[Automated 🤖 ] Bump to version 2.329.0

Merge pull request #509 from myoung34/renovate/github-codeql-action-4.x
chore(deps): update github/codeql-action action to v4.30.8
2025-10-14 07:58:18 -07:00 · 2025-10-10 12:34:30 -05:00 · 2025-10-10 17:11:04 +00:00 · 2025-10-07 17:15:14 -05:00 · 2025-10-07 18:56:02 +00:00 · 2025-10-07 13:55:37 -05:00
25 changed files with 1504 additions and 254 deletions
@@ -0,0 +1,3 @@
+query-filters:
+- include:
+    id: actions/unpinned-tag
@@ -4,105 +4,255 @@ on:
    paths:
      - Dockerfile.base
      - .github/workflows/base.yml
+      - goss*
    branches:
      - master
      - develop
  schedule:
    - cron:  '0 22 * * *'
+  workflow_dispatch:

 jobs:
-  ubuntu_base_latest_deploy:
+  ubuntu_base_tests:
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, noble]
+        platform: [amd64, arm64]
+      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=ubuntu-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:latest
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi

+  debian_base_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bookworm, trixie]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=debian-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Login to DockerHub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+
+
+  ubuntu_base_latest_deploy:
+    runs-on: ubuntu-latest
+    needs: ubuntu_base_tests
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Login to DockerHub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:latest \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  ubuntu_base_deploy:
    runs-on: ubuntu-latest
+    needs: ubuntu_base_tests
    strategy:
      matrix:
        release: [jammy, focal, noble]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  debian_base_deploy:
    runs-on: ubuntu-latest
+    needs: debian_base_tests
    strategy:
      matrix:
-        release: [bookworm, sid]
+        release: [bookworm, trixie]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -0,0 +1,30 @@
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  analyze:
+    name: Analyze GitHub Actions YAML
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        with:
+          languages: "actions"
+          queries: security-extended
+          config-file: .github/codeql/codeql-config.yml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        with:
+          category: "/language:actions"
@@ -9,124 +9,364 @@ on:
      - develop
  schedule:
    - cron:  '59 23 * * *'
+  workflow_dispatch:

 permissions:
  contents: read
  packages: write

 jobs:
-  ubuntu_latest_deploy:
+  ubuntu_tests:
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, noble]
+        platform: [amd64, arm64]
+      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=ubuntu-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Login to DockerHub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+
+  debian_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bookworm, trixie]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=debian-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Login to DockerHub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+
+  ubuntu_latest_deploy:
+    runs-on: ubuntu-latest
+    needs: ubuntu_tests
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Update Dockerfile FROM org
        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:latest,ghcr.io/${{ github.repository }}:latest
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:latest \
+              --tag ghcr.io/${{ github.repository }}:latest \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  ubuntu_deploy:
    runs-on: ubuntu-latest
+    needs: ubuntu_tests
    strategy:
      matrix:
        release: [jammy, focal, noble]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{env.ORG}}/github-runner:ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:ubuntu-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  debian_deploy:
    runs-on: ubuntu-latest
+    needs: debian_tests
    strategy:
      matrix:
-        release: [bookworm, sid]
+        release: [bookworm, trixie]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:debian-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
    - name: Create Release
      id: create_release
-      uses: actions/create-release@v1
+      uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
@@ -31,39 +31,46 @@ jobs:
    needs: create-release
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Update Dockerfile FROM org
        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }},ghcr.io/${{ github.repository }}:${{ env.TAG }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  ubuntu_tag:
    runs-on: ubuntu-latest
@@ -74,79 +81,92 @@ jobs:
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }}-ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  debian_tag:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        release: [bookworm, sid]
+        release: [bookworm, trixie]
      fail-fast: false
    needs: create-release
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }}-debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -2,6 +2,7 @@ name: 'Close stale issues and PR'
 on:
  schedule:
    - cron: '30 1 * * *'
+  workflow_dispatch:

 permissions:
  issues: write
@@ -11,7 +12,7 @@ jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
        with:
          stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
          stale-pr-message: 'This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.'
@@ -5,11 +5,231 @@ name: "Trigger: Push action"

 jobs:
  tests:
-    name: Tests
+    name: Lint
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
-      - uses: actions/setup-python@v5
-      - uses: pre-commit/action@v3.0.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@master
+        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master
+
+  ubuntu_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, noble]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=ubuntu-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Combine Dockerfile
+        run: |
+          cp Dockerfile.base Dockerfile.final.ubuntu-${{ matrix.release }};
+          sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.final.ubuntu-${{ matrix.release }}
+
+          # Combine the dockerfiles
+          cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}
+          cat Dockerfile.ubuntu-${{ matrix.release }} | sed "s/^FROM.*//" >>Dockerfile.final.ubuntu-${{ matrix.release }}
+
+          # Sanity check
+          grep FROM Dockerfile.final.ubuntu-${{ matrix.release }}
+      - name: Retry build final image
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.final.ubuntu-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+  debian_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bookworm, trixie]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=debian-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Combine Dockerfile
+        run: |
+          cp Dockerfile.base Dockerfile.final.debian-${{ matrix.release }}
+          sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.final.debian-${{ matrix.release }}
+
+          # Combine the dockerfiles
+          cp Dockerfile Dockerfile.debian-${{ matrix.release }}
+          cat Dockerfile.debian-${{ matrix.release }} | sed "s/^FROM.*//" >>Dockerfile.final.debian-${{ matrix.release }}
+
+          # Sanity check
+          grep FROM Dockerfile.final.debian-${{ matrix.release }}
+      - name: Retry build final image
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.final.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
@@ -1 +1,2 @@
 *.bak
+.idea
@@ -3,6 +3,7 @@ repos:
  rev: v4.3.0
  hooks:
  - id: check-yaml
+    exclude: goss_[a-z]*.yaml
  - id: end-of-file-fixer
  - id: trailing-whitespace
  - id: check-case-conflict
@@ -1 +1 @@
-shellcheck 0.10.0
+shellcheck 0.11.0
@@ -5,7 +5,7 @@ LABEL maintainer="myoung34@my.apsu.edu"
 ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
 RUN mkdir -p /opt/hostedtoolcache

