner \
|
||||
&& usermod -aG docker runner \
|
||||
&& echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers \
|
||||
&& ( [[ -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list ]] && rm /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list || : )
|
||||
&& echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
|
||||
|
||||
@@ -14,7 +14,7 @@ Please read [the contributing guidelines](https://github.com/myoung34/docker-git
|
||||
|
||||
### Security ###
|
||||
|
||||
It is known that environment variables are not safe from exfiltration.
|
||||
It is known that currently tokens (ACCESS_TOKEN / RUNNER_TOKEN ) are not safe from exfiltration.
|
||||
If you are using this runner make sure that any workflow changes are gated by a verification process (in the actions settings) so that malicious PR's cannot exfiltrate these.
|
||||
|
||||
### Docker Support ###
|
||||
@@ -31,6 +31,11 @@ Also, some GitHub Actions Workflow features, like [Job Services](https://docs.gi
|
||||
|
||||
Currently runners [do not support containerd](https://github.com/actions/runner/issues/1265)
|
||||
|
||||
### Docker-Compose on ARM ###
|
||||
|
||||
Please note `docker-compose` does not currently work on ARM ([see issue](https://github.com/docker/compose/issues/6831)) so it is not installed on ARM based builds here.
|
||||
A workaround exists, please see [here](https://github.com/myoung34/docker-github-actions-runner/issues/72#issuecomment-804723656)
|
||||
|
||||
## Docker Artifacts ##
|
||||
|
||||
| Container Base | Supported Architectures | Tag Regex | Docker Tags | Description | Notes |
|
||||
@@ -50,12 +55,8 @@ These containers are built via Github actions that [copy the dockerfile](https:/
|
||||
| --- | --- |
|
||||
| `RUN_AS_ROOT` | Boolean to run as root. If `true`: will run as root. If `True` and the user is overridden it will error. If any other value it will run as the `runner` user and allow an optional override. Default is `true` |
|
||||
| `RUNNER_NAME` | The name of the runner to use. Supercedes (overrides) `RUNNER_NAME_PREFIX` |
|
||||
| `RUNNER_NAME_PREFIX` | A prefix for runner name (See `RANDOM_RUNNER_SUFFIX` for how the full name is generated). Note: will be overridden by `RUNNER_NAME` if provided. Defaults to `github-runner` |
|
||||
| `RANDOM_RUNNER_SUFFIX` | Boolean to use a randomized runner name suffix (preceeded by `RUNNER_NAME_PREFIX`). Will use a 13 character random string by default. If set to a value other than true it will attempt to use the contents of `/etc/hostname` or fall back to a random string if the file does not exist or is empty. Note: will be overridden by `RUNNER_NAME` if provided. Defaults to `true`. |
|
||||
| `RUNNER_NAME_PREFIX` | A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide `RUNNER_NAME`. Defaults to `github-runner` |
|
||||
| `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
|
||||
| `APP_ID` | The github application ID. Must be paired with `APP_PRIVATE_KEY` and should not be used with `ACCESS_TOKEN` or `RUNNER_TOKEN` |
|
||||
| `APP_PRIVATE_KEY` | The github application private key. Must be paired with `APP_ID` and should not be used with `ACCESS_TOKEN` or `RUNNER_TOKEN` |
|
||||
| `APP_LOGIN` | The github application login id. Can be paired with `APP_ID` and `APP_PRIVATE_KEY` if default value extracted from `REPO_URL` or `ORG_NAME` is not correct. Note that no default is present when `RUNNER_SCOPE` is 'enterprise'. |
|
||||
| `RUNNER_SCOPE` | The scope the runner will be registered on. Valid values are `repo`, `org` and `ent`. For 'org' and 'enterprise', `ACCESS_TOKEN` is required and `REPO_URL` is unnecessary. If 'org', requires `ORG_NAME`; if 'enterprise', requires `ENTERPRISE_NAME`. Default is 'repo'. |
|
||||
| `ORG_NAME` | The organization name for the runner to register under. Requires `RUNNER_SCOPE` to be 'org'. No default value. |
|
||||
| `ENTERPRISE_NAME` | The enterprise name for the runner to register under. Requires `RUNNER_SCOPE` to be 'enterprise'. No default value. |
|
||||
@@ -69,4 +70,3 @@ These containers are built via Github actions that [copy the dockerfile](https:/
|
||||
| `CONFIGURED_ACTIONS_RUNNER_FILES_DIR` | Path to use for runner data. It allows avoiding reregistration each the start of the runner. No default value. |
|
||||
| `EPHEMERAL` | Optional flag to configure runner with [`--ephemeral` option](https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling). Ephemeral runners are suitable for autoscaling. |
|
||||
| `DISABLE_AUTO_UPDATE` | Optional environment variable to [disable auto updates](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/). Auto updates are enabled by default to preserve past behavior. Any value is considered truthy and will disable them. |
|
||||
| `START_DOCKER_SERVICE` | Optional flag which automatically starts the docker service if set to `true`. Useful when using [sysbox](https://github.com/nestybox/sysbox). Defaults to `false`.
