[Automated 🤖 ] Bump to version 2.327.1

Update github/codeql-action action to v3.29.4 (#468 )
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-07-25 11:20:08 -05:00 · 2025-07-23 21:14:56 +00:00 · 2025-07-22 23:44:43 +00:00 · 2025-07-22 13:50:50 -05:00 · 2025-07-14 08:01:53 -05:00 · 2025-07-14 09:23:52 +01:00
24 changed files with 1496 additions and 249 deletions
@@ -0,0 +1,3 @@
+query-filters:
+- include:
+    id: actions/unpinned-tag
@@ -4,6 +4,7 @@ on:
    paths:
      - Dockerfile.base
      - .github/workflows/base.yml
+      - goss*
    branches:
      - master
      - develop
@@ -11,98 +12,246 @@ on:
    - cron:  '0 22 * * *'

 jobs:
-  ubuntu_base_latest_deploy:
+  ubuntu_base_tests:
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, noble]
+        platform: [amd64, arm64]
+      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=ubuntu-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:latest
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi

+  debian_base_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bookworm, sid]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=debian-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Login to DockerHub
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+
+
+  ubuntu_base_latest_deploy:
+    runs-on: ubuntu-latest
+    needs: ubuntu_base_tests
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Login to DockerHub
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:latest \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  ubuntu_base_deploy:
    runs-on: ubuntu-latest
+    needs: ubuntu_base_tests
    strategy:
      matrix:
        release: [jammy, focal, noble]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  debian_base_deploy:
    runs-on: ubuntu-latest
+    needs: debian_base_tests
    strategy:
      matrix:
        release: [bookworm, sid]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -0,0 +1,30 @@
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  analyze:
+    name: Analyze GitHub Actions YAML
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
+        with:
+          languages: "actions"
+          queries: security-extended
+          config-file: .github/codeql/codeql-config.yml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
+        with:
+          category: "/language:actions"
@@ -15,118 +15,357 @@ permissions:
  packages: write

 jobs:
-  ubuntu_latest_deploy:
+  ubuntu_tests:
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, noble]
+        platform: [amd64, arm64]
+      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=ubuntu-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Login to DockerHub
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+
+  debian_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bookworm, sid]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=debian-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Login to DockerHub
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+
+  ubuntu_latest_deploy:
+    runs-on: ubuntu-latest
+    needs: ubuntu_tests
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Update Dockerfile FROM org
        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:latest,ghcr.io/${{ github.repository }}:latest
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:latest \
+              --tag ghcr.io/${{ github.repository }}:latest \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  ubuntu_deploy:
    runs-on: ubuntu-latest
+    needs: ubuntu_tests
    strategy:
      matrix:
        release: [jammy, focal, noble]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{env.ORG}}/github-runner:ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:ubuntu-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  debian_deploy:
    runs-on: ubuntu-latest
+    needs: debian_tests
    strategy:
      matrix:
        release: [bookworm, sid]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:debian-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Create Release
      id: create_release
-      uses: actions/create-release@v1
+      uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
@@ -31,39 +31,46 @@ jobs:
    needs: create-release
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Update Dockerfile FROM org
        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }},ghcr.io/${{ github.repository }}:${{ env.TAG }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  ubuntu_tag:
    runs-on: ubuntu-latest
@@ -74,40 +81,46 @@ jobs:
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }}-ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  debian_tag:
    runs-on: ubuntu-latest
    strategy:
@@ -117,36 +130,43 @@ jobs:
    needs: create-release
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }}-debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -11,7 +11,7 @@ jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
        with:
          stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
          stale-pr-message: 'This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.'
@@ -5,11 +5,231 @@ name: "Trigger: Push action"

 jobs:
  tests:
-    name: Tests
+    name: Lint
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
-      - uses: actions/setup-python@v5
-      - uses: pre-commit/action@v3.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@master
+        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master
+
+  ubuntu_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, noble]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=ubuntu-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Combine Dockerfile
+        run: |
+          cp Dockerfile.base Dockerfile.final.ubuntu-${{ matrix.release }};
+          sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.final.ubuntu-${{ matrix.release }}
+
+          # Combine the dockerfiles
+          cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}
+          cat Dockerfile.ubuntu-${{ matrix.release }} | sed "s/^FROM.*//" >>Dockerfile.final.ubuntu-${{ matrix.release }}
+
+          # Sanity check
+          grep FROM Dockerfile.final.ubuntu-${{ matrix.release }}
+      - name: Retry build final image
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.final.ubuntu-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+  debian_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bookworm, sid]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=debian-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Combine Dockerfile
+        run: |
+          cp Dockerfile.base Dockerfile.final.debian-${{ matrix.release }}
+          sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.final.debian-${{ matrix.release }}
+
+          # Combine the dockerfiles
+          cp Dockerfile Dockerfile.debian-${{ matrix.release }}
+          cat Dockerfile.debian-${{ matrix.release }} | sed "s/^FROM.*//" >>Dockerfile.final.debian-${{ matrix.release }}
+
+          # Sanity check
+          grep FROM Dockerfile.final.debian-${{ matrix.release }}
+      - name: Retry build final image
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.final.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
@@ -1 +1,2 @@
 *.bak
+.idea
@@ -3,6 +3,7 @@ repos:
  rev: v4.3.0
  hooks:
  - id: check-yaml
+    exclude: goss_[a-z]*.yaml
  - id: end-of-file-fixer
  - id: trailing-whitespace
  - id: check-case-conflict
@@ -5,7 +5,7 @@ LABEL maintainer="myoung34@my.apsu.edu"
 ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
 RUN mkdir -p /opt/hostedtoolcache

-ARG GH_RUNNER_VERSION="2.319.1"
+ARG GH_RUNNER_VERSION="2.327.1"

 ARG TARGETPLATFORM

@@ -2,94 +2,14 @@ FROM ubuntu:focal
 LABEL maintainer="myoung34@my.apsu.edu"

