[Automated 🤖 ] Bump to version 2.326.0

Merge pull request #464 from myoung34/renovate/github-codeql-action-3.x
Update github/codeql-action action to v3.29.2
2025-07-07 15:19:13 -05:00 · 2025-07-02 20:25:12 -04:00 · 2025-06-30 16:25:17 +00:00 · 2025-06-27 06:55:11 -05:00 · 2025-06-27 11:46:24 +00:00 · 2025-06-18 10:56:12 -05:00
29 changed files with 1305 additions and 925 deletions
@@ -0,0 +1,3 @@
+query-filters:
+- include:
+    id: actions/unpinned-tag
@@ -4,8 +4,7 @@ on:
    paths:
      - Dockerfile.base
      - .github/workflows/base.yml
-      - tests/**
-      - go.*
+      - goss*
    branches:
      - master
      - develop
@@ -18,26 +17,25 @@ jobs:
    strategy:
      matrix:
        release: [jammy, focal, noble]
-        platform: [linux/amd64, linux/arm64]
+        platform: [amd64, arm64]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.22'
-      - name: Install dependencies
+      - name: Install Goss and dgoss
        run: |
-          go get github.com/testcontainers/testcontainers-go@v0.33.0
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
      - name: Get current Git SHA
        id: vars
        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
@@ -45,50 +43,63 @@ jobs:
        id: testvars
        run: echo "GH_RUNNER_IMAGE=ubuntu-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build
-        uses: docker/build-push-action@v6
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base.ubuntu-${{ matrix.release }}
-          pull: true
-          push: false
-          load: true
-          tags: ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }},${{ env.GH_RUNNER_IMAGE }}
-          platforms: ${{ matrix.platform }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-      - name: Run go tests
-        run: go test -run ^TestIntegrationGHRunnerBase$ tests/base_test.go
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi

  debian_base_tests:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        release: [bookworm, sid]
-        platform: [linux/amd64, linux/arm64]
+        platform: [amd64, arm64]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.22'
-      - name: Install dependencies
+      - name: Install Goss and dgoss
        run: |
-          go get github.com/testcontainers/testcontainers-go@v0.33.0
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
      - name: Get current Git SHA
        id: vars
        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
@@ -96,53 +107,74 @@ jobs:
        id: testvars
        run: echo "GH_RUNNER_IMAGE=debian-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build
-        uses: docker/build-push-action@v6
+      - name: Retry build
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base.debian-${{ matrix.release }}
-          pull: true
-          push: false
-          load: true
-          tags: ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }},${{ env.GH_RUNNER_IMAGE }}
-          platforms: ${{ matrix.platform }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-      - name: Run go tests
-        run: go test -run ^TestIntegrationGHRunnerBase$ tests/base_test.go
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+
+
  ubuntu_base_latest_deploy:
    runs-on: ubuntu-latest
    needs: ubuntu_base_tests
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:latest
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:latest \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  ubuntu_base_deploy:
    runs-on: ubuntu-latest
    needs: ubuntu_base_tests
@@ -152,32 +184,37 @@ jobs:
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  debian_base_deploy:
    runs-on: ubuntu-latest
    needs: debian_base_tests
@@ -187,28 +224,34 @@ jobs:
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.base.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.base.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -0,0 +1,30 @@
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  analyze:
+    name: Analyze GitHub Actions YAML
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        with:
+          languages: "actions"
+          queries: security-extended
+          config-file: .github/codeql/codeql-config.yml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        with:
+          category: "/language:actions"
@@ -4,8 +4,6 @@ on:
    paths-ignore:
      - Dockerfile.base
      - README.md
-      - tests/**
-      - go.*
    branches:
      - master
      - develop
@@ -17,118 +15,357 @@ permissions:
  packages: write

 jobs:
-  ubuntu_latest_deploy:
+  ubuntu_tests:
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, noble]
+        platform: [amd64, arm64]
+      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=ubuntu-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Login to DockerHub
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+
+  debian_tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [bookworm, sid]
+        platform: [amd64, arm64]
+      fail-fast: false
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
+      - name: Install Goss and dgoss
+        run: |
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
+      - name: Get current Git SHA
+        id: vars
+        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+      - name: set testable image environment variable
+        id: testvars
+        run: echo "GH_RUNNER_IMAGE=debian-${{ matrix.release }}-${{ env.GIT_SHA }}-${{ matrix.platform }}" >> $GITHUB_ENV
+      - name: Login to DockerHub
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Retry build and load
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
+      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+
+  ubuntu_latest_deploy:
+    runs-on: ubuntu-latest
+    needs: ubuntu_tests
+    steps:
+      - name: Copy Repo Files
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Update Dockerfile FROM org
        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:latest,ghcr.io/${{ github.repository }}:latest
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:latest \
+              --tag ghcr.io/${{ github.repository }}:latest \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  ubuntu_deploy:
    runs-on: ubuntu-latest
+    needs: ubuntu_tests
    strategy:
      matrix:
        release: [jammy, focal, noble]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{env.ORG}}/github-runner:ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:ubuntu-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  debian_deploy:
    runs-on: ubuntu-latest
+    needs: debian_tests
    strategy:
      matrix:
        release: [bookworm, sid]
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:debian-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Create Release
      id: create_release
-      uses: actions/create-release@v1
+      uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
@@ -31,39 +31,46 @@ jobs:
    needs: create-release
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Update Dockerfile FROM org
        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }},ghcr.io/${{ github.repository }}:${{ env.TAG }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .

  ubuntu_tag:
    runs-on: ubuntu-latest
@@ -74,40 +81,46 @@ jobs:
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.ubuntu-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-ubuntu-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.ubuntu-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }}-ubuntu-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
  debian_tag:
    runs-on: ubuntu-latest
    strategy:
@@ -117,36 +130,43 @@ jobs:
    needs: create-release
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: get version
        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Copy Dockerfile
        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Retry build and push
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.debian-${{ matrix.release }}
-          pull: true
-          push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.debian-${{ matrix.release }} \
+              --platform linux/amd64,linux/arm64 \
+              --tag ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }} \
+              --tag ghcr.io/${{ github.repository }}:${{ env.TAG }}-debian-${{ matrix.release }} \
+              --push \
+              --pull \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
@@ -11,7 +11,7 @@ jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
        with:
          stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
          stale-pr-message: 'This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.'
@@ -5,14 +5,14 @@ name: "Trigger: Push action"

 jobs:
  tests:
-    name: Tests
+    name: Lint
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
-      - uses: actions/setup-python@v5
-      - uses: pre-commit/action@v3.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@master
+        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master

  ubuntu_tests:
    runs-on: ubuntu-latest
@@ -23,20 +23,19 @@ jobs:
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
        with:
-          go-version: '1.22'
-      - name: Install dependencies
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Install Goss and dgoss
        run: |
-          go get github.com/testcontainers/testcontainers-go@v0.33.0
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
      - name: Get current Git SHA
        id: vars
        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
@@ -54,22 +53,81 @@ jobs:

          # Sanity check
          grep FROM Dockerfile.final.ubuntu-${{ matrix.release }}
-      - name: Build final image
-        uses: docker/build-push-action@v6
+      - name: Retry build final image
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.final.ubuntu-${{ matrix.release }}
-          pull: true
-          push: false
-          load: true
-          tags: ${{ env.GH_RUNNER_IMAGE }}
-          platforms: linux/${{ matrix.platform }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.final.ubuntu-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
-      - name: Run go tests
-        run: go test ./tests/...
-
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: ubuntu" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
  debian_tests:
    runs-on: ubuntu-latest
    strategy:
@@ -79,20 +137,19 @@ jobs:
      fail-fast: false
    steps:
      - name: Copy Repo Files
-        uses: actions/checkout@master
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get GitHub organization or user
        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
        with:
-          go-version: '1.22'
-      - name: Install dependencies
+          image: tonistiigi/binfmt:qemu-v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      - name: Install Goss and dgoss
        run: |
-          go get github.com/testcontainers/testcontainers-go@v0.33.0
+          curl -fsSL https://goss.rocks/install | sh
+          export PATH=$PATH:/usr/local/bin
      - name: Get current Git SHA
        id: vars
        run: echo "GIT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
@@ -110,18 +167,69 @@ jobs:

          # Sanity check
          grep FROM Dockerfile.final.debian-${{ matrix.release }}
-      - name: Build final image
-        uses: docker/build-push-action@v6
+      - name: Retry build final image
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
        with:
-          context: .
-          file: Dockerfile.final.debian-${{ matrix.release }}
-          pull: true
-          push: false
-          load: true
-          tags: ${{ env.GH_RUNNER_IMAGE }}
-          platforms: linux/${{ matrix.platform }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            docker buildx build \
+              --file Dockerfile.final.debian-${{ matrix.release }} \
+              --platform linux/${{ matrix.platform }} \
+              --tag ${{ env.GH_RUNNER_IMAGE }} \
+              --load \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              .
      # Tests will run against the final `${GH_RUNNER_IMAGE}` laid on top of `base-${GH_RUNNER_IMAGE}`
-      - name: Run go tests
-        run: go test ./tests/...
+      - name: Run goss tests
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 60
+          max_attempts: 3
+          command: |
+            echo "os: debian" >goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "oscodename: ${{ matrix.release }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            echo "arch: ${{ matrix.platform }}" >>goss_vars_${GH_RUNNER_IMAGE}.yaml
+            # test the edge case from deregistration on reusable runners
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_reusage_fail.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e ACCESS_TOKEN=notreal \
+            -e LABELS=linux,x64 \
+            -e REPO_URL=https://github.com/octokode/test1 \
+            -e RUNNER_NAME=sustainjane-runner-1 \
+            -e RUNNER_SCOPE=repo \
+            -e RUNNER_WORKDIR=/tmp/runner/work \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=false \
+            -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR=/runner/data \
+            ${GH_RUNNER_IMAGE} 10
+            if [ $? -ne 0 ]; then
+              exit 1
+            fi
+            # test the base
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_base.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with all defaults
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full_defaults.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep -e RUNNER_NAME=test -e DEBUG_ONLY=true ${GH_RUNNER_IMAGE} 10
+            # test the final image but with non-default values
+            GOSS_VARS=goss_vars_${GH_RUNNER_IMAGE}.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+            -e DEBUG_ONLY=true \
+            -e RUNNER_NAME=huzzah \
+            -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+            -e RUN_AS_ROOT=true \
+            -e RUNNER_NAME_PREFIX=asdf \
+            -e ACCESS_TOKEN=1234 \
+            -e APP_ID=5678 \
+            -e APP_PRIVATE_KEY=2345 \
+            -e APP_LOGIN=SOMETHING \
+            -e RUNNER_SCOPE=org \
+            -e ORG_NAME=myoung34 \
+            -e ENTERPRISE_NAME=emyoung34 \
+            -e LABELS=blue,green \
+            -e RUNNER_TOKEN=3456 \
+            -e RUNNER_WORKDIR=/tmp/a \
+            -e RUNNER_GROUP=wat \
+            -e GITHUB_HOST=github.example.com \
+            -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+            -e EPHEMERAL=true \
+            -e DISABLE_AUTO_UPDATE=true \
+            ${GH_RUNNER_IMAGE} 10
@@ -1,2 +1,2 @@
 *.bak
-.idea/
+.idea
@@ -3,6 +3,7 @@ repos:
  rev: v4.3.0
  hooks:
  - id: check-yaml
+    exclude: goss_[a-z]*.yaml
  - id: end-of-file-fixer
  - id: trailing-whitespace
  - id: check-case-conflict
@@ -5,7 +5,7 @@ LABEL maintainer="myoung34@my.apsu.edu"
 ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
 RUN mkdir -p /opt/hostedtoolcache

-ARG GH_RUNNER_VERSION="2.319.1"
+ARG GH_RUNNER_VERSION="2.326.0"

 ARG TARGETPLATFORM

@@ -2,94 +2,14 @@ FROM ubuntu:focal
 LABEL maintainer="myoung34@my.apsu.edu"

 ARG DUMB_INIT_VERSION="1.2.2"
-ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
-
 # TODO: remove git PPA and skopeo customizations for focal when focal hits EOL
 ENV GIT_LFS_VERSION="3.2.0"
+
 ENV LANG=en_US.UTF-8
 ENV LANGUAGE=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
-# hadolint ignore=SC2086,DL3015,DL3008,DL3013,SC2015
-RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends gnupg \
-  && ( \
-    apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
-      || apt-key adv --keyserver pgp.mit.edu --recv-keys ${GIT_CORE_PPA_KEY} \
-      || apt-key adv --keyserver keyserver.pgp.com --recv-keys ${GIT_CORE_PPA_KEY} \
-  ) \
-  && apt-get update \
-  && apt-get install -y --no-install-recommends \
-    gnupg \
-    lsb-release \
-    curl \
-    tar \
-    unzip \
-    zip \
-    apt-transport-https \
-    ca-certificates \
-    sudo \
-    gpg-agent \
-    software-properties-common \
-    build-essential \
-    zlib1g-dev \
-    zstd \
-    gettext \
-    libcurl4-openssl-dev \
-    inetutils-ping \
-    jq \
-    wget \
-    dirmngr \
-    openssh-client \
-    locales \
-    python3-pip \
-    python3-setuptools \
-    python3-venv \
-    python3 \
-    dumb-init \
-    nodejs \
-    rsync \
-    libpq-dev \
-    gosu \
-    pkg-config \
-  && DPKG_ARCH="$(dpkg --print-architecture)" \
-  && LSB_RELEASE_CODENAME="$(lsb_release --codename | cut -f2)" \
-  && sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers \
-  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && (echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu focal main>/etc/apt/sources.list.d/git-core.list ) || : ) \
-  && apt-get update \
-  && ( apt-get install -y --no-install-recommends git || apt-get install -t stable -y --no-install-recommends git ) \
-  && ( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] && apt-get install -y --no-install-recommends liblttng-ust0 || : ) \
-  && ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
-  && ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install && rm awscliv2.zip) || pip3 install --no-cache-dir awscli ) \
-  && ( curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz && tar -xzf /tmp/lfs.tar.gz -C /tmp && /tmp/git-lfs-${GIT_LFS_VERSION}/install.sh && rm -rf /tmp/lfs.tar.gz  /tmp/git-lfs-${GIT_LFS_VERSION}) \
-  && distro=$(lsb_release -is | awk '{print tolower($0)}') \
-  && mkdir -p /etc/apt/keyrings \
-  && ( curl -fsSL https://download.docker.com/linux/${distro}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg ) \
-  && version=$(lsb_release -cs | sed 's/trixie\|n\/a/bookworm/g') \
-  && ( echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${distro} ${version} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null ) \
-  && apt-get update \
-  && apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated \
-  && echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose \
-  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "available in 20.10 and higher" && echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://build.opensuse.org/projects/devel:kubic/signing_keys/download?kind=gpg" | apt-key add - ) || : ) \
-  && apt-get update \
-  && ( apt-get install -y --no-install-recommends podman buildah skopeo || : ) \
-  && GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" | jq -r '.browser_download_url') \
-  && curl -sSLo /tmp/ghcli.deb ${GH_CLI_DOWNLOAD_URL} && apt-get -y install /tmp/ghcli.deb && rm /tmp/ghcli.deb \
-  && YQ_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/mikefarah/yq/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && YQ_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/mikefarah/yq/releases/latest | jq ".assets[] | select(.name == \"yq_linux_${DPKG_ARCH}.tar.gz\")" | jq -r '.browser_download_url') \
-  && ( curl -s ${YQ_DOWNLOAD_URL} -L -o /tmp/yq.tar.gz && tar -xzf /tmp/yq.tar.gz -C /tmp && mv /tmp/yq_linux_${DPKG_ARCH} /usr/local/bin/yq) \
-  && PWSH_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/PowerShell/PowerShell/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
-  && PWSH_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" https://api.github.com/repos/PowerShell/PowerShell/releases/latest | jq -r ".assets[] | select(.name == \"powershell-${PWSH_VERSION}-linux-${DPKG_ARCH//amd64/x64}.tar.gz\") | .browser_download_url") \
-  && ( curl -L -o /tmp/powershell.tar.gz $PWSH_DOWNLOAD_URL && mkdir -p /opt/powershell && tar zxf /tmp/powershell.tar.gz -C /opt/powershell && chmod +x /opt/powershell/pwsh && ln -s /opt/powershell/pwsh /usr/bin/pwsh ) \
-  && rm -rf /var/lib/apt/lists/* \
-  && rm -rf /tmp/* \
-  && sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker \
-  && groupadd -g 121 runner \
-  && useradd -mr -d /home/runner -u 1001 -g 121 runner \
-  && usermod -aG sudo runner \
-  && usermod -aG docker runner \
-  && echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers \
-  && ( [[ -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list ]] && rm /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list || : )
+
+COPY --chmod=700 build/ /tmp/build/
+RUN /tmp/build/install_base.sh
@@ -10,6 +10,11 @@ This will run the [new self-hosted github actions runners](https://help.github.c
 Please see [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage)
 Please read [the contributing guidelines](https://github.com/myoung34/docker-github-actions-runner/blob/master/CONTRIBUTING.md)