|
||||
|
||||
@@ -1,89 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Request an ACCESS_TOKEN to be used by a GitHub APP
|
||||
# Environment variable that need to be set up:
|
||||
# * APP_ID, the GitHub's app ID
|
||||
# * APP_PRIVATE_KEY, the content of GitHub app's private key in PEM format.
|
||||
# * APP_LOGIN, the login name used to install GitHub's app
|
||||
#
|
||||
# https://github.com/orgs/community/discussions/24743#discussioncomment-3245300
|
||||
#
|
||||
|
||||
set -o pipefail
|
||||
|
||||
_GITHUB_HOST=${GITHUB_HOST:="github.com"}
|
||||
|
||||
# If URL is not github.com then use the enterprise api endpoint
|
||||
if [[ ${GITHUB_HOST} = "github.com" ]]; then
|
||||
URI="https://api.${_GITHUB_HOST}"
|
||||
else
|
||||
URI="https://${_GITHUB_HOST}/api/v3"
|
||||
fi
|
||||
|
||||
API_VERSION=v3
|
||||
API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
|
||||
CONTENT_LENGTH_HEADER="Content-Length: 0"
|
||||
APP_INSTALLATIONS_URI="${URI}/app/installations"
|
||||
|
||||
|
||||
# JWT parameters based off
|
||||
# https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-a-github-app
|
||||
#
|
||||
# JWT token issuance and expiration parameters
|
||||
JWT_IAT_DRIFT=60
|
||||
JWT_EXP_DELTA=600
|
||||
|
||||
JWT_JOSE_HEADER='{
|
||||
"alg": "RS256",
|
||||
"typ": "JWT"
|
||||
}'
|
||||
|
||||
|
||||
build_jwt_payload() {
|
||||
now=$(date +%s)
|
||||
iat=$((now - JWT_IAT_DRIFT))
|
||||
jq -c \
|
||||
--arg iat_str "${iat}" \
|
||||
--arg exp_delta_str "${JWT_EXP_DELTA}" \
|
||||
--arg app_id_str "${APP_ID}" \
|
||||
'
|
||||
($iat_str | tonumber) as $iat
|
||||
| ($exp_delta_str | tonumber) as $exp_delta
|
||||
| ($app_id_str | tonumber) as $app_id
|
||||
| .iat = $iat
|
||||
| .exp = ($iat + $exp_delta)
|
||||
| .iss = $app_id
|
||||
' <<< "{}" | tr -d '\n'
|
||||
}
|
||||
|
||||
base64url() {
|
||||
base64 | tr '+/' '-_' | tr -d '=\n'
|
||||
}
|
||||
|
||||
rs256_sign() {
|
||||
openssl dgst -binary -sha256 -sign <(echo "$1")
|
||||
}
|
||||
|
||||
request_access_token() {
|
||||
jwt_payload=$(build_jwt_payload)
|
||||
encoded_jwt_parts=$(base64url <<<"${JWT_JOSE_HEADER}").$(base64url <<<"${jwt_payload}")
|
||||
encoded_mac=$(echo -n "${encoded_jwt_parts}" | rs256_sign "${APP_PRIVATE_KEY}" | base64url)
|
||||
generated_jwt="${encoded_jwt_parts}.${encoded_mac}"
|
||||
|
||||
auth_header="Authorization: Bearer ${generated_jwt}"
|
||||
|
||||
app_installations_response=$(curl -sX GET \
|
||||
-H "${auth_header}" \
|
||||
-H "${API_HEADER}" \
|
||||
"${APP_INSTALLATIONS_URI}" \
|
||||
)
|
||||
access_token_url=$(echo "${app_installations_response}" | jq --raw-output '.[] | select (.account.login == "'"${APP_LOGIN}"'" and .app_id == '"${APP_ID}"') .access_tokens_url')