-ARG GH_RUNNER_VERSION="2.319.1"
+ARG GH_RUNNER_VERSION="2.329.0"

 ARG TARGETPLATFORM

@@ -2,94 +2,14 @@ FROM ubuntu:focal
 LABEL maintainer="myoung34@my.apsu.edu"

 ARG DUMB_INIT_VERSION="1.2.2"
-ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
-
 # TODO: remove git PPA and skopeo customizations for focal when focal hits EOL
 ENV GIT_LFS_VERSION="3.2.0"
+
 ENV LANG=en_US.UTF-8
 ENV LANGUAGE=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
-# hadolint ignore=SC2086,DL3015,DL3008,DL3013,SC2015
-RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends gnupg \
-  && ( \
-    apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
-      || apt-key adv --keyserver pgp.mit.edu --recv-keys ${GIT_CORE_PPA_KEY} \
-      || apt-key adv --keyserver keyserver.pgp.com --recv-keys ${GIT_CORE_PPA_KEY} \
-  ) \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends \
-    gnupg \
-    lsb-release \
-    curl \
-    tar \
-    unzip \
-    zip \
-    apt-transport-https \
-    ca-certificates \
-    sudo \
-    gpg-agent \
-    software-properties-common \
-    build-essential \
-    zlib1g-dev \
-    zstd \
-    gettext \
-    libcurl4-openssl-dev \
-    inetutils-ping \
-    jq \
-    wget \
-    dirmngr \
-    openssh-client \
-    locales \
-    python3-pip \
-    python3-setuptools \
-    python3-venv \
-    python3 \
-    dumb-init \
-    nodejs \
-    rsync \
-    libpq-dev \
-    gosu \
-    pkg-config \
-  && DPKG_ARCH="$(dpkg --print-architecture)" \
-  && LSB_RELEASE_CODENAME="$(lsb_release --codename | cut -f2)" \
-  && sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers \
-  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && (echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu focal main>/etc/apt/sources.list.d/git-core.list ) || : ) \
-  && apt-get update \
-  && ( apt-get install -y --no-install-recommends git || apt-get install -t stable -y --no-install-recommends git ) \
-  && ( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] && apt-get install -y --no-install-recommends liblttng-ust0 || : ) \
-  && ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
-  && ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install && rm awscliv2.zip) || pip3 install --no-cache-dir awscli ) \
-  && ( curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz && tar -xzf /tmp/lfs.tar.gz -C /tmp && /tmp/git-lfs-${GIT_LFS_VERSION}/install.sh && rm -rf /tmp/lfs.tar.gz  /tmp/git-lfs-${GIT_LFS_VERSION}) \
-  && distro=$(lsb_release -is | awk '{print tolower($0)}') \
-  && mkdir -p /etc/apt/keyrings \
-  && ( curl -fsSL https://download.docker.com/linux/${distro}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg ) \
-  && version=$(lsb_release -cs | sed 's/trixie\|n\/a/bookworm/g') \
-  && ( echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${distro} ${version} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null ) \
-  && apt-get update \
-  && apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated \
-  && echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose \
-  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "available in 20.10 and higher" && echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://build.opensuse.org/projects/devel:kubic/signing_keys/download?kind=gpg" | apt-key add - ) || : ) \
-  && apt-get update \
-  && ( apt-get install -y --no-install-recommends podman buildah skopeo || : ) \
-  && GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" | jq -r '.browser_download_url') \
-  && curl -sSLo /tmp/ghcli.deb ${GH_CLI_DOWNLOAD_URL} && apt-get -y install /tmp/ghcli.deb && rm /tmp/ghcli.deb \
-  && YQ_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/mikefarah/yq/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && YQ_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/mikefarah/yq/releases/latest | jq ".assets[] | select(.name == \"yq_linux_${DPKG_ARCH}.tar.gz\")" | jq -r '.browser_download_url') \
-  && ( curl -s ${YQ_DOWNLOAD_URL} -L -o /tmp/yq.tar.gz && tar -xzf /tmp/yq.tar.gz -C /tmp && mv /tmp/yq_linux_${DPKG_ARCH} /usr/local/bin/yq) \
-  && PWSH_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/PowerShell/PowerShell/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && PWSH_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/PowerShell/PowerShell/releases/latest | jq -r ".assets[] | select(.name == \"powershell-${PWSH_VERSION}-linux-${DPKG_ARCH//amd64/x64}.tar.gz\") | .browser_download_url") \
-  && ( curl -L -o /tmp/powershell.tar.gz $PWSH_DOWNLOAD_URL && mkdir -p /opt/powershell && tar zxf /tmp/powershell.tar.gz -C /opt/powershell && chmod +x /opt/powershell/pwsh && ln -s /opt/powershell/pwsh /usr/bin/pwsh ) \
-  && rm -rf /var/lib/apt/lists/* \
-  && rm -rf /tmp/* \
-  && sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker \
-  && groupadd -g 121 runner \
-  && useradd -mr -d /home/runner -u 1001 -g 121 runner \
-  && usermod -aG sudo runner \
-  && usermod -aG docker runner \
-  && echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers \
-  && ( [[ -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list ]] && rm /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list || : )
+
+COPY --chmod=700 build/ /tmp/build/
+RUN /tmp/build/install_base.sh
@@ -10,6 +10,11 @@ This will run the [new self-hosted github actions runners](https://help.github.c
 Please see [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage)
 Please read [the contributing guidelines](https://github.com/myoung34/docker-github-actions-runner/blob/master/CONTRIBUTING.md)