+
+## Included software and configuration ##
+
+While this project is not perfectly 1:1 with the software upstream, the included packages etc are available [here](https://github.com/myoung34/docker-github-actions-runner/blob/master/build/config.json). Documentation can be found in [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage#modifications)
+
 ## Notes ##

 ### Security ###
@@ -38,7 +43,7 @@ Currently runners [do not support containerd](https://github.com/actions/runner/
 | ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` `/\d\.\d{3}\.\d+-ubuntu-focal/`| [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) [ubuntu-focal](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-focal) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. Tags with `-ubuntu-focal` are included and created on [upstream tags](https://github.com/actions/runner/tags).|
 | ubuntu noble | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-noble/` | [ubuntu-noble](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-noble) | This is the latest build from noble (Rebuilt nightly and on master merges). Tags with `-ubuntu-noble` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 | ubuntu jammy | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-jammy/` | [ubuntu-jammy](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-jammy) | This is the latest build from jammy (Rebuilt nightly and on master merges). Tags with `-ubuntu-jammy` are included and created on [upstream tags](https://github.com/actions/runner/tags). | There is [currently an issue with jammy from inside a 20.04LTS host](https://github.com/myoung34/docker-github-actions-runner/issues/219) which is why this is not `latest` |
-| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 | debian bookworm | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-bookworm/` | [debian-bookworm](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bookworm) | This is the latest build from bookworm (Rebuilt nightly and on master merges). Tags with `-debian-bookworm` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 | debian sid | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |

@@ -73,18 +78,49 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `NO_DEFAULT_LABELS` | Optional environment variable to disable adding the default self-hosted, platform, and architecture labels to the runner. Any value is considered truthy and will disable them. |
 | `DEBUG_ONLY` | Optional boolean to print debug output but not run any actual registration or runner commands. Used in CI and testing. Default: false |
 | `DEBUG_OUTPUT` | Optional boolean to print additional debug output. Default: false |
-
+| `UNSET_CONFIG_VARS` | Optional flag to unset all configuration environment variables after runner setup but before starting the runner. This prevents these variables from leaking into the workflow environment. Set to 'true' to enable. Defaults to 'false' for backward compatibility. |

 ## Tests ##

-Tests are written in [testcontainers-go](https://testcontainers.org/) for general assertions.
+Tests are written in [goss](https://github.com/goss-org/goss/) for general assertions.
 It's expected that all pull-requests have relevant assertions in order to be merged.

+Prereqs: Ensure that docker, goss and dgoss are set up
+Note: while testing locally works, github actions will test all variations of operating systems and supported architectures.
+
 The test file expects the image to test as an environment variable `GH_RUNNER_IMAGE` to assist in CI