 ARG DUMB_INIT_VERSION="1.2.2"
-ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
-
 # TODO: remove git PPA and skopeo customizations for focal when focal hits EOL
 ENV GIT_LFS_VERSION="3.2.0"
+
 ENV LANG=en_US.UTF-8
 ENV LANGUAGE=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
-# hadolint ignore=SC2086,DL3015,DL3008,DL3013,SC2015
-RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends gnupg \
-  && ( \
-    apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
-      || apt-key adv --keyserver pgp.mit.edu --recv-keys ${GIT_CORE_PPA_KEY} \
-      || apt-key adv --keyserver keyserver.pgp.com --recv-keys ${GIT_CORE_PPA_KEY} \
-  ) \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends \
-    gnupg \
-    lsb-release \
-    curl \
-    tar \
-    unzip \
-    zip \
-    apt-transport-https \
-    ca-certificates \
-    sudo \
-    gpg-agent \
-    software-properties-common \
-    build-essential \
-    zlib1g-dev \
-    zstd \
-    gettext \
-    libcurl4-openssl-dev \
-    inetutils-ping \
-    jq \
-    wget \
-    dirmngr \
-    openssh-client \
-    locales \
-    python3-pip \
-    python3-setuptools \
-    python3-venv \
-    python3 \
-    dumb-init \
-    nodejs \
-    rsync \
-    libpq-dev \
-    gosu \
-    pkg-config \
-  && DPKG_ARCH="$(dpkg --print-architecture)" \
-  && LSB_RELEASE_CODENAME="$(lsb_release --codename | cut -f2)" \
-  && sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers \
-  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && (echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu focal main>/etc/apt/sources.list.d/git-core.list ) || : ) \
-  && apt-get update \
-  && ( apt-get install -y --no-install-recommends git || apt-get install -t stable -y --no-install-recommends git ) \
-  && ( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] && apt-get install -y --no-install-recommends liblttng-ust0 || : ) \
-  && ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
-  && ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install && rm awscliv2.zip) || pip3 install --no-cache-dir awscli ) \
-  && ( curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz && tar -xzf /tmp/lfs.tar.gz -C /tmp && /tmp/git-lfs-${GIT_LFS_VERSION}/install.sh && rm -rf /tmp/lfs.tar.gz  /tmp/git-lfs-${GIT_LFS_VERSION}) \
-  && distro=$(lsb_release -is | awk '{print tolower($0)}') \
-  && mkdir -p /etc/apt/keyrings \
-  && ( curl -fsSL https://download.docker.com/linux/${distro}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg ) \
-  && version=$(lsb_release -cs | sed 's/trixie\|n\/a/bookworm/g') \
-  && ( echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${distro} ${version} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null ) \
-  && apt-get update \
-  && apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated \
-  && echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose \
-  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "available in 20.10 and higher" && echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://build.opensuse.org/projects/devel:kubic/signing_keys/download?kind=gpg" | apt-key add - ) || : ) \
-  && apt-get update \
-  && ( apt-get install -y --no-install-recommends podman buildah skopeo || : ) \
-  && GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" | jq -r '.browser_download_url') \
-  && curl -sSLo /tmp/ghcli.deb ${GH_CLI_DOWNLOAD_URL} && apt-get -y install /tmp/ghcli.deb && rm /tmp/ghcli.deb \
-  && YQ_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/mikefarah/yq/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && YQ_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/mikefarah/yq/releases/latest | jq ".assets[] | select(.name == \"yq_linux_${DPKG_ARCH}.tar.gz\")" | jq -r '.browser_download_url') \
-  && ( curl -s ${YQ_DOWNLOAD_URL} -L -o /tmp/yq.tar.gz && tar -xzf /tmp/yq.tar.gz -C /tmp && mv /tmp/yq_linux_${DPKG_ARCH} /usr/local/bin/yq) \
-  && PWSH_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/PowerShell/PowerShell/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && PWSH_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/PowerShell/PowerShell/releases/latest | jq -r ".assets[] | select(.name == \"powershell-${PWSH_VERSION}-linux-${DPKG_ARCH//amd64/x64}.tar.gz\") | .browser_download_url") \
-  && ( curl -L -o /tmp/powershell.tar.gz $PWSH_DOWNLOAD_URL && mkdir -p /opt/powershell && tar zxf /tmp/powershell.tar.gz -C /opt/powershell && chmod +x /opt/powershell/pwsh && ln -s /opt/powershell/pwsh /usr/bin/pwsh ) \
-  && rm -rf /var/lib/apt/lists/* \
-  && rm -rf /tmp/* \
-  && sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker \
-  && groupadd -g 121 runner \
-  && useradd -mr -d /home/runner -u 1001 -g 121 runner \
-  && usermod -aG sudo runner \
-  && usermod -aG docker runner \
-  && echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers \
-  && ( [[ -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list ]] && rm /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list || : )
+
+COPY --chmod=700 build/ /tmp/build/
+RUN /tmp/build/install_base.sh
@@ -10,6 +10,11 @@ This will run the [new self-hosted github actions runners](https://help.github.c
 Please see [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage)
 Please read [the contributing guidelines](https://github.com/myoung34/docker-github-actions-runner/blob/master/CONTRIBUTING.md)

+
+## Included software and configuration ##
+
+While this project is not perfectly 1:1 with the software upstream, the included packages etc are available [here](https://github.com/myoung34/docker-github-actions-runner/blob/master/build/config.json). Documentation can be found in [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage#modifications)
+
 ## Notes ##

 ### Security ###
@@ -38,7 +43,7 @@ Currently runners [do not support containerd](https://github.com/actions/runner/
 | ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` `/\d\.\d{3}\.\d+-ubuntu-focal/`| [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) [ubuntu-focal](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-focal) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. Tags with `-ubuntu-focal` are included and created on [upstream tags](https://github.com/actions/runner/tags).|
 | ubuntu noble | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-noble/` | [ubuntu-noble](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-noble) | This is the latest build from noble (Rebuilt nightly and on master merges). Tags with `-ubuntu-noble` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 | ubuntu jammy | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-jammy/` | [ubuntu-jammy](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-jammy) | This is the latest build from jammy (Rebuilt nightly and on master merges). Tags with `-ubuntu-jammy` are included and created on [upstream tags](https://github.com/actions/runner/tags). | There is [currently an issue with jammy from inside a 20.04LTS host](https://github.com/myoung34/docker-github-actions-runner/issues/219) which is why this is not `latest` |
-| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 | debian bookworm | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-bookworm/` | [debian-bookworm](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bookworm) | This is the latest build from bookworm (Rebuilt nightly and on master merges). Tags with `-debian-bookworm` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 | debian sid | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |

@@ -51,7 +56,7 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `RUN_AS_ROOT` | Boolean to run as root. If `true`: will run as root. If `True` and the user is overridden it will error. If any other value it will run as the `runner` user and allow an optional override. Default is `true` |
 | `RUNNER_NAME` | The name of the runner to use. Supersedes (overrides) `RUNNER_NAME_PREFIX` |
 | `RUNNER_NAME_PREFIX` | A prefix for runner name (See `RANDOM_RUNNER_SUFFIX` for how the full name is generated). Note: will be overridden by `RUNNER_NAME` if provided. Defaults to `github-runner` |
-| `RANDOM_RUNNER_SUFFIX` | Boolean to use a randomized runner name suffix (preceded by `RUNNER_NAME_PREFIX`). Will use a 13 character random string by default. If set to a value other than true it will attempt to use the contents of `/etc/hostname` or fall back to a random string if the file does not exist or is empty. Note: will be overridden by `RUNNER_NAME` if provided. Defaults to `true`. |
+| `RANDOM_RUNNER_SUFFIX` | Boolean to use a randomized runner name suffix (preceded by `RUNNER_NAME_PREFIX`). Will use a 13 character random string by default. If set to a value other than true and `RUNNER_NAME_PREFIX` is set to an empty string, it will attempt to use the contents of `/etc/hostname` or fall back to a random string if the file does not exist or is empty. Note: will be overridden by `RUNNER_NAME` if provided. Defaults to `true`. |
 | `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
 | `APP_ID` | The github application ID. Must be paired with `APP_PRIVATE_KEY` and should not be used with `ACCESS_TOKEN` or `RUNNER_TOKEN` |
 | `APP_PRIVATE_KEY` | The github application private key. Must be paired with `APP_ID` and should not be used with `ACCESS_TOKEN` or `RUNNER_TOKEN` |
@@ -71,3 +76,51 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `DISABLE_AUTO_UPDATE` | Optional environment variable to [disable auto updates](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/). Auto updates are enabled by default to preserve past behavior. Any value is considered truthy and will disable them. |
 | `START_DOCKER_SERVICE` | Optional flag which automatically starts the docker service if set to `true`. Useful when using [sysbox](https://github.com/nestybox/sysbox). Defaults to `false`. |
 | `NO_DEFAULT_LABELS` | Optional environment variable to disable adding the default self-hosted, platform, and architecture labels to the runner. Any value is considered truthy and will disable them. |
+| `DEBUG_ONLY` | Optional boolean to print debug output but not run any actual registration or runner commands. Used in CI and testing. Default: false |
+| `DEBUG_OUTPUT` | Optional boolean to print additional debug output. Default: false |
+| `UNSET_CONFIG_VARS` | Optional flag to unset all configuration environment variables after runner setup but before starting the runner. This prevents these variables from leaking into the workflow environment. Set to 'true' to enable. Defaults to 'false' for backward compatibility. |
+
+## Tests ##
+
+Tests are written in [goss](https://github.com/goss-org/goss/) for general assertions.
+It's expected that all pull-requests have relevant assertions in order to be merged.
+
+Prereqs: Ensure that docker, goss and dgoss are set up
+Note: while testing locally works, github actions will test all variations of operating systems and supported architectures.
+
+The test file expects the image to test as an environment variable `GH_RUNNER_IMAGE` to assist in CI
+
+To test:
+```
+$ # need to set minimum vars for the goss test interpolation
+$ echo "os: ubuntu" >goss_vars.yaml
+$ echo "oscodename: focal" >>goss_vars.yaml
+$ echo "arch: x86_64" >>goss_vars.yaml
+$ docker build -t my-base-test -f Dockerfile.base .
+$ # Use the base image in your final
+$ sed -i.bak 's/^FROM.*/FROM my-base-test/g' Dockerfile
+$ docker build -t my-full-test -f Dockerfile .
+$ # Run the full test from Dockerfile.base on the current git HEAD
+$ GOSS_VARS=goss_vars.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+  -e DEBUG_ONLY=true \
+  -e RUNNER_NAME=huzzah \
+  -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+  -e RUN_AS_ROOT=true \
+  -e RUNNER_NAME_PREFIX=asdf \
+  -e ACCESS_TOKEN=1234 \
+  -e APP_ID=5678 \
+  -e APP_PRIVATE_KEY=2345 \
+  -e APP_LOGIN=SOMETHING \
+  -e RUNNER_SCOPE=org \
+  -e ORG_NAME=myoung34 \
+  -e ENTERPRISE_NAME=emyoung34 \
+  -e LABELS=blue,green \
+  -e RUNNER_TOKEN=3456 \
+  -e RUNNER_WORKDIR=/tmp/a \
+  -e RUNNER_GROUP=wat \
+  -e GITHUB_HOST=github.example.com \
+  -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+  -e EPHEMERAL=true \
+  -e DISABLE_AUTO_UPDATE=true \
+  my-full-test 10
+```
@@ -0,0 +1,113 @@
+{
+  "user": {
+    "user-id": 1001,
+    "group-id": 121
+  },
+  "install": [
+    {
+      "category": "aws",
+      "source": "script",
+      "packages": [
+        "aws-cli"
+      ]
+    },
+    {
+      "category": "development",
+      "source": "apt",
+      "packages": [
+        "build-essential",
+        "zlib1g-dev",
+        "zstd",
+        "gettext",
+        "libcurl4-openssl-dev",
+        "libpq-dev",
+        "pkg-config",
+        "software-properties-common"
+      ]
+    },
+    {
+      "category": "container-tools",
+      "source": "script",
+      "packages": [
+        "container-tools"
+      ]
+    },
+    {
+      "category": "debugging",
+      "source": "script",
+      "packages": [
+        "liblttng-ust"
+      ]
+    },
+    {
+      "category": "docker-cli",
+      "source": "script",
+      "packages": [
+        "docker-cli"
+      ]
+    },
+    {
+      "category": "docker",
+      "source": "script",
+      "packages": [
+        "docker"
+      ]
+    },
+    {
+      "category": "git",
+      "source": "script",
+      "packages": [
+        "git",
+        "git-lfs"
+      ]
+    },
+    {
+      "category": "github",
+      "source": "script",
+      "packages": [
+        "github-cli"
+      ]
+    },
+    {
+      "category": "network-tools",
+      "source": "apt",
+      "packages": [
+        "inetutils-ping",
+        "wget",
+        "openssh-client",
+        "rsync"
+      ]
+    },
+    {
+      "category": "node",
+      "source": "apt",
+      "packages": [
+        "nodejs"
+      ]
+    },
+    {
+      "category": "powershell",
+      "source": "script",
+      "packages": [
+        "powershell"
+      ]
+    },
+    {
+      "category": "python",
+      "source": "apt",
+      "packages": [
+        "python3",
+        "python3-pip",
+        "python3-setuptools",
+        "python3-venv"
+      ]
+    },
+    {
+      "category": "yq",
+      "source": "script",
+      "packages": [
+        "yq"
+      ]
+    }
+  ]
+}
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function config_file() {
+  echo "$(dirname "${BASH_SOURCE[0]}")/config.json"
+}
+
+function user_id() {
+  jq -r '.user."user-id"' "$(config_file)"
+}
+
+function group_id() {
+  jq -r '.user."group-id"' "$(config_file)"
+}
+
+function apt_packages() {
+  jq -r '.install[] | select(.source == "apt") | .packages[]' "$(config_file)" | paste -sd ' ' -
+}
+
+function script_packages() {
+  jq -r '.install[] | select(.source == "script") | .packages[]' "$(config_file)"
+}
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Required by the build or runner operation