+
+## Included software and configuration ##
+
+While this project is not perfectly 1:1 with the software upstream, the included packages etc are available [here](https://github.com/myoung34/docker-github-actions-runner/blob/master/build/config.json). Documentation can be found in [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage#modifications)
+
 ## Notes ##

 ### Security ###
@@ -38,9 +43,10 @@ Currently runners [do not support containerd](https://github.com/actions/runner/
 | ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` `/\d\.\d{3}\.\d+-ubuntu-focal/`| [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) [ubuntu-focal](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-focal) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. Tags with `-ubuntu-focal` are included and created on [upstream tags](https://github.com/actions/runner/tags).|
 | ubuntu noble | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-noble/` | [ubuntu-noble](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-noble) | This is the latest build from noble (Rebuilt nightly and on master merges). Tags with `-ubuntu-noble` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 | ubuntu jammy | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-jammy/` | [ubuntu-jammy](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-jammy) | This is the latest build from jammy (Rebuilt nightly and on master merges). Tags with `-ubuntu-jammy` are included and created on [upstream tags](https://github.com/actions/runner/tags). | There is [currently an issue with jammy from inside a 20.04LTS host](https://github.com/myoung34/docker-github-actions-runner/issues/219) which is why this is not `latest` |
-| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 | debian bookworm | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-bookworm/` | [debian-bookworm](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bookworm) | This is the latest build from bookworm (Rebuilt nightly and on master merges). Tags with `-debian-bookworm` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
-| debian sid | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian trixie | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-trixie/` | [debian-trixie](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-trixie) | This is the latest build from trixie (Rebuilt nightly and on master merges). Tags with `-debian-trixie` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| ~~debian sid~~ | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is currently disabled as it is failing until `forky` is included in https://download.docker.com/linux/debian/dists/ ~~This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags).~~ | |

 These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.