 To test:
 ```
-$ go get github.com/testcontainers/testcontainers-go@v0.33.0`
-$ docker build -t my-image-test -f Dockerfile.base .
-$ GH_RUNNER_IMAGE="my-image-test" go test -v ./tests/...
+$ # need to set minimum vars for the goss test interpolation
+$ echo "os: ubuntu" >goss_vars.yaml
+$ echo "oscodename: focal" >>goss_vars.yaml
+$ echo "arch: x86_64" >>goss_vars.yaml
+$ docker build -t my-base-test -f Dockerfile.base .
+$ # Use the base image in your final
+$ sed -i.bak 's/^FROM.*/FROM my-base-test/g' Dockerfile
+$ docker build -t my-full-test -f Dockerfile .
+$ # Run the full test from Dockerfile.base on the current git HEAD
+$ GOSS_VARS=goss_vars.yaml GOSS_FILE=goss_full.yaml GOSS_SLEEP=1 dgoss run --entrypoint /usr/bin/sleep \
+  -e DEBUG_ONLY=true \
+  -e RUNNER_NAME=huzzah \
+  -e REPO_URL=https://github.com/myoung34/docker-github-actions-runner \
+  -e RUN_AS_ROOT=true \
+  -e RUNNER_NAME_PREFIX=asdf \
+  -e ACCESS_TOKEN=1234 \
+  -e APP_ID=5678 \
+  -e APP_PRIVATE_KEY=2345 \
+  -e APP_LOGIN=SOMETHING \
+  -e RUNNER_SCOPE=org \
+  -e ORG_NAME=myoung34 \
+  -e ENTERPRISE_NAME=emyoung34 \
+  -e LABELS=blue,green \
+  -e RUNNER_TOKEN=3456 \
+  -e RUNNER_WORKDIR=/tmp/a \
+  -e RUNNER_GROUP=wat \
+  -e GITHUB_HOST=github.example.com \
+  -e DISABLE_AUTOMATIC_DEREGISTRATION=true \
+  -e EPHEMERAL=true \
+  -e DISABLE_AUTO_UPDATE=true \
+  my-full-test 10
 ```
@@ -0,0 +1,113 @@
+{
+  "user": {
+    "user-id": 1001,
+    "group-id": 121
+  },
+  "install": [
+    {
+      "category": "aws",
+      "source": "script",
+      "packages": [
+        "aws-cli"
+      ]
+    },
+    {
+      "category": "development",
+      "source": "apt",
+      "packages": [
+        "build-essential",
+        "zlib1g-dev",
+        "zstd",
+        "gettext",
+        "libcurl4-openssl-dev",
+        "libpq-dev",
+        "pkg-config",
+        "software-properties-common"
+      ]
+    },
+    {
+      "category": "container-tools",
+      "source": "script",
+      "packages": [
+        "container-tools"
+      ]
+    },
+    {
+      "category": "debugging",
+      "source": "script",
+      "packages": [
+        "liblttng-ust"
+      ]
+    },
+    {
+      "category": "docker-cli",
+      "source": "script",
+      "packages": [
+        "docker-cli"
+      ]
+    },
+    {
+      "category": "docker",
+      "source": "script",
+      "packages": [
+        "docker"
+      ]
+    },
+    {
+      "category": "git",
+      "source": "script",
+      "packages": [
+        "git",
+        "git-lfs"
+      ]
+    },
+    {
+      "category": "github",
+      "source": "script",
+      "packages": [
+        "github-cli"
+      ]
+    },
+    {
+      "category": "network-tools",
+      "source": "apt",
+      "packages": [
+        "inetutils-ping",
+        "wget",
+        "openssh-client",
+        "rsync"
+      ]
+    },
+    {
+      "category": "node",
+      "source": "apt",
+      "packages": [
+        "nodejs"
+      ]
+    },
+    {
+      "category": "powershell",
+      "source": "script",
+      "packages": [
+        "powershell"
+      ]
+    },
+    {
+      "category": "python",
+      "source": "apt",
+      "packages": [
+        "python3",
+        "python3-pip",
+        "python3-setuptools",
+        "python3-venv"
+      ]
+    },
+    {
+      "category": "yq",
+      "source": "script",
+      "packages": [
+        "yq"
+      ]
+    }
+  ]
+}
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function config_file() {
+  echo "$(dirname "${BASH_SOURCE[0]}")/config.json"
+}
+
+function user_id() {
+  jq -r '.user."user-id"' "$(config_file)"
+}
+
+function group_id() {
+  jq -r '.user."group-id"' "$(config_file)"
+}
+
+function apt_packages() {
+  jq -r '.install[] | select(.source == "apt") | .packages[]' "$(config_file)" | paste -sd ' ' -
+}
+
+function script_packages() {
+  jq -r '.install[] | select(.source == "script") | .packages[]' "$(config_file)"
+}
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Required by the build or runner operation
+function install_essentials() {
+  apt-get install -y --no-install-recommends \
+      ca-certificates \
+      curl \
+      jq \
+      gnupg \
+      tar \
+      unzip \
+      zip \
+      apt-transport-https \
+      sudo \
+      dirmngr \
+      locales \
+      gosu \
+      gpg-agent \
+      dumb-init \
+      libc-bin
+}
+
+function install_tools_apt() {
+  apt_packages | xargs apt-get install -y --no-install-recommends
+}
+
+function remove_caches() {
+  rm -rf /var/lib/apt/lists/*
+  rm -rf /tmp/*
+}
+
+function setup_sudoers() {
+  sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers
+  echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+}
+
+echo en_US.UTF-8 UTF-8 >> /etc/locale.gen
+
+scripts_dir=$(dirname "$0")
+# shellcheck source=/dev/null
+source "$scripts_dir/sources.sh"
+# shellcheck source=/dev/null
+source "$scripts_dir/tools.sh"
+# shellcheck source=/dev/null
+source "$scripts_dir/config.sh"
+
+apt-get update
+install_essentials
+configure_sources
+
+apt-get update
+install_tools_apt
+install_tools
+
+setup_sudoers
+groupadd -g "$(group_id)" runner
+useradd -mr -d /home/runner -u "$(user_id)" -g "$(group_id)" runner
+usermod -aG sudo runner
+usermod -aG docker runner
+
+remove_sources
+remove_caches
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function configure_git() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  local GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
+
+  gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY}
+  gpg --export ${GIT_CORE_PPA_KEY} | gpg --dearmor -o /usr/share/keyrings/git-core.gpg
+
+  if [[ "${VERSION_CODENAME}" == "focal" ]]; then
+    local GIT_CORE_FOCAL_PPA_KEY="E363C90F8F1B6217"
+    local KEYRING_FILE="/usr/share/keyrings/git-core-focal.gpg"
+    gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys ${GIT_CORE_FOCAL_PPA_KEY}
+    gpg --export ${GIT_CORE_FOCAL_PPA_KEY} | gpg --dearmor -o "${KEYRING_FILE}"
+    echo deb [signed-by=${KEYRING_FILE}] http://ppa.launchpad.net/git-core/ppa/ubuntu focal main>/etc/apt/sources.list.d/git-core.list
+
+  fi
+}
+
+function configure_docker() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  mkdir -p /etc/apt/keyrings
+  curl -fsSL "https://download.docker.com/linux/$ID/gpg" | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+
+  local version DPKG_ARCH
+  version=$(echo "$VERSION_CODENAME" | sed 's/trixie\|n\/a/bookworm/g')
+  DPKG_ARCH="$(dpkg --print-architecture)"
+  echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/$ID ${version} stable" \
+    | tee /etc/apt/sources.list.d/docker.list > /dev/null
+}
+
+function configure_container_tools() {
+  # shellcheck source=/dev/null
+  source /etc/os-release
+
+  if [[ "${VERSION_CODENAME}" == "focal" ]]; then
+    echo "available in 20.10 and higher"
+    echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" \
+      | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
+    curl -L "https://build.opensuse.org/projects/devel:kubic/signing_keys/download?kind=gpg" \
+      | /usr/bin/apt-key add -
+  fi
+}
+
+function configure_sources() {
+  configure_git
+  configure_docker
+  configure_container_tools
+}
+
+function remove_sources() {
+  rm -f /etc/apt/sources.list.d/git-core.list
+  rm -f /etc/apt/sources.list.d/docker.list
+  rm -f /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
+}
@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+function install_git() {
+  ( apt-get install -y --no-install-recommends git \
+   || apt-get install -t stable -y --no-install-recommends git )
+}
+
+function install_liblttng-ust() {
+  if [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]]; then
+    apt-get install -y --no-install-recommends liblttng-ust0
+  fi
+
+  if [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]]; then
+    apt-get install -y --no-install-recommends liblttng-ust1
+  fi
+}
+
+function install_aws-cli() {
+  ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" \
+    && unzip -q awscliv2.zip -d /tmp/ \
+    && /tmp/aws/install \
+    && rm awscliv2.zip \
+  ) \
+    || pip3 install --no-cache-dir awscli
+}
+
+function install_git-lfs() {
+  local DPKG_ARCH
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz
+  tar -xzf /tmp/lfs.tar.gz -C /tmp
+  "/tmp/git-lfs-${GIT_LFS_VERSION}/install.sh"
+  rm -rf /tmp/lfs.tar.gz "/tmp/git-lfs-${GIT_LFS_VERSION}"
+}
+
+function install_docker-cli() {
+  apt-get install -y docker-ce-cli --no-install-recommends --allow-unauthenticated
+}
+
+function install_docker() {
+  apt-get install -y docker-ce docker-ce-cli docker-buildx-plugin containerd.io docker-compose-plugin --no-install-recommends --allow-unauthenticated
+
+  echo -e '#!/bin/sh\ndocker compose --compatibility "$@"' > /usr/local/bin/docker-compose
+  chmod +x /usr/local/bin/docker-compose
+
+  sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker
+}
+
+function install_container-tools() {
+  ( apt-get install -y --no-install-recommends podman buildah skopeo || : )
+}
+
+function install_github-cli() {
+  local DPKG_ARCH GH_CLI_VERSION GH_CLI_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/cli/cli/releases/latest \
+      | jq -r '.tag_name' | sed 's/^v//g')
+
+  GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/cli/cli/releases/latest \
+      | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" \
+      | jq -r '.browser_download_url')
+
+  curl -sSLo /tmp/ghcli.deb "${GH_CLI_DOWNLOAD_URL}"
+  apt-get -y install /tmp/ghcli.deb
+  rm /tmp/ghcli.deb
+}
+
+function install_yq() {
+  local DPKG_ARCH YQ_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  YQ_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/mikefarah/yq/releases/latest \
+      | jq ".assets[] | select(.name == \"yq_linux_${DPKG_ARCH}.tar.gz\")" \
+      | jq -r '.browser_download_url')
+
+  curl -s "${YQ_DOWNLOAD_URL}" -L -o /tmp/yq.tar.gz
+  tar -xzf /tmp/yq.tar.gz -C /tmp
+  mv "/tmp/yq_linux_${DPKG_ARCH}" /usr/local/bin/yq
+}
+
+function install_powershell() {
+  local DPKG_ARCH PWSH_VERSION PWSH_DOWNLOAD_URL
+
+  DPKG_ARCH="$(dpkg --print-architecture)"
+
+  PWSH_VERSION=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
+      | jq -r '.tag_name' \
+      | sed 's/^v//g')
+
+  PWSH_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json" \
+    https://api.github.com/repos/PowerShell/PowerShell/releases/latest \
+      | jq -r ".assets[] | select(.name == \"powershell-${PWSH_VERSION}-linux-${DPKG_ARCH//amd64/x64}.tar.gz\") | .browser_download_url")
+
+  curl -L -o /tmp/powershell.tar.gz "$PWSH_DOWNLOAD_URL"
+  mkdir -p /opt/powershell
+  tar zxf /tmp/powershell.tar.gz -C /opt/powershell
+  chmod +x /opt/powershell/pwsh
+  ln -s /opt/powershell/pwsh /usr/bin/pwsh
+}
+
+function install_tools() {
+  local function_name
+  # shellcheck source=/dev/null
+  source "$(dirname "${BASH_SOURCE[0]}")/config.sh"
+
+  script_packages | while read -r package; do
+    function_name="install_${package}"
+    if declare -f "${function_name}" > /dev/null; then
+      "${function_name}"
+    else
+      echo "No install script found for package: ${package}"
+      exit 1
+    fi
+  done
+}
@@ -26,6 +26,7 @@ deregister_runner() {
    RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
  fi
  ./config.sh remove --token "${RUNNER_TOKEN}"
+  [[ -f "/actions-runner/.runner" ]] && rm -f /actions-runner/.runner
  exit
 }