+function install_essentials() {
+  apt-get install -y --no-install-recommends \
+      ca-certificates \
+      curl \
+      jq \
+      gnupg \
+      tar \
+      unzip \
+      zip \
+      apt-transport-https \
+      sudo \
+      dirmngr \
+      locales \
+      gosu \
+      gpg-agent \
+      dumb-init \
+      libc-bin
+}
+
+function install_tools_apt() {
+  apt_packages | xargs apt-get install -y --no-install-recommends
+}
+
+function remove_caches() {
+  rm -rf /var/lib/apt/lists/*
+  rm -rf /tmp/*
+}
+
+function setup_sudoers() {
+  sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers
+  echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+}
+
+echo en_US.UTF-8 UTF-8 >> /etc/locale.gen
+
+scripts_dir=$(dirname "$0")
+# shellcheck source=/dev/null
+source "$scripts_dir/sources.sh"
+# shellcheck source=/dev/null
+source "$scripts_dir/tools.sh"
+# shellcheck source=/dev/null
+source "$scripts_dir/config.sh"
+
+apt-get update
+install_essentials
+configure_sources
+
+apt-get update
+install_tools_apt
+install_tools
+
+setup_sudoers
+groupadd -g "$(group_id)" runner
+useradd -mr -d /home/runner -u "$(user_id)" -g "$(group_id)" runner
+usermod -aG sudo runner
+usermod -aG docker runner
+
+remove_sources
+remove_caches
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function configure_git() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  local GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
+
+  gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY}
+  gpg --export ${GIT_CORE_PPA_KEY} | gpg --dearmor -o /usr/share/keyrings/git-core.gpg
+
+  if [[ "${VERSION_CODENAME}" == "focal" ]]; then
+    local GIT_CORE_FOCAL_PPA_KEY="E363C90F8F1B6217"
+    local KEYRING_FILE="/usr/share/keyrings/git-core-focal.gpg"
+    gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys ${GIT_CORE_FOCAL_PPA_KEY}
+    gpg --export ${GIT_CORE_FOCAL_PPA_KEY} | gpg --dearmor -o "${KEYRING_FILE}"
+    echo deb [signed-by=${KEYRING_FILE}] http://ppa.launchpad.net/git-core/ppa/ubuntu focal main>/etc/apt/sources.list.d/git-core.list
+
+  fi
+}
+
+function configure_docker() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  mkdir -p /etc/apt/keyrings
+  curl -fsSL "https://download.docker.com/linux/$ID/gpg" | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+
+  local version DPKG_ARCH
+  version=$(echo "$VERSION_CODENAME" | sed 's/trixie\|n\/a/bookworm/g')
+  DPKG_ARCH="$(dpkg --print-architecture)"
+  echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$ID ${version} stable" \
+    | tee /etc/apt/sources.list.d/docker.list > /dev/null
+}
+
+function configure_container_tools() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  if [[ "${VERSION_CODENAME}" == "focal" ]]; then
+    echo "available in 20.10 and higher"
+    echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" \
+      | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
+    curl -L "https://build.opensuse.org/projects/devel:kubic/signing_keys/download?kind=gpg" \
+      | /usr/bin/apt-key add -
+  fi
+}
+
+function configure_sources() {
+  configure_git
+  configure_docker
+  configure_container_tools
+}
+
+function remove_sources() {
+  rm -f /etc/apt/sources.list.d/git-core.list
+  rm -f /etc/apt/sources.list.d/docker.list
+  rm -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
+}
@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function install_git() {
+  ( apt-get install -y --no-install-recommends git \
+   || apt-get install -t stable -y --no-install-recommends git )
+}
+
+function install_liblttng-ust() {
+  if [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]]; then
+    apt-get install -y --no-install-recommends liblttng-ust0
+  fi
+
+  if [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]]; then
+    apt-get install -y --no-install-recommends liblttng-ust1
+  fi
+}
+
+function install_aws-cli() {
+  ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" \
+    && unzip -q awscliv2.zip -d /tmp/ \
+    && /tmp/aws/install \
+    && rm awscliv2.zip \
+  ) \
+    || pip3 install --no-cache-dir awscli
+}
+
+function install_git-lfs() {
+  local DPKG_ARCH
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz
+  tar -xzf /tmp/lfs.tar.gz -C /tmp
+  "/tmp/git-lfs-${GIT_LFS_VERSION}/install.sh"
+  rm -rf /tmp/lfs.tar.gz "/tmp/git-lfs-${GIT_LFS_VERSION}"
+}
+
+function install_docker-cli() {
+  apt-get install -y docker-ce-cli --no-install-recommends --allow-unauthenticated
+}
+
+function install_docker() {
+  apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated
+
+  echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose
+  chmod +x /usr/local/bin/docker-compose
+
+  sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker
+}
+
+function install_container-tools() {
+  ( apt-get install -y --no-install-recommends podman buildah skopeo || : )
+}
+
+function install_github-cli() {
+  local DPKG_ARCH GH_CLI_VERSION GH_CLI_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/cli/cli/releases/latest \
+      | jq -r '.tag_name' | sed 's/^v//g')
+
+  GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/cli/cli/releases/latest \
+      | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" \
+      | jq -r '.browser_download_url')
+
+  curl -sSLo /tmp/ghcli.deb "${GH_CLI_DOWNLOAD_URL}"
+  apt-get -y install /tmp/ghcli.deb
+  rm /tmp/ghcli.deb
+}
+
+function install_yq() {
+  local DPKG_ARCH YQ_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  YQ_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/mikefarah/yq/releases/latest \
+      | jq ".assets[] | select(.name == \"yq_linux_${DPKG_ARCH}.tar.gz\")" \
+      | jq -r '.browser_download_url')
+
+  curl -s "${YQ_DOWNLOAD_URL}" -L -o /tmp/yq.tar.gz
+  tar -xzf /tmp/yq.tar.gz -C /tmp
+  mv "/tmp/yq_linux_${DPKG_ARCH}" /usr/local/bin/yq
+}
+
+function install_powershell() {
+  local DPKG_ARCH PWSH_VERSION PWSH_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  PWSH_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
+      | jq -r '.tag_name' \
+      | sed 's/^v//g')
+
+  PWSH_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
+      | jq -r ".assets[] | select(.name == \"powershell-${PWSH_VERSION}-linux-${DPKG_ARCH//amd64/x64}.tar.gz\") | .browser_download_url")
+
+  curl -L -o /tmp/powershell.tar.gz "$PWSH_DOWNLOAD_URL"
+  mkdir -p /opt/powershell
+  tar zxf /tmp/powershell.tar.gz -C /opt/powershell
+  chmod +x /opt/powershell/pwsh
+  ln -s /opt/powershell/pwsh /usr/bin/pwsh
+}
+
+function install_tools() {
+  local function_name
+  # shellcheck source=/dev/null
+  source "$(dirname "${BASH_SOURCE[0]}")/config.sh"
+
+  script_packages | while read -r package; do
+    function_name="install_${package}"
+    if declare -f "${function_name}" > /dev/null; then
+      "${function_name}"
+    else
+      echo "No install script found for package: ${package}"
+      exit 1
+    fi
+  done
+}
@@ -14,6 +14,7 @@ export -n APP_PRIVATE_KEY
 trap_with_arg() {
    func="$1" ; shift
    for sig ; do
+        # shellcheck disable=SC2064
        trap "$func $sig" "$sig"
    done
 }
@@ -25,9 +26,12 @@ deregister_runner() {
    RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
  fi
  ./config.sh remove --token "${RUNNER_TOKEN}"
+  [[ -f "/actions-runner/.runner" ]] && rm -f /actions-runner/.runner
  exit
 }