@@ -51,7 +57,7 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `RUN_AS_ROOT` | Boolean to run as root. If `true`: will run as root. If `True` and the user is overridden it will error. If any other value it will run as the `runner` user and allow an optional override. Default is `true` |
 | `RUNNER_NAME` | The name of the runner to use. Supersedes (overrides) `RUNNER_NAME_PREFIX` |
 | `RUNNER_NAME_PREFIX` | A prefix for runner name (See `RANDOM_RUNNER_SUFFIX` for how the full name is generated). Note: will be overridden by `RUNNER_NAME` if provided. Defaults to `github-runner` |
-| `RANDOM_RUNNER_SUFFIX` | Boolean to use a randomized runner name suffix (preceded by `RUNNER_NAME_PREFIX`). Will use a 13 character random string by default. If set to a value other than true it will attempt to use the contents of `/etc/hostname` or fall back to a random string if the file does not exist or is empty. Note: will be overridden by `RUNNER_NAME` if provided. Defaults to `true`. |
+| `RANDOM_RUNNER_SUFFIX` | Boolean to use a randomized runner name suffix (preceded by `RUNNER_NAME_PREFIX`). Will use a 13 character random string by default. If set to a value other than true and `RUNNER_NAME_PREFIX` is set to an empty string, it will attempt to use the contents of `/etc/hostname` or fall back to a random string if the file does not exist or is empty. Note: will be overridden by `RUNNER_NAME` if provided. Defaults to `true`. |
 | `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
 | `APP_ID` | The github application ID. Must be paired with `APP_PRIVATE_KEY` and should not be used with `ACCESS_TOKEN` or `RUNNER_TOKEN` |
 | `APP_PRIVATE_KEY` | The github application private key. Must be paired with `APP_ID` and should not be used with `ACCESS_TOKEN` or `RUNNER_TOKEN` |
@@ -71,3 +77,51 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `DISABLE_AUTO_UPDATE` | Optional environment variable to [disable auto updates](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/). Auto updates are enabled by default to preserve past behavior. Any value is considered truthy and will disable them. |
 | `START_DOCKER_SERVICE` | Optional flag which automatically starts the docker service if set to `true`. Useful when using [sysbox](https://github.com/nestybox/sysbox). Defaults to `false`. |
 | `NO_DEFAULT_LABELS` | Optional environment variable to disable adding the default self-hosted, platform, and architecture labels to the runner. Any value is considered truthy and will disable them. |
+| `DEBUG_ONLY` | Optional boolean to print debug output but not run any actual registration or runner commands. Used in CI and testing. Default: false |
+| `DEBUG_OUTPUT` | Optional boolean to print additional debug output. Default: false |
+| `UNSET_CONFIG_VARS` | Optional flag to unset all configuration environment variables after runner setup but before starting the runner. This prevents these variables from leaking into the workflow environment. Set to 'true' to enable. Defaults to 'false' for backward compatibility. |
+
+## Tests ##
+
+Tests are written in [goss](https://github.com/goss-org/goss/) for general assertions.
+It's expected that all pull-requests have relevant assertions in order to be merged.
+
+Prereqs: Ensure that docker, goss and dgoss are set up
+Note: while testing locally works, github actions will test all variations of operating systems and supported architectures.
+
+The test file expects the image to test as an environment variable `GH_RUNNER_IMAGE` to assist in CI
+
+To test:
+```
+$ # need to set minimum vars for the goss test interpolation
+$ echo "os: ubuntu" >goss_vars.yaml
+$ echo "oscodename: focal" >>goss_vars.yaml
+$ echo "arch: x86_64" >>goss_vars.yaml
+$ docker build -t my-base-test -f Dockerfile.base .
+$ # Use the base image in your final
+$ sed -i.bak 's/^FROM.*/FROM my-base-test/g' Dockerfile
+$ docker build -t my-full-test -f Dockerfile .
+$ # Run the full test from Dockerfile.base on the current git HEAD
+$ GOSS_VARS=goss_vars.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+  -e DEBUG_ONLY=true \
+  -e RUNNER_NAME=huzzah \
+  -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+  -e RUN_AS_ROOT=true \
+  -e RUNNER_NAME_PREFIX=asdf \
+  -e ACCESS_TOKEN=1234 \
+  -e APP_ID=5678 \
+  -e APP_PRIVATE_KEY=2345 \
+  -e APP_LOGIN=SOMETHING \
+  -e RUNNER_SCOPE=org \
+  -e ORG_NAME=myoung34 \
+  -e ENTERPRISE_NAME=emyoung34 \
+  -e LABELS=blue,green \
+  -e RUNNER_TOKEN=3456 \
+  -e RUNNER_WORKDIR=/tmp/a \
+  -e RUNNER_GROUP=wat \
+  -e GITHUB_HOST=github.example.com \
+  -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+  -e EPHEMERAL=true \
+  -e DISABLE_AUTO_UPDATE=true \
+  my-full-test 10
+```
@@ -0,0 +1,112 @@
+{
+  "user": {
+    "user-id": 1001,
+    "group-id": 121
+  },
+  "install": [
+    {
+      "category": "aws",
+      "source": "script",
+      "packages": [
+        "aws-cli"
+      ]
+    },
+    {
+      "category": "development",
+      "source": "apt",
+      "packages": [
+        "build-essential",
+        "zlib1g-dev",
+        "zstd",
+        "gettext",
+        "libcurl4-openssl-dev",
+        "libpq-dev",
+        "pkg-config"
+      ]
+    },
+    {
+      "category": "container-tools",
+      "source": "script",
+      "packages": [
+        "container-tools"
+      ]
+    },
+    {
+      "category": "debugging",
+      "source": "script",
+      "packages": [
+        "liblttng-ust"
+      ]
+    },
+    {
+      "category": "docker-cli",
+      "source": "script",
+      "packages": [
+        "docker-cli"
+      ]
+    },
+    {
+      "category": "docker",
+      "source": "script",
+      "packages": [
+        "docker"
+      ]
+    },
+    {
+      "category": "git",
+      "source": "script",
+      "packages": [
+        "git",
+        "git-lfs"
+      ]
+    },
+    {
+      "category": "github",
+      "source": "script",
+      "packages": [
+        "github-cli"
+      ]
+    },
+    {
+      "category": "network-tools",
+      "source": "apt",
+      "packages": [
+        "inetutils-ping",
+        "wget",
+        "openssh-client",
+        "rsync"
+      ]
+    },
+    {
+      "category": "node",
+      "source": "apt",
+      "packages": [
+        "nodejs"
+      ]
+    },
+    {
+      "category": "powershell",
+      "source": "script",
+      "packages": [
+        "powershell"
+      ]
+    },
+    {
+      "category": "python",
+      "source": "apt",
+      "packages": [
+        "python3",
+        "python3-pip",
+        "python3-setuptools",
+        "python3-venv"
+      ]
+    },
+    {
+      "category": "yq",
+      "source": "script",
+      "packages": [
+        "yq"
+      ]
+    }
+  ]
+}
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function config_file() {
+  echo "$(dirname "${BASH_SOURCE[0]}")/config.json"
+}
+
+function user_id() {
+  jq -r '.user."user-id"' "$(config_file)"
+}
+
+function group_id() {
+  jq -r '.user."group-id"' "$(config_file)"
+}
+
+function apt_packages() {
+  jq -r '.install[] | select(.source == "apt") | .packages[]' "$(config_file)" | paste -sd ' ' -
+}
+
+function script_packages() {
+  jq -r '.install[] | select(.source == "script") | .packages[]' "$(config_file)"
+}
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Required by the build or runner operation