@@ -57,6 +58,8 @@ _RUNNER_GROUP=${RUNNER_GROUP:-Default}
 _GITHUB_HOST=${GITHUB_HOST:="github.com"}
 _RUN_AS_ROOT=${RUN_AS_ROOT:="true"}
 _START_DOCKER_SERVICE=${START_DOCKER_SERVICE:="false"}
+_UNSET_CONFIG_VARS=${UNSET_CONFIG_VARS:="false"}
+_CONFIGURED_ACTIONS_RUNNER_FILES_DIR=${CONFIGURED_ACTIONS_RUNNER_FILES_DIR:-""}

 # ensure backwards compatibility
 if [[ -z ${RUNNER_SCOPE} ]]; then
@@ -147,19 +150,46 @@ configure_runner() {
      --replace \
      "${ARGS[@]}"

-  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir "${_RUNNER_WORKDIR}"
+  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir -p "${_RUNNER_WORKDIR}"

 }

+unset_config_vars() {
+  echo "Unsetting configuration environment variables"
+  unset RUN_AS_ROOT
+  unset RUNNER_NAME
+  unset RUNNER_NAME_PREFIX
+  unset RANDOM_RUNNER_SUFFIX
+  unset ACCESS_TOKEN
+  unset APP_ID
+  unset APP_PRIVATE_KEY
+  unset APP_LOGIN
+  unset RUNNER_SCOPE
+  unset ORG_NAME
+  unset ENTERPRISE_NAME
+  unset LABELS
+  unset REPO_URL
+  unset RUNNER_TOKEN
+  unset RUNNER_WORKDIR
+  unset RUNNER_GROUP
+  unset GITHUB_HOST
+  unset DISABLE_AUTOMATIC_DEREGISTRATION
+  unset CONFIGURED_ACTIONS_RUNNER_FILES_DIR
+  unset EPHEMERAL
+  unset DISABLE_AUTO_UPDATE
+  unset START_DOCKER_SERVICE
+  unset NO_DEFAULT_LABELS
+  unset UNSET_CONFIG_VARS
+}

 # Opt into runner reusage because a value was given
-if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+if [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
  echo "Runner reusage is enabled"

  # directory exists, copy the data
-  if [[ -d "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  if [[ -d "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
    echo "Copying previous data"
-    cp -p -r "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}/." "/actions-runner"
+    cp -p -r "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}/." "/actions-runner"
  fi

  if [ -f "/actions-runner/.runner" ]; then
@@ -173,14 +203,19 @@ if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
 else
  echo "Runner reusage is disabled"
  if [[ ${_DEBUG_ONLY} == "false" ]]; then
+    [[ -f "/actions-runner/.runner" ]] && rm -f /actions-runner/.runner
    configure_runner
  fi
 fi

-if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
-  echo "Reusage is enabled. Storing data to ${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+if [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  echo "Reusage is enabled. Storing data to ${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+  if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
+    echo "DISABLE_AUTOMATIC_DEREGISTRATION should be set to true to avoid issues with re-using a deregistered runner."
+    exit 1
+  fi
  # Quoting (even with double-quotes) the regexp brokes the copying
-  cp -p -r "/actions-runner/_diag" "/actions-runner/svc.sh" /actions-runner/.[^.]* "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+  cp -p -r "/actions-runner/_diag" "/actions-runner/svc.sh" /actions-runner/.[^.]* "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
 fi


@@ -204,6 +239,11 @@ if [[ ${_START_DOCKER_SERVICE} == "true" ]]; then
  fi
 fi

+# Unset configuration environment variables if the flag is set
+if [[ ${_UNSET_CONFIG_VARS} == "true" ]]; then
+  unset_config_vars
+fi
+
 # Container's command (CMD) execution as runner user