+_DEBUG_ONLY=${DEBUG_ONLY:-false}
+_DEBUG_OUTPUT=${DEBUG_OUTPUT:-false}
 _DISABLE_AUTOMATIC_DEREGISTRATION=${DISABLE_AUTOMATIC_DEREGISTRATION:-false}

 _RANDOM_RUNNER_SUFFIX=${RANDOM_RUNNER_SUFFIX:="true"}
@@ -38,7 +42,8 @@ if [[ ${RANDOM_RUNNER_SUFFIX} != "true" ]]; then
  if [[ -f "/etc/hostname" ]]; then
    # in some cases it can also be empty
    if [[ $(stat --printf="%s" /etc/hostname) -ne 0 ]]; then
-      _RUNNER_NAME=${RUNNER_NAME:-${RUNNER_NAME_PREFIX:-github-runner}-$(cat /etc/hostname)}
+      _RUNNER_NAME_PREFIX=${RUNNER_NAME_PREFIX-"github-runner"}
+      _RUNNER_NAME=${RUNNER_NAME:-${_RUNNER_NAME_PREFIX:+${_RUNNER_NAME_PREFIX}-}$(cat /etc/hostname)}
      echo "RANDOM_RUNNER_SUFFIX is ${RANDOM_RUNNER_SUFFIX}. /etc/hostname exists and has content. Setting runner name to ${_RUNNER_NAME}"
    else
      echo "RANDOM_RUNNER_SUFFIX is ${RANDOM_RUNNER_SUFFIX} ./etc/hostname exists but is empty. Not using /etc/hostname."
@@ -54,6 +59,8 @@ _RUNNER_GROUP=${RUNNER_GROUP:-Default}
 _GITHUB_HOST=${GITHUB_HOST:="github.com"}
 _RUN_AS_ROOT=${RUN_AS_ROOT:="true"}
 _START_DOCKER_SERVICE=${START_DOCKER_SERVICE:="false"}
+_UNSET_CONFIG_VARS=${UNSET_CONFIG_VARS:="false"}
+_CONFIGURED_ACTIONS_RUNNER_FILES_DIR=${CONFIGURED_ACTIONS_RUNNER_FILES_DIR:-""}

 # ensure backwards compatibility
 if [[ -z ${RUNNER_SCOPE} ]]; then
@@ -144,41 +151,80 @@ configure_runner() {
      --replace \
      "${ARGS[@]}"

-  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir "${_RUNNER_WORKDIR}"
+  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir -p "${_RUNNER_WORKDIR}"

 }

+unset_config_vars() {
+  echo "Unsetting configuration environment variables"
+  unset RUN_AS_ROOT
+  unset RUNNER_NAME
+  unset RUNNER_NAME_PREFIX
+  unset RANDOM_RUNNER_SUFFIX
+  unset ACCESS_TOKEN
+  unset APP_ID
+  unset APP_PRIVATE_KEY
+  unset APP_LOGIN
+  unset RUNNER_SCOPE
+  unset ORG_NAME
+  unset ENTERPRISE_NAME
+  unset LABELS
+  unset REPO_URL
+  unset RUNNER_TOKEN
+  unset RUNNER_WORKDIR
+  unset RUNNER_GROUP
+  unset GITHUB_HOST
+  unset DISABLE_AUTOMATIC_DEREGISTRATION
+  unset CONFIGURED_ACTIONS_RUNNER_FILES_DIR
+  unset EPHEMERAL
+  unset DISABLE_AUTO_UPDATE
+  unset START_DOCKER_SERVICE
+  unset NO_DEFAULT_LABELS
+  unset UNSET_CONFIG_VARS
+}

 # Opt into runner reusage because a value was given
-if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+if [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
  echo "Runner reusage is enabled"

  # directory exists, copy the data
-  if [[ -d "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  if [[ -d "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
    echo "Copying previous data"
-    cp -p -r "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}/." "/actions-runner"
+    cp -p -r "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}/." "/actions-runner"
  fi

  if [ -f "/actions-runner/.runner" ]; then
    echo "The runner has already been configured"
  else
-    configure_runner
+
+    if [[ ${_DEBUG_ONLY} == "false" ]]; then
+      configure_runner
+    fi
  fi
 else
  echo "Runner reusage is disabled"
-  configure_runner
+  if [[ ${_DEBUG_ONLY} == "false" ]]; then
+    [[ -f "/actions-runner/.runner" ]] && rm -f /actions-runner/.runner
+    configure_runner
+  fi
 fi

-if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
-  echo "Reusage is enabled. Storing data to ${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+if [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  echo "Reusage is enabled. Storing data to ${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+  if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
+    echo "DISABLE_AUTOMATIC_DEREGISTRATION should be set to true to avoid issues with re-using a deregistered runner."
+    exit 1
+  fi
  # Quoting (even with double-quotes) the regexp brokes the copying
-  cp -p -r "/actions-runner/_diag" "/actions-runner/svc.sh" /actions-runner/.[^.]* "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+  cp -p -r "/actions-runner/_diag" "/actions-runner/svc.sh" /actions-runner/.[^.]* "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
 fi



 if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
-  trap_with_arg deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
+  if [[ ${_DEBUG_ONLY} == "false" ]]; then
+    trap_with_arg deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
+  fi
 fi

 # Start docker service if needed (e.g. for docker-in-docker)
@@ -186,27 +232,68 @@ if [[ ${_START_DOCKER_SERVICE} == "true" ]]; then
  echo "Starting docker service"
  _PREFIX=""
  [[ ${_RUN_AS_ROOT} != "true" ]] && _PREFIX="sudo"
-  ${_PREFIX} service docker start
+
+  if [[ ${_DEBUG_ONLY} == "true" ]]; then
+    echo ${_PREFIX} service docker start
+  else
+    ${_PREFIX} service docker start
+  fi
+fi
+
+# Unset configuration environment variables if the flag is set
+if [[ ${_UNSET_CONFIG_VARS} == "true" ]]; then
+  unset_config_vars
 fi