+function install_essentials() {
+  apt-get install -y --no-install-recommends \
+      ca-certificates \
+      curl \
+      jq \
+      gnupg \
+      tar \
+      unzip \
+      zip \
+      apt-transport-https \
+      sudo \
+      dirmngr \
+      locales \
+      gosu \
+      gpg-agent \
+      dumb-init \
+      libc-bin
+}
+
+function install_tools_apt() {
+  apt_packages | xargs apt-get install -y --no-install-recommends
+}
+
+function remove_caches() {
+  rm -rf /var/lib/apt/lists/*
+  rm -rf /tmp/*
+}
+
+function setup_sudoers() {
+  sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers
+  echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+}
+
+echo en_US.UTF-8 UTF-8 >> /etc/locale.gen
+
+scripts_dir=$(dirname "$0")
+# shellcheck source=/dev/null
+source "$scripts_dir/sources.sh"
+# shellcheck source=/dev/null
+source "$scripts_dir/tools.sh"
+# shellcheck source=/dev/null
+source "$scripts_dir/config.sh"
+
+apt-get update
+install_essentials
+configure_sources
+
+apt-get update
+install_tools_apt
+install_tools
+
+setup_sudoers
+groupadd -g "$(group_id)" runner
+useradd -mr -d /home/runner -u "$(user_id)" -g "$(group_id)" runner
+usermod -aG sudo runner
+usermod -aG docker runner
+
+remove_sources
+remove_caches
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function configure_git() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  local GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
+
+  gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY}
+  gpg --export ${GIT_CORE_PPA_KEY} | gpg --dearmor -o /usr/share/keyrings/git-core.gpg
+
+  if [[ "${VERSION_CODENAME}" == "focal" ]]; then
+    local GIT_CORE_FOCAL_PPA_KEY="E363C90F8F1B6217"
+    local KEYRING_FILE="/usr/share/keyrings/git-core-focal.gpg"
+    gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys ${GIT_CORE_FOCAL_PPA_KEY}
+    gpg --export ${GIT_CORE_FOCAL_PPA_KEY} | gpg --dearmor -o "${KEYRING_FILE}"
+    echo deb [signed-by=${KEYRING_FILE}] http://ppa.launchpad.net/git-core/ppa/ubuntu focal main>/etc/apt/sources.list.d/git-core.list
+
+  fi
+}
+
+function configure_docker() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  mkdir -p /etc/apt/keyrings
+  curl -fsSL "https://download.docker.com/linux/$ID/gpg" | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+
+  local version DPKG_ARCH
+  version=$(echo "$VERSION_CODENAME" | sed 's/trixie\|n\/a/bookworm/g')
+  DPKG_ARCH="$(dpkg --print-architecture)"
+  echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$ID ${version} stable" \
+    | tee /etc/apt/sources.list.d/docker.list > /dev/null
+}
+
+function configure_container_tools() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  if [[ "${VERSION_CODENAME}" == "focal" ]]; then
+    echo "available in 20.10 and higher"
+    echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" \
+      | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
+    curl -L "https://build.opensuse.org/projects/devel:kubic/signing_keys/download?kind=gpg" \
+      | /usr/bin/apt-key add -
+  fi
+}
+
+function configure_sources() {
+  configure_git
+  configure_docker
+  configure_container_tools
+}
+
+function remove_sources() {
+  rm -f /etc/apt/sources.list.d/git-core.list
+  rm -f /etc/apt/sources.list.d/docker.list
+  rm -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
+}
@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function install_git() {
+  ( apt-get install -y --no-install-recommends git \
+   || apt-get install -t stable -y --no-install-recommends git )
+}
+
+function install_liblttng-ust() {
+  if [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]]; then
+    apt-get install -y --no-install-recommends liblttng-ust0
+  fi
+
+  if [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]]; then
+    apt-get install -y --no-install-recommends liblttng-ust1
+  fi
+}
+
+function install_aws-cli() {
+  ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" \
+    && unzip -q awscliv2.zip -d /tmp/ \
+    && /tmp/aws/install \
+    && rm awscliv2.zip \
+  ) \
+    || pip3 install --no-cache-dir awscli
+}
+
+function install_git-lfs() {
+  local DPKG_ARCH
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz
+  tar -xzf /tmp/lfs.tar.gz -C /tmp
+  "/tmp/git-lfs-${GIT_LFS_VERSION}/install.sh"
+  rm -rf /tmp/lfs.tar.gz "/tmp/git-lfs-${GIT_LFS_VERSION}"
+}
+
+function install_docker-cli() {
+  apt-get install -y docker-ce-cli --no-install-recommends --allow-unauthenticated
+}
+
+function install_docker() {
+  apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated
+
+  echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose
+  chmod +x /usr/local/bin/docker-compose
+
+  sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker
+}
+
+function install_container-tools() {
+  ( apt-get install -y --no-install-recommends podman buildah skopeo || : )
+}
+
+function install_github-cli() {
+  local DPKG_ARCH GH_CLI_VERSION GH_CLI_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/cli/cli/releases/latest \
+      | jq -r '.tag_name' | sed 's/^v//g')
+
+  GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/cli/cli/releases/latest \
+      | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" \
+      | jq -r '.browser_download_url')
+
+  curl -sSLo /tmp/ghcli.deb "${GH_CLI_DOWNLOAD_URL}"
+  apt-get -y install /tmp/ghcli.deb
+  rm /tmp/ghcli.deb
+}
+
+function install_yq() {
+  local DPKG_ARCH YQ_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  YQ_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/mikefarah/yq/releases/latest \
+      | jq ".assets[] | select(.name == \"yq_linux_${DPKG_ARCH}.tar.gz\")" \
+      | jq -r '.browser_download_url')
+
+  curl -s "${YQ_DOWNLOAD_URL}" -L -o /tmp/yq.tar.gz
+  tar -xzf /tmp/yq.tar.gz -C /tmp
+  mv "/tmp/yq_linux_${DPKG_ARCH}" /usr/local/bin/yq
+}
+
+function install_powershell() {
+  local DPKG_ARCH PWSH_VERSION PWSH_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  PWSH_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
+      | jq -r '.tag_name' \
+      | sed 's/^v//g')
+
+  PWSH_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
+      | jq -r ".assets[] | select(.name == \"powershell-${PWSH_VERSION}-linux-${DPKG_ARCH//amd64/x64}.tar.gz\") | .browser_download_url")
+
+  curl -L -o /tmp/powershell.tar.gz "$PWSH_DOWNLOAD_URL"
+  mkdir -p /opt/powershell
+  tar zxf /tmp/powershell.tar.gz -C /opt/powershell
+  chmod +x /opt/powershell/pwsh
+  ln -s /opt/powershell/pwsh /usr/bin/pwsh
+}
+
+function install_tools() {
+  local function_name
+  # shellcheck source=/dev/null
+  source "$(dirname "${BASH_SOURCE[0]}")/config.sh"
+
+  script_packages | while read -r package; do
+    function_name="install_${package}"
+    if declare -f "${function_name}" > /dev/null; then
+      "${function_name}"
+    else
+      echo "No install script found for package: ${package}"
+      exit 1
+    fi
+  done
+}
@@ -14,6 +14,7 @@ export -n APP_PRIVATE_KEY
 trap_with_arg() {
    func="$1" ; shift
    for sig ; do
+        # shellcheck disable=SC2064
        trap "$func $sig" "$sig"
    done
 }
@@ -25,9 +26,12 @@ deregister_runner() {
    RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
  fi
  ./config.sh remove --token "${RUNNER_TOKEN}"
+  [[ -f "/actions-runner/.runner" ]] && rm -f /actions-runner/.runner
  exit
 }