@@ -235,7 +275,7 @@ if [[ ${_RUN_AS_ROOT} == "true" ]]; then
  fi
 else
  if [[ $(id -u) -eq 0 ]]; then
-    [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && chown -R runner "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+    [[ -n "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && chown -R runner "${_CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
    chown -R runner "${_RUNNER_WORKDIR}" /actions-runner
    # The toolcache is not recursively chowned to avoid recursing over prepulated tooling in derived docker images
    chown runner /opt/hostedtoolcache/
@@ -1,50 +0,0 @@
-module docker-github-actions-runner
-
-go 1.22
-
-require (
-	dario.cat/mergo v1.0.0 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/containerd/containerd v1.7.18 // indirect
-	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/cpuguy83/dockercfg v0.3.1 // indirect
-	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/docker v27.1.1+incompatible // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/klauspost/compress v1.17.4 // indirect
-	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
-	github.com/magiconair/properties v1.8.7 // indirect
-	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/patternmatcher v0.6.0 // indirect
-	github.com/moby/sys/sequential v0.5.0 // indirect
-	github.com/moby/sys/user v0.1.0 // indirect
-	github.com/moby/term v0.5.0 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/shirou/gopsutil/v3 v3.23.12 // indirect
-	github.com/shoenig/go-m1cpu v0.1.6 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/testcontainers/testcontainers-go v0.33.0 // indirect
-	github.com/tklauser/go-sysconf v0.3.12 // indirect
-	github.com/tklauser/numcpus v0.6.1 // indirect
-	github.com/yusufpapurcu/wmi v1.2.3 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
-	go.opentelemetry.io/otel v1.24.0 // indirect
-	go.opentelemetry.io/otel/metric v1.24.0 // indirect
-	go.opentelemetry.io/otel/trace v1.24.0 // indirect
-	golang.org/x/crypto v0.22.0 // indirect
-	golang.org/x/sys v0.21.0 // indirect
-)
@@ -1,142 +0,0 @@
-dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
-dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/containerd/containerd v1.7.18 h1:jqjZTQNfXGoEaZdW1WwPU0RqSn1Bm2Ay/KJPUuO8nao=
-github.com/containerd/containerd v1.7.18/go.mod h1:IYEk9/IO6wAPUz2bCMVUbsfXjzw5UNP5fLz4PsUygQ4=
-github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
-github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
-github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
-github.com/cpuguy83/dockercfg v0.3.1 h1:/FpZ+JaygUR/lZP2NlFI2DVfrOEMAIKP5wWEJdoYe9E=
-github.com/cpuguy83/dockercfg v0.3.1/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
-github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v27.1.1+incompatible h1:hO/M4MtV36kzKldqnA37IWhebRA+LnqqcqDja6kVaKY=
-github.com/docker/docker v27.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
-github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
-github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
-github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
-github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
-github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
-github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
-github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
-github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
-github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
-github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
-github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
-github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
-github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
-github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
-github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
-github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/shirou/gopsutil/v3 v3.23.12 h1:z90NtUkp3bMtmICZKpC4+WaknU1eXtp5vtbQ11DgpE4=
-github.com/shirou/gopsutil/v3 v3.23.12/go.mod h1:1FrWgea594Jp7qmjHUUPlJDTPgcsb9mGnXDxavtikzM=
-github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
-github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
-github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/testcontainers/testcontainers-go v0.33.0 h1:zJS9PfXYT5O0ZFXM2xxXfk4J5UMw/kRiISng037Gxdw=
-github.com/testcontainers/testcontainers-go v0.33.0/go.mod h1:W80YpTa8D5C3Yy16icheD01UTDu+LmXIA2Keo+jWtT8=
-github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
-github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
-github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
-github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
-github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
-go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo=
-go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
-go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
-go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
-go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
-go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -0,0 +1,89 @@
+package:
+    curl:
+        installed: true
+    docker:
+        installed: false
+    docker-compose:
+        installed: false
+    git:
+        installed: true
+    git-lfs:
+        installed: false
+    jq:
+        installed: true
+    lsb_release:
+        installed: false
+    make:
+        installed: true
+    pwsh:
+        installed: false
+    python3:
+        installed: true
+    rsync:
+        installed: true
+    ssh:
+        installed: false
+    sudo:
+        installed: true
+    tar:
+        installed: true
+    unzip:
+        installed: true
+    wget:
+        installed: true
+    yq:
+        installed: false
+    # Ubuntu Focal is the only one currently that doesnt have an official upstream skopeo/buildah/podman
+    {{ if not (eq .Vars.oscodename "focal") }}
+    skopeo:
+        installed: true
+    buildah:
+        installed: true
+    podman:
+        installed: true
+    {{ end }}
+file:
+  /usr/bin/gh:
+    exists: true
+  /usr/bin/nodejs:
+    exists: true
+  /usr/sbin/gosu:
+    exists: true
+  /usr/bin/dumb-init:
+    exists: true
+  /etc/init.d/docker:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - /^\s*# ulimit -Hn/
+  /etc/sudoers:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - '/%sudo ALL=\(ALL\) NOPASSWD: ALL/'
+      - '/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/'
+  /etc/locale.gen:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+    contents:
+      - '/^en_US.UTF-8 UTF-8/'
+
+user:
+    runner:
+        exists: true
+        uid: 1001
+        gid: 121
+        groups:
+            - runner
+            - sudo
+            - docker
+group:
+    runner:
+        exists: true
+        gid: 121
@@ -0,0 +1,18 @@
+command:
+  /entrypoint.sh something:
+    exit-status: 0
+    stdout:
+      - "Runner reusage is disabled"
+      - ""
+      - "Disable automatic registration: true"
+      - "Random runner suffix: true"
+      - "Runner workdir: /tmp/a"
+      - "Runner name: huzzah"
+      - "Labels: blue,green"
+      - "Runner Group: wat"
+      - "Github Host: github.example.com"
+      - "Run as root:true"
+      - "Start docker: false"
+      - "Running something"
+    stderr: ""
+    timeout: 2000
@@ -0,0 +1,20 @@
+command:
+    /entrypoint.sh something:
+        exit-status: 0
+        stdout:
+            - REPO_URL required for repo runners
+            - Runner reusage is disabled
+            - ""
+            - 'Disable automatic registration: false'
+            - 'Random runner suffix: true'
+            - 'Runner name: test'
+            - 'Runner workdir: /_work/test'
+            - 'Labels: default'
+            - 'Runner Group: Default'
+            - 'Github Host: github.com'
+            - Run as root:true
+            - 'Start docker: false'
+            - Running something
+            - ""
+        stderr: ""
+        timeout: 2000
@@ -0,0 +1,9 @@
+command:
+  /entrypoint.sh something:
+    exit-status: 1
+    stdout:
+      - "Runner reusage is enabled"
+      - "Reusage is enabled. Storing data to /runner/data"
+      - "DISABLE_AUTOMATIC_DEREGISTRATION should be set to true to avoid issues with re-using a deregistered runner."
+    stderr: ""
+    timeout: 2000
@@ -10,4 +10,4 @@ curl -L "https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSIO
 tar -zxf actions.tar.gz
 rm -f actions.tar.gz
 ./bin/installdependencies.sh
-mkdir /_work
+mkdir -p /_work
@@ -1,7 +1,8 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
-    "config:base"
+    "config:base",
+    "helpers:pinGitHubActionDigests"
  ],
  "packageRules": [
    {
@@ -11,6 +12,11 @@
    {
      "matchDepTypes": ["devDependencies"],
      "automerge": true
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchPackagePatterns": [".*"],