|
||||
curl -sX POST \
|
||||
-H "${CONTENT_LENGTH_HEADER}" \
|
||||
-H "${auth_header}" \
|
||||
-H "${API_HEADER}" \
|
||||
"${access_token_url}" | \
|
||||
jq --raw-output .token
|
||||
}
|
||||
|
||||
request_access_token
|
||||
+12
-60
@@ -2,14 +2,12 @@
|
||||
# shellcheck shell=bash
|
||||
|
||||
export RUNNER_ALLOW_RUNASROOT=1
|
||||
export PATH=${PATH}:/actions-runner
|
||||
export PATH=$PATH:/actions-runner
|
||||
|
||||
# Un-export these, so that they must be passed explicitly to the environment of
|
||||
# any command that needs them. This may help prevent leaks.
|
||||
export -n ACCESS_TOKEN
|
||||
export -n RUNNER_TOKEN
|
||||
export -n APP_ID
|
||||
export -n APP_PRIVATE_KEY
|
||||
|
||||
deregister_runner() {
|
||||
echo "Caught SIGTERM. Deregistering runner"
|
||||
@@ -23,33 +21,16 @@ deregister_runner() {
|
||||
|
||||
_DISABLE_AUTOMATIC_DEREGISTRATION=${DISABLE_AUTOMATIC_DEREGISTRATION:-false}
|
||||
|
||||
_RANDOM_RUNNER_SUFFIX=${RANDOM_RUNNER_SUFFIX:="true"}
|
||||
|
||||
_RUNNER_NAME=${RUNNER_NAME:-${RUNNER_NAME_PREFIX:-github-runner}-$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 13 ; echo '')}
|
||||
if [[ ${RANDOM_RUNNER_SUFFIX} != "true" ]]; then
|
||||
# In some cases this file does not exist
|
||||
if [[ -f "/etc/hostname" ]]; then
|
||||
# in some cases it can also be empty
|
||||
if [[ $(stat --printf="%s" /etc/hostname) -ne 0 ]]; then
|
||||
_RUNNER_NAME=${RUNNER_NAME:-${RUNNER_NAME_PREFIX:-github-runner}-$(cat /etc/hostname)}
|
||||
echo "RANDOM_RUNNER_SUFFIX is ${RANDOM_RUNNER_SUFFIX}. /etc/hostname exists and has content. Setting runner name to ${_RUNNER_NAME}"
|
||||
else
|
||||
echo "RANDOM_RUNNER_SUFFIX is ${RANDOM_RUNNER_SUFFIX} ./etc/hostname exists but is empty. Not using /etc/hostname."
|
||||
fi
|
||||
else
|
||||
echo "RANDOM_RUNNER_SUFFIX is ${RANDOM_RUNNER_SUFFIX} but /etc/hostname does not exist. Not using /etc/hostname."
|
||||
fi
|
||||
fi
|
||||
|
||||
_RUNNER_WORKDIR=${RUNNER_WORKDIR:-/_work/${_RUNNER_NAME}}
|
||||
_RUNNER_WORKDIR=${RUNNER_WORKDIR:-/_work}
|
||||
_LABELS=${LABELS:-default}
|
||||
_RUNNER_GROUP=${RUNNER_GROUP:-Default}
|
||||
_GITHUB_HOST=${GITHUB_HOST:="github.com"}
|
||||
_RUN_AS_ROOT=${RUN_AS_ROOT:="true"}
|
||||
_START_DOCKER_SERVICE=${START_DOCKER_SERVICE:="false"}
|
||||
_EPHEMERAL=""
|
||||
|
||||
# ensure backwards compatibility
|
||||
if [[ -z ${RUNNER_SCOPE} ]]; then
|
||||
if [[ -z $RUNNER_SCOPE ]]; then
|
||||
if [[ ${ORG_RUNNER} == "true" ]]; then
|
||||
echo 'ORG_RUNNER is now deprecated. Please use RUNNER_SCOPE="org" instead.'