+_DEBUG_ONLY=${DEBUG_ONLY:-false}
+_DEBUG_OUTPUT=${DEBUG_OUTPUT:-false}
 _DISABLE_AUTOMATIC_DEREGISTRATION=${DISABLE_AUTOMATIC_DEREGISTRATION:-false}

 _RANDOM_RUNNER_SUFFIX=${RANDOM_RUNNER_SUFFIX:="true"}
@@ -38,7 +42,8 @@ if [[ ${RANDOM_RUNNER_SUFFIX} != "true" ]]; then
  if [[ -f "/etc/hostname" ]]; then
    # in some cases it can also be empty
    if [[ $(stat --printf="%s" /etc/hostname) -ne 0 ]]; then
-      _RUNNER_NAME=${RUNNER_NAME:-${RUNNER_NAME_PREFIX:-github-runner}-$(cat /etc/hostname)}
+      _RUNNER_NAME_PREFIX=${RUNNER_NAME_PREFIX-"github-runner"}
+      _RUNNER_NAME=${RUNNER_NAME:-${_RUNNER_NAME_PREFIX:+${_RUNNER_NAME_PREFIX}-}$(cat /etc/hostname)}
      echo "RANDOM_RUNNER_SUFFIX is ${RANDOM_RUNNER_SUFFIX}. /etc/hostname exists and has content. Setting runner name to ${_RUNNER_NAME}"
    else
      echo "RANDOM_RUNNER_SUFFIX is ${RANDOM_RUNNER_SUFFIX} ./etc/hostname exists but is empty. Not using /etc/hostname."
@@ -54,6 +59,8 @@ _RUNNER_GROUP=${RUNNER_GROUP:-Default}
 _GITHUB_HOST=${GITHUB_HOST:="github.com"}
 _RUN_AS_ROOT=${RUN_AS_ROOT:="true"}
 _START_DOCKER_SERVICE=${START_DOCKER_SERVICE:="false"}
+_UNSET_CONFIG_VARS=${UNSET_CONFIG_VARS:="false"}
+_CONFIGURED_ACTIONS_RUNNER_FILES_DIR=${CONFIGURED_ACTIONS_RUNNER_FILES_DIR:-""}