 # Container's command (CMD) execution as runner user


+if [[ ${_DEBUG_ONLY} == "true" ]] || [[ ${_DEBUG_OUTPUT} == "true" ]] ; then
+  echo ""
+  echo "Disable automatic registration: ${_DISABLE_AUTOMATIC_DEREGISTRATION}"
+  echo "Random runner suffix: ${_RANDOM_RUNNER_SUFFIX}"
+  echo "Runner name: ${_RUNNER_NAME}"
+  echo "Runner workdir: ${_RUNNER_WORKDIR}"
+  echo "Labels: ${_LABELS}"
+  echo "Runner Group: ${_RUNNER_GROUP}"
+  echo "Github Host: ${_GITHUB_HOST}"
+  echo "Run as root:${_RUN_AS_ROOT}"
+  echo "Start docker: ${_START_DOCKER_SERVICE}"
+fi
+
 if [[ ${_RUN_AS_ROOT} == "true" ]]; then
  if [[ $(id -u) -eq 0 ]]; then
-    "$@"
+    if [[ ${_DEBUG_ONLY} == "true" ]] || [[ ${_DEBUG_OUTPUT} == "true" ]] ; then
+      # shellcheck disable=SC2145
+      echo "Running $@"
+    fi
+    if [[ ${_DEBUG_ONLY} == "false" ]]; then
+      "$@"
+    fi
  else
    echo "ERROR: RUN_AS_ROOT env var is set to true but the user has been overridden and is not running as root, but UID '$(id -u)'"
    exit 1
  fi
 else
  if [[ $(id -u) -eq 0 ]]; then
-    [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && chown -R runner "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+    [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && chown -R runner "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
    chown -R runner "${_RUNNER_WORKDIR}" /actions-runner
    # The toolcache is not recursively chowned to avoid recursing over prepulated tooling in derived docker images
    chown runner /opt/hostedtoolcache/
-    /usr/sbin/gosu runner "$@"
+    if [[ ${_DEBUG_ONLY} == "true" ]] || [[ ${_DEBUG_OUTPUT} == "true" ]] ; then
+      # shellcheck disable=SC2145
+      echo "Running /usr/sbin/gosu runner $@"
+    fi
+    if [[ ${_DEBUG_ONLY} == "false" ]]; then
+      /usr/sbin/gosu runner "$@"
+    fi
  else
-    "$@"
+    if [[ ${_DEBUG_ONLY} == "true" ]] || [[ ${_DEBUG_OUTPUT} == "true" ]] ; then
+      # shellcheck disable=SC2145
+      echo "Running $@"
+    fi
+    if [[ ${_DEBUG_ONLY} == "false" ]]; then
+      "$@"
+    fi
  fi
 fi
@@ -0,0 +1,89 @@
+package:
+    curl:
+        installed: true
+    docker:
+        installed: false
+    docker-compose:
+        installed: false
+    git:
+        installed: true
+    git-lfs:
+        installed: false
+    jq:
+        installed: true
+    lsb_release:
+        installed: false
+    make:
+        installed: true
+    pwsh:
+        installed: false
+    python3:
+        installed: true
+    rsync:
+        installed: true
+    ssh:
+        installed: false
+    sudo:
+        installed: true
+    tar:
+        installed: true
+    unzip:
+        installed: true
+    wget:
+        installed: true
+    yq:
+        installed: false
+    # Ubuntu Focal is the only one currently that doesnt have an official upstream skopeo/buildah/podman
+    {{ if not (eq .Vars.oscodename "focal") }}
+    skopeo:
+        installed: true
+    buildah:
+        installed: true
+    podman:
+        installed: true
+    {{ end }}
+file:
+  /usr/bin/gh:
+    exists: true
+  /usr/bin/nodejs:
+    exists: true
+  /usr/sbin/gosu:
+    exists: true
+  /usr/bin/dumb-init:
+    exists: true
+  /etc/init.d/docker:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - /^\s*# ulimit -Hn/
+  /etc/sudoers:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - '/%sudo ALL=\(ALL\) NOPASSWD: ALL/'
+      - '/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/'
+  /etc/locale.gen:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - '/^en_US.UTF-8 UTF-8/'
+
+user:
+    runner:
+        exists: true
+        uid: 1001
+        gid: 121
+        groups:
+            - runner
+            - sudo
+            - docker
+group:
+    runner:
+        exists: true
+        gid: 121
@@ -0,0 +1,18 @@
+command:
+  /entrypoint.sh something:
+    exit-status: 0
+    stdout:
+      - "Runner reusage is disabled"
+      - ""
+      - "Disable automatic registration: true"
+      - "Random runner suffix: true"
+      - "Runner workdir: /tmp/a"
+      - "Runner name: huzzah"
+      - "Labels: blue,green"
+      - "Runner Group: wat"
+      - "Github Host: github.example.com"
+      - "Run as root:true"
+      - "Start docker: false"
+      - "Running something"
+    stderr: ""
+    timeout: 2000
@@ -0,0 +1,20 @@
+command:
+    /entrypoint.sh something:
+        exit-status: 0
+        stdout:
+            - REPO_URL required for repo runners
+            - Runner reusage is disabled
+            - ""
+            - 'Disable automatic registration: false'
+            - 'Random runner suffix: true'
+            - 'Runner name: test'
+            - 'Runner workdir: /_work/test'
+            - 'Labels: default'
+            - 'Runner Group: Default'
+            - 'Github Host: github.com'
+            - Run as root:true
+            - 'Start docker: false'
+            - Running something
+            - ""
+        stderr: ""
+        timeout: 2000
@@ -0,0 +1,9 @@
+command:
+  /entrypoint.sh something:
+    exit-status: 1
+    stdout:
+      - "Runner reusage is enabled"
+      - "Reusage is enabled. Storing data to /runner/data"
+      - "DISABLE_AUTOMATIC_DEREGISTRATION should be set to true to avoid issues with re-using a deregistered runner."
+    stderr: ""
+    timeout: 2000
@@ -10,4 +10,4 @@ curl -L "https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSIO
 tar -zxf actions.tar.gz
 rm -f actions.tar.gz
 ./bin/installdependencies.sh
-mkdir /_work
+mkdir -p /_work
@@ -1,7 +1,8 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
-    "config:base"
+    "config:base",
+    "helpers:pinGitHubActionDigests"
  ],
  "packageRules": [
    {
@@ -11,6 +12,11 @@
    {
      "matchDepTypes": ["devDependencies"],
      "automerge": true
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchPackagePatterns": [".*"],
+      "versioning": "digest"
    }
  ],
  "platformAutomerge": true
Author	SHA1	Message	Date
Marcus Young	81e09ddc65	[Automated 🤖 ] Bump to version 2.327.1	2025-07-25 11:20:08 -05:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	fcb09013a4	Update github/codeql-action action to v3.29.4 (#468 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-07-23 21:14:56 +00:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	b879b98f0d	Update github/codeql-action action to v3.29.3 (#467 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-07-22 23:44:43 +00:00
Marcus Young	e4df714376	[Automated 🤖 ] Bump to version 2.327.0	2025-07-22 13:50:50 -05:00
myoung34andGitHub	176b4f862d	Merge pull request #465 from ElsevierAlex/allow-runner-name-without-prefix Allow hostname without github-runner prefix to avoid 64-char limit	2025-07-14 08:01:53 -05:00