+      "versioning": "digest"
    }
  ],
  "platformAutomerge": true
@@ -1,167 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"testing"
-)
-
-func TestIntegrationGHRunnerBase(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	ctx := context.Background()
-
-	ghaRunner, err := setupGHRunner(ctx, map[string]string{})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Clean up the container after the test is complete
-	t.Cleanup(func() {
-		if err := ghaRunner.Terminate(ctx); err != nil {
-			t.Fatalf("failed to terminate container: %s", err)
-		}
-	})
-
-	for _, theProgram := range []string{
-		"curl",
-		"docker",
-		"docker-compose",
-		"dumb-init",
-		"gh",
-		"git",
-		"git-lfs",
-		"gosu",
-		"jq",
-		"lsb_release",
-		"make",
-		"nodejs",
-		"pwsh",
-		"python3",
-		"rsync",
-		"ssh",
-		"sudo",
-		"tar",
-		"unzip",
-		"wget",
-		"yq",
-		"zip",
-	} {
-
-		t.Run(fmt.Sprintf("%sExists", theProgram), func(t *testing.T) {
-
-			exitCode, _, err := ghaRunner.Exec(ctx, []string{"which", theProgram})
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if exitCode != 0 {
-				t.Fatalf("expected %s to be installed", theProgram)
-			}
-		})
-	}
-
-	theTests := []outputTest{
-		{
-			name:        "ulimit set",
-			cmd:         []string{"grep", "^\\s*# ulimit -Hn", "/etc/init.d/docker"},
-			expectation: "expected ulimit to be set in /etc/init.d/docker\"",
-			output:      []string{""},
-			statusCode:  0,
-		},
-		{
-			name:        "runner user id",
-			cmd:         []string{"id", "-u", "runner"},
-			expectation: "expected runner to exist with uid 1001",
-			output:      []string{"1001"},
-			statusCode:  0,
-		},
-		{
-			name:        "runner group id",
-			cmd:         []string{"id", "-g", "runner"},
-			expectation: "expected runner to exist with gid 121",
-			output:      []string{"121"},
-			statusCode:  0,
-		},
-		{
-			name:        "runner groups",
-			cmd:         []string{"id", "-Gn", "runner"},
-			expectation: "expected runner to exist with group names runner sudo docker",
-			output:      []string{"runner sudo docker"},
-			statusCode:  0,
-		},
-		{
-			name:        "sudo no password for runner",
-			cmd:         []string{"tail", "-n", "1", "/etc/sudoers"},
-			expectation: "expected runner to have NOPASSWD line in sudoers",
-			output:      []string{"%sudo ALL=(ALL) NOPASSWD: ALL"},
-			statusCode:  0,
-		},
-		{
-			name:        "suders defaults",
-			cmd:         []string{"grep", "Defaults env_keep = \"HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy\"", "/etc/sudoers"},
-			expectation: "expected sudoers to have updated Defaults env_keep",
-			output:      []string{""},
-			statusCode:  0,
-		},
-		{
-			name:        "locale set",
-			cmd:         []string{"grep", "-v", "^#", "/etc/locale.gen"},
-			expectation: "expected locale to be set in /etc/locale.gen",
-			output:      []string{"en_US.UTF-8 UTF-8"},
-			statusCode:  0,
-		},
-	}
-	t.Logf("%v", theTests)
-
-	for _, theT := range theTests {
-
-		t.Run(theT.name, func(t *testing.T) {
-
-			if theT.output[0] != "" {
-				output, err := runAndReturnOutput(ghaRunner, ctx, theT.cmd)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if output[0] != theT.output[0] {
-					t.Fatalf("expected %s, got %s", theT.output, output[0])
-				}
-			}
-
-			cmdExitCode, _, _ := ghaRunner.Exec(ctx, theT.cmd)
-			if cmdExitCode != 0 {
-				t.Fatalf(theT.expectation)
-			}
-		})
-	}
-
-	// os specific tests
-	osDistro, err := runAndReturnOutput(ghaRunner, ctx, []string{"/usr/bin/awk", "-F=", "/^VERSION_CODENAME=/ {print $2}", "/etc/os-release"})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// focal is the only one that does not have skopeo buildah podman
-	if osDistro[0] != "focal" {
-		for _, theProgram := range []string{
-			"skopeo",
-			"buildah",
-			"podman",
-		} {
-			t.Run(fmt.Sprintf("%sExists", theProgram), func(t *testing.T) {
-
-				exitCode, _, err := ghaRunner.Exec(ctx, []string{"which", theProgram})
-				if err != nil {
-					t.Fatal(err)
-				}
-
-				if exitCode != 0 {
-					t.Fatalf("expected %s to be installed", theProgram)
-				}
-
-			})
-		}
-	}
-}
@@ -1,89 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"github.com/testcontainers/testcontainers-go"
-	"io"
-	"os"
-	"strings"
-	"unicode"
-)
-
-type ghaRunnerontainer struct {
-	testcontainers.Container
-}
-
-// Helper function to read from an io.Reader and return a slice of strings (one per line)
-func readLines(reader io.Reader) ([]string, error) {
-	var lines []string
-	scanner := bufio.NewScanner(reader)
-	for scanner.Scan() {
-		lines = append(lines, scanner.Text())
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, err
-	}
-	return lines, nil
-}
-
-func cleanString(b []byte) string {
-	s := string(b)
-	return strings.Map(func(r rune) rune {
-		if unicode.IsPrint(r) {
-			return r
-		}
-		return -1
-	}, s)
-}
-
-func runAndReturnOutput(ctr testcontainers.Container, ctx context.Context, cmd []string) ([]string, error) {
-	_, reader, err := ctr.Exec(ctx, cmd)
-	if err != nil {
-		return nil, err
-	}
-	lines, err := readLines(reader)
-	if err != nil {
-		fmt.Println("Error reading lines:", err)
-	}
-
-	fixedOutput := make([]string, len(lines))
-	for i, line := range lines {
-		fixedOutput[i] = cleanString([]byte(line))
-	}
-	return fixedOutput, nil
-
-}
-
-func setupGHRunner(ctx context.Context, envVars map[string]string) (*ghaRunnerontainer, error) {
-	if os.Getenv("GH_RUNNER_IMAGE") == "" {
-		return nil, fmt.Errorf("GH_RUNNER_IMAGE is not set")
-	}
-	req := testcontainers.ContainerRequest{
-		Image:        os.Getenv("GH_RUNNER_IMAGE"),
-		ExposedPorts: []string{},
-		Entrypoint:   []string{"/usr/bin/sleep"},
-		Cmd:          []string{"60"},
-		Env:          envVars,
-	}
-
-	container, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
-		ContainerRequest: req,
-		Started:          true,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return &ghaRunnerontainer{Container: container}, nil
-}
-
-type outputTest struct {
-	name        string
-	cmd         []string
-	output      []string
-	statusCode  int
-	expectation string
-	envVars     map[string]string
-}
@@ -1,134 +0,0 @@
-package main
-
-import (
-	"context"
-	"testing"
-)
-
-func TestIntegrationGHRunner(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping integration test")
-	}
-
-	ctx := context.Background()
-
-	theTests := []outputTest{
-		{
-			name: "default behavior",
-			envVars: map[string]string{
-				"DEBUG_ONLY":  "true",
-				"RUNNER_NAME": "test",
-			},
-			cmd:         []string{"/entrypoint.sh", "something"},
-			expectation: "The default behavior should be set correctly",
-			output: []string{
-				"REPO_URL required for repo runners",
-				"Runner reusage is disabled",
-				"",
-				"Disable automatic registration: false",
-				"Random runner suffix: true",
-				"Runner name: test",
-				"Runner workdir: /_work/test",
-				"Labels: default",
-				"Runner Group: Default",
-				"Github Host: github.com",
-				"Run as root:true",
-				"Start docker: false",
-				"Running something",
-			},
-			statusCode: 0,
-		},
-		{
-			name: "non default behavior",
-			envVars: map[string]string{
-				"DEBUG_ONLY":                       "true",
-				"RUNNER_NAME":                      "huzzah",
-				"REPO_URL":                         "https://github.com/myoung34/docker-github-actions-runner",
-				"RUN_AS_ROOT":                      "true",
-				"RUNNER_NAME_PREFIX":               "asdf",
-				"ACCESS_TOKEN":                     "1234",
-				"APP_ID":                           "5678",
-				"APP_PRIVATE_KEY":                  "2345",
-				"APP_LOGIN":                        "SOMETHING",
-				"RUNNER_SCOPE":                     "org",
-				"ORG_NAME":                         "myoung34",
-				"ENTERPRISE_NAME":                  "emyoung34",
-				"LABELS":                           "blue,green",
-				"RUNNER_TOKEN":                     "3456",
-				"RUNNER_WORKDIR":                   "/tmp/a",
-				"RUNNER_GROUP":                     "wat",
-				"GITHUB_HOST":                      "github.example.com",
-				"DISABLE_AUTOMATIC_DEREGISTRATION": "true",
-				"EPHEMERAL":                        "true",
-				"DISABLE_AUTO_UPDATE":              "true",
-			},
-			cmd:         []string{"/entrypoint.sh", "something"},
-			expectation: "The non default behavior should be set correctly",
-			output: []string{
-				"Runner reusage is disabled",
-				"",
-				"Disable automatic registration: true",
-				"Random runner suffix: true",
-				"Runner name: huzzah",
-				"Runner workdir: /tmp/a",
-				"Labels: blue,green",
-				"Runner Group: wat",
-				"Github Host: github.example.com",
-				"Run as root:true",
-				"Start docker: false",
-				"Running something",
-			},
-			statusCode: 0,
-		},
-		{
-			name:        "gha softwrae installed",