 # ensure backwards compatibility
 if [[ -z ${RUNNER_SCOPE} ]]; then
@@ -144,41 +151,80 @@ configure_runner() {
      --replace \
      "${ARGS[@]}"

-  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir "${_RUNNER_WORKDIR}"
+  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir -p "${_RUNNER_WORKDIR}"

 }

+unset_config_vars() {
+  echo "Unsetting configuration environment variables"
+  unset RUN_AS_ROOT
+  unset RUNNER_NAME
+  unset RUNNER_NAME_PREFIX
+  unset RANDOM_RUNNER_SUFFIX
+  unset ACCESS_TOKEN
+  unset APP_ID
+  unset APP_PRIVATE_KEY
+  unset APP_LOGIN
+  unset RUNNER_SCOPE
+  unset ORG_NAME
+  unset ENTERPRISE_NAME
+  unset LABELS
+  unset REPO_URL
+  unset RUNNER_TOKEN
+  unset RUNNER_WORKDIR
+  unset RUNNER_GROUP
+  unset GITHUB_HOST
+  unset DISABLE_AUTOMATIC_DEREGISTRATION
+  unset CONFIGURED_ACTIONS_RUNNER_FILES_DIR
+  unset EPHEMERAL
+  unset DISABLE_AUTO_UPDATE
+  unset START_DOCKER_SERVICE
+  unset NO_DEFAULT_LABELS
+  unset UNSET_CONFIG_VARS
+}

 # Opt into runner reusage because a value was given
-if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+if [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
  echo "Runner reusage is enabled"

  # directory exists, copy the data
-  if [[ -d "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  if [[ -d "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
    echo "Copying previous data"
-    cp -p -r "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}/." "/actions-runner"
+    cp -p -r "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}/." "/actions-runner"
  fi

  if [ -f "/actions-runner/.runner" ]; then
    echo "The runner has already been configured"
  else
-    configure_runner
+
+    if [[ ${_DEBUG_ONLY} == "false" ]]; then
+      configure_runner
+    fi
  fi
 else
  echo "Runner reusage is disabled"
-  configure_runner
+  if [[ ${_DEBUG_ONLY} == "false" ]]; then
+    [[ -f "/actions-runner/.runner" ]] && rm -f /actions-runner/.runner
+    configure_runner
+  fi
 fi

-if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
-  echo "Reusage is enabled. Storing data to ${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+if [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  echo "Reusage is enabled. Storing data to ${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+  if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
+    echo "DISABLE_AUTOMATIC_DEREGISTRATION should be set to true to avoid issues with re-using a deregistered runner."
+    exit 1
+  fi
  # Quoting (even with double-quotes) the regexp brokes the copying
-  cp -p -r "/actions-runner/_diag" "/actions-runner/svc.sh" /actions-runner/.[^.]* "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+  cp -p -r "/actions-runner/_diag" "/actions-runner/svc.sh" /actions-runner/.[^.]* "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
 fi



 if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
-  trap_with_arg deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
+  if [[ ${_DEBUG_ONLY} == "false" ]]; then
+    trap_with_arg deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
+  fi
 fi

 # Start docker service if needed (e.g. for docker-in-docker)
@@ -186,27 +232,68 @@ if [[ ${_START_DOCKER_SERVICE} == "true" ]]; then
  echo "Starting docker service"
  _PREFIX=""
  [[ ${_RUN_AS_ROOT} != "true" ]] && _PREFIX="sudo"
-  ${_PREFIX} service docker start
+
+  if [[ ${_DEBUG_ONLY} == "true" ]]; then
+    echo ${_PREFIX} service docker start
+  else
+    ${_PREFIX} service docker start
+  fi
+fi
+
+# Unset configuration environment variables if the flag is set
+if [[ ${_UNSET_CONFIG_VARS} == "true" ]]; then
+  unset_config_vars
 fi