chorbea	bf1835f3ee	Defaulted RUNNER_NAME_PREFIX	2025-07-14 09:23:52 +01:00
Marcus Young	1113f5896b	[Automated 🤖 ] Bump to version 2.326.0	2025-07-07 15:19:13 -05:00
chorbea	a4c88c50ff	allow hostname without github-runner prefix to avoid 64-char limit	2025-07-04 10:11:55 +01:00
myoung34andGitHub	6510abfa97	Merge pull request #464 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.29.2	2025-07-02 20:25:12 -04:00
renovate[bot]andGitHub	1e5aef7fd9	Update github/codeql-action action to v3.29.2	2025-06-30 16:25:17 +00:00
myoung34andGitHub	767b90dc11	Merge pull request #463 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.29.1	2025-06-27 06:55:11 -05:00
renovate[bot]andGitHub	c4cde09fb4	Update github/codeql-action action to v3.29.1	2025-06-27 11:46:24 +00:00
myoung34andGitHub	93215e94d9	Merge pull request #461 from myoung34/renovate/docker-setup-buildx-action-3.x Update docker/setup-buildx-action action to v3.11.1	2025-06-18 10:56:12 -05:00
renovate[bot]andGitHub	cb4c4ac8ed	Update docker/setup-buildx-action action to v3.11.1	2025-06-18 13:43:01 +00:00
myoung34andGitHub	ba68ffeb81	Merge pull request #460 from myoung34/renovate/docker-setup-buildx-action-3.x Update docker/setup-buildx-action action to v3.11.0	2025-06-16 14:12:03 -05:00
renovate[bot]andGitHub	6311c21d14	Update docker/setup-buildx-action action to v3.11.0	2025-06-16 19:07:01 +00:00
myoung34andGitHub	b3c7474675	Merge pull request #458 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.29.0	2025-06-11 17:17:04 -05:00
renovate[bot]andGitHub	b67116f6e4	Update github/codeql-action action to v3.29.0	2025-06-11 22:03:48 +00:00
myoung34andGitHub	1d9e8868ad	Merge pull request #457 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.19	2025-06-03 10:20:18 -05:00
renovate[bot]andGitHub	2d4990e197	Update github/codeql-action action to v3.28.19	2025-06-03 15:10:37 +00:00
Marcus Young	7e5779b170	[Automated 🤖 ] Bump to version 2.325.0	2025-06-02 13:48:39 -05:00
myoung34andGitHub	56233b5a1c	Merge pull request #455 from SaschaHenning/master Fix RUNNER_WORKDIR not created if part of the folder structure is nonexisting	2025-05-22 09:54:58 -05:00
Sascha HenningandGitHub	2b0f61916a	fix RUNNER_WORKDIR not created if parent folder does not exist	2025-05-20 15:01:32 +02:00
myoung34andGitHub	d49ef96679	Merge pull request #454 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.18	2025-05-19 11:22:45 -05:00
renovate[bot]andGitHub	f66226db9c	Update github/codeql-action action to v3.28.18	2025-05-16 14:56:08 +00:00
Marcus Young	de943e2e38	[Automated 🤖 ] Bump to version 2.324.0	2025-05-13 00:27:05 -05:00
myoung34andGitHub	d9094bd6dd	Merge pull request #448 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.17	2025-05-02 06:21:22 -04:00
renovate[bot]andGitHub	46bb16d631	Update github/codeql-action action to v3.28.17	2025-05-02 09:58:26 +00:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	b304a0e3f1	Update actions/setup-python action to v5.6.0 (#447 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-04-24 14:31:26 +00:00
myoung34andGitHub	67197609ff	Merge pull request #446 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.16	2025-04-23 08:07:01 -05:00
renovate[bot]andGitHub	4aa08f7b87	Update github/codeql-action action to v3.28.16	2025-04-23 12:48:24 +00:00
myoung34andGitHub	c07669d21e	Merge pull request #444 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.15	2025-04-07 20:42:58 -05:00
renovate[bot]andGitHub	afe24fb382	Update github/codeql-action action to v3.28.15	2025-04-07 22:49:35 +00:00
myoung34andGitHub	4593a2c53b	Merge pull request #443 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.14	2025-04-07 09:06:09 -05:00
renovate[bot]andGitHub	febe59b6f2	Update github/codeql-action action to v3.28.14	2025-04-07 10:01:29 +00:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	abf6f7ef87	Update actions/setup-python action to v5.5.0 (#441 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-03-25 10:46:47 +00:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	8969c0a49b	Update github/codeql-action action to v3.28.13 (#439 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-03-24 22:14:27 +00:00
myoung34andGitHub	ac1308d764	Merge pull request #438 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.12	2025-03-20 15:45:29 -05:00
renovate[bot]andGitHub	c90771d489	Update github/codeql-action action to v3.28.12	2025-03-19 18:39:17 +00:00
Mark Young	5869f38e4b	[Automated 🤖 ] Bump to version 2.323.0	2025-03-19 13:38:45 -05:00
Mark Young	9e608c3a82	Move final actions to SHA's	2025-03-17 11:11:33 -05:00
Mark Young	b65e08bc91	Add codeql to flag unpinned actions refs	2025-03-17 09:15:06 -05:00
myoung34andGitHub	9270f9a7a7	Merge pull request #437 from myoung34/renovate/docker-setup-qemu-action-3.x Update docker/setup-qemu-action action to v3.6.0	2025-03-17 08:56:15 -05:00
myoung34andGitHub	4e8ac02be6	Merge pull request #436 from myoung34/renovate/docker-setup-buildx-action-3.x Update docker/setup-buildx-action action to v3.10.0	2025-03-17 08:56:08 -05:00
myoung34andGitHub	6c30d2e070	Merge pull request #435 from myoung34/renovate/docker-login-action-3.x Update docker/login-action action to v3.4.0	2025-03-17 08:56:00 -05:00
renovate[bot]andGitHub	5aadc7f42b	Update docker/setup-qemu-action action to v3.6.0	2025-03-17 13:55:49 +00:00
myoung34andGitHub	66eb4f5a2f	Merge pull request #434 from myoung34/renovate/actions-stale-9.x Update actions/stale action to v9.1.0	2025-03-17 08:55:47 -05:00
renovate[bot]andGitHub	e42df8f308	Update docker/setup-buildx-action action to v3.10.0	2025-03-17 13:55:43 +00:00
myoung34andGitHub	feedfa66f0	Merge pull request #433 from myoung34/renovate/actions-setup-python-5.x Update actions/setup-python action to v5.4.0	2025-03-17 08:55:41 -05:00
renovate[bot]andGitHub	1f125c1391	Update docker/login-action action to v3.4.0	2025-03-17 13:55:38 +00:00
renovate[bot]andGitHub	9d6d26c2d4	Update actions/stale action to v9.1.0	2025-03-17 13:55:33 +00:00
renovate[bot]andGitHub	5cfbf3423a	Update actions/setup-python action to v5.4.0	2025-03-17 13:55:30 +00:00
myoung34andGitHub	ad78bd8fd8	Merge pull request #432 from myoung34/renovate/actions-create-release-1.x Update actions/create-release action to v1.1.4	2025-03-17 08:55:25 -05:00
myoung34andGitHub	90fdc6b19c	Merge pull request #431 from myoung34/renovate/actions-checkout-4.x Update actions/checkout action to v4.2.2	2025-03-17 08:55:13 -05:00
myoung34andGitHub	8a526ec997	Merge pull request #430 from myoung34/renovate/nick-fields-retry-3.x Update nick-fields/retry action to v3.0.2	2025-03-17 08:55:03 -05:00
renovate[bot]andGitHub	9c9369a0e3	Update actions/create-release action to v1.1.4	2025-03-17 13:53:52 +00:00