|
||||
export RUNNER_SCOPE="org"
|
||||
@@ -65,9 +46,6 @@ case ${RUNNER_SCOPE} in
|
||||
[[ -z ${ORG_NAME} ]] && ( echo "ORG_NAME required for org runners"; exit 1 )
|
||||
_SHORT_URL="https://${_GITHUB_HOST}/${ORG_NAME}"
|
||||
RUNNER_SCOPE="org"
|
||||
if [[ -n "${APP_ID}" ]] && [[ -z "${APP_LOGIN}" ]]; then
|
||||
APP_LOGIN=${ORG_NAME}
|
||||
fi
|
||||
;;
|
||||
|
||||
ent*)
|
||||
@@ -80,29 +58,10 @@ case ${RUNNER_SCOPE} in
|
||||
[[ -z ${REPO_URL} ]] && ( echo "REPO_URL required for repo runners"; exit 1 )
|
||||
_SHORT_URL=${REPO_URL}
|
||||
RUNNER_SCOPE="repo"
|
||||
if [[ -n "${APP_ID}" ]] && [[ -z "${APP_LOGIN}" ]]; then
|
||||
APP_LOGIN=${REPO_URL%/*}
|
||||
APP_LOGIN=${APP_LOGIN##*/}
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
configure_runner() {
|
||||
ARGS=()
|
||||
if [[ -n "${APP_ID}" ]] && [[ -n "${APP_PRIVATE_KEY}" ]] && [[ -n "${APP_LOGIN}" ]]; then
|
||||
if [[ -n "${ACCESS_TOKEN}" ]] || [[ -n "${RUNNER_TOKEN}" ]]; then
|
||||
echo "ERROR: ACCESS_TOKEN or RUNNER_TOKEN provided but are mutually exclusive with APP_ID, APP_PRIVATE_KEY and APP_LOGIN." >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "Obtaining access token for app_id ${APP_ID} and login ${APP_LOGIN}"
|
||||
nl="
|
||||
"
|
||||
ACCESS_TOKEN=$(APP_ID="${APP_ID}" APP_PRIVATE_KEY="${APP_PRIVATE_KEY//\\n/${nl}}" APP_LOGIN="${APP_LOGIN}" bash /app_token.sh)
|
||||
elif [[ -n "${APP_ID}" ]] || [[ -n "${APP_PRIVATE_KEY}" ]] || [[ -n "${APP_LOGIN}" ]]; then
|
||||
echo "ERROR: All of APP_ID, APP_PRIVATE_KEY and APP_LOGIN must be specified." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -n "${ACCESS_TOKEN}" ]]; then
|
||||
echo "Obtaining the token of the runner"
|
||||
_TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" bash /token.sh)
|
||||
@@ -112,12 +71,14 @@ configure_runner() {
|
||||
# shellcheck disable=SC2153
|
||||
if [ -n "${EPHEMERAL}" ]; then
|
||||
echo "Ephemeral option is enabled"
|
||||
ARGS+=("--ephemeral")
|
||||
_EPHEMERAL="--ephemeral"
|
||||
fi
|
||||
|
||||
if [ -n "${DISABLE_AUTO_UPDATE}" ]; then
|
||||
echo "Disable auto update option is enabled"
|
||||
ARGS+=("--disableupdate")
|
||||
_AUTO_UPDATE="--disableupdate"
|
||||
else
|
||||
_AUTO_UPDATE=""
|
||||
fi
|
||||
|
||||
echo "Configuring"
|
||||
@@ -130,7 +91,8 @@ configure_runner() {
|
||||
--runnergroup "${_RUNNER_GROUP}" \
|
||||
--unattended \
|
||||
--replace \
|
||||
"${ARGS[@]}"
|
||||
"${_EPHEMERAL}" \
|
||||
"${_AUTO_UPDATE}"
|
||||
|
||||
[[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir "${_RUNNER_WORKDIR}"
|
||||
|
||||
@@ -167,14 +129,6 @@ if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
|
||||
trap deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
|
||||
fi
|
||||
|
||||
# Start docker service if needed (e.g. for docker-in-docker)
|
||||
if [[ ${_START_DOCKER_SERVICE} == "true" ]]; then
|
||||
echo "Starting docker service"
|
||||
_PREFIX=""
|
||||
[[ ${_RUN_AS_ROOT} != "true" ]] && _PREFIX="sudo"
|
||||
${_PREFIX} service docker start
|
||||
fi
|
||||
|
||||
# Container's command (CMD) execution as runner user
|
||||
|
||||
|
||||
@@ -187,10 +141,8 @@ if [[ ${_RUN_AS_ROOT} == "true" ]]; then
|
||||
fi
|
||||
else
|
||||
if [[ $(id -u) -eq 0 ]]; then
|
||||
[[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && chown -R runner "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
|
||||
chown -R runner "${_RUNNER_WORKDIR}" /actions-runner
|
||||
# The toolcache is not recursively chowned to avoid recursing over prepulated tooling in derived docker images
|
||||
chown runner /opt/hostedtoolcache/
|
||||
[[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && /usr/bin/chown -R runner "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
|
||||
/usr/bin/chown -R runner "${_RUNNER_WORKDIR}" /opt/hostedtoolcache/ /actions-runner
|
||||
/usr/sbin/gosu runner "$@"
|
||||
else
|
||||
"$@"
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"config:base"
|
||||
],
|
||||
"packageRules": [
|
||||
{
|
||||
"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
|
||||
"automerge": true
|
||||
},
|
||||
{
|
||||
"matchDepTypes": ["devDependencies"],
|
||||
"automerge": true
|
||||
}
|
||||
],
|
||||
"platformAutomerge": true
|
||||
}
|
||||
Reference in New Issue
Block a user