 # Container's command (CMD) execution as runner user


+if [[ ${_DEBUG_ONLY} == "true" ]] || [[ ${_DEBUG_OUTPUT} == "true" ]] ; then
+  echo ""
+  echo "Disable automatic registration: ${_DISABLE_AUTOMATIC_DEREGISTRATION}"
+  echo "Random runner suffix: ${_RANDOM_RUNNER_SUFFIX}"
+  echo "Runner name: ${_RUNNER_NAME}"
+  echo "Runner workdir: ${_RUNNER_WORKDIR}"
+  echo "Labels: ${_LABELS}"
+  echo "Runner Group: ${_RUNNER_GROUP}"
+  echo "Github Host: ${_GITHUB_HOST}"
+  echo "Run as root:${_RUN_AS_ROOT}"
+  echo "Start docker: ${_START_DOCKER_SERVICE}"
+fi
+
 if [[ ${_RUN_AS_ROOT} == "true" ]]; then
  if [[ $(id -u) -eq 0 ]]; then
-    "$@"
+    if [[ ${_DEBUG_ONLY} == "true" ]] || [[ ${_DEBUG_OUTPUT} == "true" ]] ; then
+      # shellcheck disable=SC2145
+      echo "Running $@"
+    fi
+    if [[ ${_DEBUG_ONLY} == "false" ]]; then
+      "$@"
+    fi
  else
    echo "ERROR: RUN_AS_ROOT env var is set to true but the user has been overridden and is not running as root, but UID '$(id -u)'"
    exit 1
  fi
 else
  if [[ $(id -u) -eq 0 ]]; then
-    [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && chown -R runner "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+    [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && chown -R runner "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
    chown -R runner "${_RUNNER_WORKDIR}" /actions-runner
    # The toolcache is not recursively chowned to avoid recursing over prepulated tooling in derived docker images
    chown runner /opt/hostedtoolcache/
-    /usr/sbin/gosu runner "$@"
+    if [[ ${_DEBUG_ONLY} == "true" ]] || [[ ${_DEBUG_OUTPUT} == "true" ]] ; then
+      # shellcheck disable=SC2145
+      echo "Running /usr/sbin/gosu runner $@"
+    fi
+    if [[ ${_DEBUG_ONLY} == "false" ]]; then
+      /usr/sbin/gosu runner "$@"
+    fi
  else
-    "$@"
+    if [[ ${_DEBUG_ONLY} == "true" ]] || [[ ${_DEBUG_OUTPUT} == "true" ]] ; then
+      # shellcheck disable=SC2145
+      echo "Running $@"
+    fi
+    if [[ ${_DEBUG_ONLY} == "false" ]]; then
+      "$@"
+    fi
  fi
 fi
@@ -0,0 +1,89 @@
+package:
+    curl:
+        installed: true
+    docker:
+        installed: false
+    docker-compose:
+        installed: false
+    git:
+        installed: true
+    git-lfs:
+        installed: false
+    jq:
+        installed: true
+    lsb_release:
+        installed: false
+    make:
+        installed: true
+    pwsh:
+        installed: false
+    python3:
+        installed: true
+    rsync:
+        installed: true
+    ssh:
+        installed: false
+    sudo:
+        installed: true
+    tar:
+        installed: true
+    unzip:
+        installed: true
+    wget:
+        installed: true
+    yq:
+        installed: false
+    # Ubuntu Focal is the only one currently that doesnt have an official upstream skopeo/buildah/podman
+    {{ if not (eq .Vars.oscodename "focal") }}
+    skopeo:
+        installed: true
+    buildah:
+        installed: true
+    podman:
+        installed: true
+    {{ end }}
+file:
+  /usr/bin/gh:
+    exists: true
+  /usr/bin/nodejs:
+    exists: true
+  /usr/sbin/gosu:
+    exists: true
+  /usr/bin/dumb-init:
+    exists: true
+  /etc/init.d/docker:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - /^\s*# ulimit -Hn/
+  /etc/sudoers:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - '/%sudo ALL=\(ALL\) NOPASSWD: ALL/'
+      - '/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/'
+  /etc/locale.gen:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - '/^en_US.UTF-8 UTF-8/'
+
+user:
+    runner:
+        exists: true
+        uid: 1001
+        gid: 121
+        groups:
+            - runner
+            - sudo
+            - docker
+group:
+    runner:
+        exists: true
+        gid: 121
@@ -0,0 +1,18 @@
+command:
+  /entrypoint.sh something:
+    exit-status: 0
+    stdout:
+      - "Runner reusage is disabled"
+      - ""
+      - "Disable automatic registration: true"
+      - "Random runner suffix: true"
+      - "Runner workdir: /tmp/a"
+      - "Runner name: huzzah"
+      - "Labels: blue,green"
+      - "Runner Group: wat"
+      - "Github Host: github.example.com"
+      - "Run as root:true"
+      - "Start docker: false"
+      - "Running something"
+    stderr: ""
+    timeout: 2000
@@ -0,0 +1,20 @@
+command:
+    /entrypoint.sh something:
+        exit-status: 0
+        stdout:
+            - REPO_URL required for repo runners
+            - Runner reusage is disabled
+            - ""
+            - 'Disable automatic registration: false'
+            - 'Random runner suffix: true'
+            - 'Runner name: test'
+            - 'Runner workdir: /_work/test'
+            - 'Labels: default'
+            - 'Runner Group: Default'
+            - 'Github Host: github.com'
+            - Run as root:true
+            - 'Start docker: false'
+            - Running something
+            - ""
+        stderr: ""
+        timeout: 2000
@@ -0,0 +1,9 @@
+command:
+  /entrypoint.sh something:
+    exit-status: 1
+    stdout:
+      - "Runner reusage is enabled"
+      - "Reusage is enabled. Storing data to /runner/data"
+      - "DISABLE_AUTOMATIC_DEREGISTRATION should be set to true to avoid issues with re-using a deregistered runner."
+    stderr: ""
+    timeout: 2000
@@ -10,4 +10,4 @@ curl -L "https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSIO
 tar -zxf actions.tar.gz
 rm -f actions.tar.gz
 ./bin/installdependencies.sh
-mkdir /_work
+mkdir -p /_work
@@ -1,7 +1,8 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
-    "config:base"
+    "config:base",
+    "helpers:pinGitHubActionDigests"
  ],
  "packageRules": [
    {
@@ -11,6 +12,11 @@
    {
      "matchDepTypes": ["devDependencies"],
      "automerge": true
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchPackagePatterns": [".*"],
+      "versioning": "digest"
    }
  ],
  "platformAutomerge": true