renovate[bot]andGitHub	a79e0182bf	Update actions/checkout action to v4.2.2	2025-03-17 13:53:49 +00:00
renovate[bot]andGitHub	2b58586d88	Update nick-fields/retry action to v3.0.2	2025-03-17 13:53:45 +00:00
myoung34andGitHub	c1292d5720	Merge pull request #429 from myoung34/renovate/pin-dependencies Pin dependencies	2025-03-17 08:53:12 -05:00
renovate[bot]andGitHub	e8e9da59f0	Pin dependencies	2025-03-17 13:27:33 +00:00
Mark Young	d8df91da6d	Set renovate to prefer github actions sha's	2025-03-17 08:26:55 -05:00
myoung34andGitHub	651dbe1fdf	Merge pull request #427 from myoung34/fix_deregistration_on_reusable Force DISABLE_AUTOMATIC_DEREGISTRATION to be true on reusable runners, add tests	2025-02-24 11:56:18 -06:00
Mark Young	9ed37bca4c	Force DISABLE_AUTOMATIC_DEREGISTRATION to be true on reusable runners, add tests	2025-02-24 11:19:25 -06:00
Mark Young	b9c038dfd3	Fix remaining qemu libc-bin runs	2025-02-19 17:30:16 -06:00
myoung34andGitHub	38e96633b7	Merge pull request #425 from myoung34/libc-bin_segfault Attempt to fix GHA segfault	2025-02-19 17:03:43 -06:00
Mark Young	fb13e93b86	Fix GHA segfault on ubuntu-jammy for libc-bin * backtrack binfmt to v7 via https://github.com/tonistiigi/binfmt/issues/240	2025-02-19 09:50:25 -06:00
Marcus Young	c3436f8af3	[Automated 🤖 ] Bump to version 2.322.0	2025-01-24 09:00:57 -06:00
myoung34andGitHub	1a5ad74d28	Merge pull request #417 from myoung34/fix_debian_sid Fix debian sid	2024-12-11 16:44:11 -05:00
Mark Young	50340d28c3	Fix debian sid	2024-12-11 15:59:31 -05:00
Marcus Young	ec7f582118	[Automated 🤖 ] Bump to version 2.321.0	2024-11-13 10:37:31 -07:00
myoung34andGitHub	c36f07ff88	Merge pull request #408 from myoung34/renovate/actions-checkout-digest Update actions/checkout digest to 11bd719	2024-10-23 11:53:12 -05:00
renovate[bot]andGitHub	1c4008bc0b	Update actions/checkout digest to 11bd719	2024-10-23 16:50:20 +00:00
myoung34andGitHub	8873f648e7	Merge pull request #404 from myoung34/renovate/actions-checkout-digest Update actions/checkout digest to eef6144	2024-10-07 13:49:32 -05:00
renovate[bot]andGitHub	90e9fe160a	Update actions/checkout digest to eef6144	2024-10-07 18:40:39 +00:00
myoung34andGitHub	47ce625b58	Merge pull request #403 from bodograumann/patch-1 Make sure there is no remnant runner config before configuring	2024-10-06 14:06:40 -05:00
Bodo Graumann	c6f70ddb46	Apply suggestions from PR	2024-10-05 20:08:27 +02:00
Bodo GraumannandGitHub	d4ee023016	Make sure there is no remnant runner config before configuring Closes #402	2024-10-05 09:25:14 +02:00
Marcus Young	706339b472	[Automated 🤖 ] Bump to version 2.320.0	2024-10-03 14:56:00 -05:00
myoung34andGitHub	a164a11b6b	Merge pull request #399 from myoung34/readme_update Add information on how to view and modify the included packages and configuration	2024-09-27 06:26:14 -05:00
Marcus Young	c9036e711f	Add information on how to view and modify the included packages and configuration	2024-09-27 06:25:45 -05:00
myoung34andGitHub	a55d4f9a42	Merge pull request #393 from vyadh/config-driven-install Config driven install	2024-09-26 16:14:54 -05:00
Kieron Wilkinson	b34e2f59c1	Added script source for software installs via config.json	2024-09-26 21:24:12 +01:00
Kieron Wilkinson	11d8d4c524	Select apt packages to install from config.json	2024-09-26 21:24:12 +01:00
Kieron Wilkinson	29667cc827	Created a build config file with initially user and group id. This allows users to specify ids that are consistent with their host users	2024-09-26 21:24:11 +01:00
myoung34andGitHub	5615bd29fd	Merge pull request #398 from myoung34/fix_readme Fix readme for tests	2024-09-25 08:40:48 -05:00
Marcus Young	e40248bf5b	Fix readme for tests	2024-09-25 08:40:29 -05:00
myoung34andGitHub	cf3f558db2	Merge pull request #395 from myoung34/goss_deprecation Goss: change deprecated file.contains to file.contents	2024-09-23 08:00:07 -05:00
Marcus Young	156484048d	Goss: change deprecated file.contains to file.contents	2024-09-20 22:02:21 -05:00
myoung34andGitHub	c54340de85	Merge pull request #394 from myoung34/retry_buildx Wrap all tests and docker/build-push-action into nick-fields/retry	2024-09-10 15:13:03 -05:00
Marcus Young	4ef971402a	Wrap all tests and docker/build-push-action into nick-fields/retry	2024-09-10 13:02:36 -05:00
myoung34andGitHub	a7d71289d1	Merge pull request #391 from myoung34/test_dir Fix temp dir location for tests	2024-09-09 13:33:36 -05:00
Mark Young	583d899630	Fix temp dir location for tests	2024-09-09 13:33:24 -05:00
myoung34andGitHub	560b1e0287	Merge pull request #390 from myoung34/add_dir_test Add runner dir test output to goss	2024-09-09 11:35:21 -05:00
Marcus Young	c69304a308	Add runner dir test output to goss	2024-09-09 11:34:02 -05:00
myoung34andGitHub	a8e227675c	Merge pull request #385 from vyadh/install-scripts Refactored to a set of install scripts to avoid adding further complexity to the base Dockerfile and make it easier to disable tools	2024-09-06 21:54:22 -05:00
Kieron Wilkinson	3f73ad68c9	Fixed shellcheck issues	2024-09-06 21:03:14 +01:00
Kieron Wilkinson	0bcea869f0	Refactored Dockerfile.base install into dedicated scripts Additionally, this change: - Configures upfront to reduce number of apt updates - Removes use of lsb-release to allow simplification and avoid unnecessary dependencies in the base image (i.e. Python)	2024-09-06 16:56:19 +01:00
myoung34andGitHub	b8ce68480a	Merge pull request #384 from yamoyamoto/chore/unset-envs-before-launch-service feat: Prevent exposure of configuration environment variables to runner workflows	2024-09-06 06:21:53 -05:00
tomoya-kawaguchi	35c099d07e	chore: use local var	2024-09-06 16:56:27 +09:00
tomoya-kawaguchi	bf069ba26b	docs: add UNSET_CONFIG_VARS settings	2024-09-06 16:56:27 +09:00
tomoya-kawaguchi	a3360fccaa	chore: unset configuration environment variables if flag is set	2024-09-06 16:54:52 +09:00
myoung34andGitHub	ab85a5a708	Merge pull request #389 from myoung34/base_and_defaults_test Remove the final command test from the base, make it a "defaults" test	2024-09-05 12:41:25 -05:00
Mark Young	e36338743e	Remove the final command test from the base, make it a "defaults" test	2024-09-05 12:40:05 -05:00
myoung34andGitHub	75bcd96989	Merge pull request #388 from myoung34/bugfix/platforms_slash Bugfix: fix platforms to remove slash	2024-09-05 12:34:05 -05:00
Mark Young	78d8042a48	Bugfix: fix platforms to remove slash	2024-09-05 12:33:41 -05:00
myoung34andGitHub	1ec6d387e6	Merge pull request #387 from myoung34/goss_tests Add goss tests	2024-09-05 11:59:50 -05:00
Marcus Young	0a4919d643	Add vars file for os,oscodename,arch in test matrix	2024-09-05 11:07:11 -05:00
Marcus Young	87dcaa1bb5	Add goss tests	2024-09-05 10:01:22 -05:00