-			cmd:         []string{"ls", "./bin/Runner.Listener"},
-			expectation: "The GHA software should be installed in the container",
-			output: []string{
-				"./bin/Runner.Listener",
-			},
-			statusCode: 0,
-		},
-	}
-	t.Logf("%v", theTests)
-
-	for _, theT := range theTests {
-
-		t.Run(theT.name, func(t *testing.T) {
-			ghaRunner, err := setupGHRunner(ctx, theT.envVars)
-			if err != nil {
-				t.Fatal(err)
-			}
-			// Clean up the container after the test is complete
-			t.Cleanup(func() {
-				if err := ghaRunner.Terminate(ctx); err != nil {
-					t.Fatalf("failed to terminate container: %s", err)
-				}
-			})
-
-			output, err := runAndReturnOutput(ghaRunner, ctx, theT.cmd)
-
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			// loop through output and compare to test output
-			for i, line := range output {
-				// skip if theT.output[i] is empty
-				if theT.output[i] == "" {
-					continue
-				}
-				if line != theT.output[i] {
-					// try it again but without the first character in the line because of dumb unicode
-					if line[1:] != theT.output[i] {
-						if line != theT.output[i][1:] {
-							if line[1:] != theT.output[i][1:] {
-								t.Errorf("Expected %s, got %s", theT.output[i], line)
-							}
-						}
-					}
-				}
-			}
-		})
-	}
-}
Author	SHA1	Message	Date
Marcus Young	1113f5896b	[Automated 🤖 ] Bump to version 2.326.0	2025-07-07 15:19:13 -05:00
myoung34andGitHub	6510abfa97	Merge pull request #464 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.29.2	2025-07-02 20:25:12 -04:00
renovate[bot]andGitHub	1e5aef7fd9	Update github/codeql-action action to v3.29.2	2025-06-30 16:25:17 +00:00
myoung34andGitHub	767b90dc11	Merge pull request #463 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.29.1	2025-06-27 06:55:11 -05:00
renovate[bot]andGitHub	c4cde09fb4	Update github/codeql-action action to v3.29.1	2025-06-27 11:46:24 +00:00
myoung34andGitHub	93215e94d9	Merge pull request #461 from myoung34/renovate/docker-setup-buildx-action-3.x Update docker/setup-buildx-action action to v3.11.1	2025-06-18 10:56:12 -05:00
renovate[bot]andGitHub	cb4c4ac8ed	Update docker/setup-buildx-action action to v3.11.1	2025-06-18 13:43:01 +00:00
myoung34andGitHub	ba68ffeb81	Merge pull request #460 from myoung34/renovate/docker-setup-buildx-action-3.x Update docker/setup-buildx-action action to v3.11.0	2025-06-16 14:12:03 -05:00
renovate[bot]andGitHub	6311c21d14	Update docker/setup-buildx-action action to v3.11.0	2025-06-16 19:07:01 +00:00
myoung34andGitHub	b3c7474675	Merge pull request #458 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.29.0	2025-06-11 17:17:04 -05:00
renovate[bot]andGitHub	b67116f6e4	Update github/codeql-action action to v3.29.0	2025-06-11 22:03:48 +00:00
myoung34andGitHub	1d9e8868ad	Merge pull request #457 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.19	2025-06-03 10:20:18 -05:00
renovate[bot]andGitHub	2d4990e197	Update github/codeql-action action to v3.28.19	2025-06-03 15:10:37 +00:00
Marcus Young	7e5779b170	[Automated 🤖 ] Bump to version 2.325.0	2025-06-02 13:48:39 -05:00
myoung34andGitHub	56233b5a1c	Merge pull request #455 from SaschaHenning/master Fix RUNNER_WORKDIR not created if part of the folder structure is nonexisting	2025-05-22 09:54:58 -05:00
Sascha HenningandGitHub	2b0f61916a	fix RUNNER_WORKDIR not created if parent folder does not exist	2025-05-20 15:01:32 +02:00
myoung34andGitHub	d49ef96679	Merge pull request #454 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.18	2025-05-19 11:22:45 -05:00
renovate[bot]andGitHub	f66226db9c	Update github/codeql-action action to v3.28.18	2025-05-16 14:56:08 +00:00
Marcus Young	de943e2e38	[Automated 🤖 ] Bump to version 2.324.0	2025-05-13 00:27:05 -05:00
myoung34andGitHub	d9094bd6dd	Merge pull request #448 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.17	2025-05-02 06:21:22 -04:00
renovate[bot]andGitHub	46bb16d631	Update github/codeql-action action to v3.28.17	2025-05-02 09:58:26 +00:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	b304a0e3f1	Update actions/setup-python action to v5.6.0 (#447 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-04-24 14:31:26 +00:00
myoung34andGitHub	67197609ff	Merge pull request #446 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.16	2025-04-23 08:07:01 -05:00
renovate[bot]andGitHub	4aa08f7b87	Update github/codeql-action action to v3.28.16	2025-04-23 12:48:24 +00:00
myoung34andGitHub	c07669d21e	Merge pull request #444 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.15	2025-04-07 20:42:58 -05:00
renovate[bot]andGitHub	afe24fb382	Update github/codeql-action action to v3.28.15	2025-04-07 22:49:35 +00:00
myoung34andGitHub	4593a2c53b	Merge pull request #443 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.14	2025-04-07 09:06:09 -05:00
renovate[bot]andGitHub	febe59b6f2	Update github/codeql-action action to v3.28.14	2025-04-07 10:01:29 +00:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	abf6f7ef87	Update actions/setup-python action to v5.5.0 (#441 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-03-25 10:46:47 +00:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	8969c0a49b	Update github/codeql-action action to v3.28.13 (#439 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2025-03-24 22:14:27 +00:00
myoung34andGitHub	ac1308d764	Merge pull request #438 from myoung34/renovate/github-codeql-action-3.x Update github/codeql-action action to v3.28.12	2025-03-20 15:45:29 -05:00
renovate[bot]andGitHub	c90771d489	Update github/codeql-action action to v3.28.12	2025-03-19 18:39:17 +00:00
Mark Young	5869f38e4b	[Automated 🤖 ] Bump to version 2.323.0	2025-03-19 13:38:45 -05:00
Mark Young	9e608c3a82	Move final actions to SHA's	2025-03-17 11:11:33 -05:00
Mark Young	b65e08bc91	Add codeql to flag unpinned actions refs	2025-03-17 09:15:06 -05:00
myoung34andGitHub	9270f9a7a7	Merge pull request #437 from myoung34/renovate/docker-setup-qemu-action-3.x Update docker/setup-qemu-action action to v3.6.0	2025-03-17 08:56:15 -05:00
myoung34andGitHub	4e8ac02be6	Merge pull request #436 from myoung34/renovate/docker-setup-buildx-action-3.x Update docker/setup-buildx-action action to v3.10.0	2025-03-17 08:56:08 -05:00
myoung34andGitHub	6c30d2e070	Merge pull request #435 from myoung34/renovate/docker-login-action-3.x Update docker/login-action action to v3.4.0	2025-03-17 08:56:00 -05:00
renovate[bot]andGitHub	5aadc7f42b	Update docker/setup-qemu-action action to v3.6.0	2025-03-17 13:55:49 +00:00
myoung34andGitHub	66eb4f5a2f	Merge pull request #434 from myoung34/renovate/actions-stale-9.x Update actions/stale action to v9.1.0	2025-03-17 08:55:47 -05:00
renovate[bot]andGitHub	e42df8f308	Update docker/setup-buildx-action action to v3.10.0	2025-03-17 13:55:43 +00:00
myoung34andGitHub	feedfa66f0	Merge pull request #433 from myoung34/renovate/actions-setup-python-5.x Update actions/setup-python action to v5.4.0	2025-03-17 08:55:41 -05:00
renovate[bot]andGitHub	1f125c1391	Update docker/login-action action to v3.4.0	2025-03-17 13:55:38 +00:00
renovate[bot]andGitHub	9d6d26c2d4	Update actions/stale action to v9.1.0	2025-03-17 13:55:33 +00:00
renovate[bot]andGitHub	5cfbf3423a	Update actions/setup-python action to v5.4.0	2025-03-17 13:55:30 +00:00
myoung34andGitHub	ad78bd8fd8	Merge pull request #432 from myoung34/renovate/actions-create-release-1.x Update actions/create-release action to v1.1.4	2025-03-17 08:55:25 -05:00
myoung34andGitHub	90fdc6b19c	Merge pull request #431 from myoung34/renovate/actions-checkout-4.x Update actions/checkout action to v4.2.2	2025-03-17 08:55:13 -05:00
myoung34andGitHub	8a526ec997	Merge pull request #430 from myoung34/renovate/nick-fields-retry-3.x Update nick-fields/retry action to v3.0.2	2025-03-17 08:55:03 -05:00
renovate[bot]andGitHub	9c9369a0e3	Update actions/create-release action to v1.1.4	2025-03-17 13:53:52 +00:00
renovate[bot]andGitHub	a79e0182bf	Update actions/checkout action to v4.2.2	2025-03-17 13:53:49 +00:00
renovate[bot]andGitHub	2b58586d88	Update nick-fields/retry action to v3.0.2	2025-03-17 13:53:45 +00:00
myoung34andGitHub	c1292d5720	Merge pull request #429 from myoung34/renovate/pin-dependencies Pin dependencies	2025-03-17 08:53:12 -05:00
renovate[bot]andGitHub	e8e9da59f0	Pin dependencies	2025-03-17 13:27:33 +00:00
Mark Young	d8df91da6d	Set renovate to prefer github actions sha's	2025-03-17 08:26:55 -05:00
myoung34andGitHub	651dbe1fdf	Merge pull request #427 from myoung34/fix_deregistration_on_reusable Force DISABLE_AUTOMATIC_DEREGISTRATION to be true on reusable runners, add tests	2025-02-24 11:56:18 -06:00
Mark Young	9ed37bca4c	Force DISABLE_AUTOMATIC_DEREGISTRATION to be true on reusable runners, add tests	2025-02-24 11:19:25 -06:00
Mark Young	b9c038dfd3	Fix remaining qemu libc-bin runs	2025-02-19 17:30:16 -06:00
myoung34andGitHub	38e96633b7	Merge pull request #425 from myoung34/libc-bin_segfault Attempt to fix GHA segfault	2025-02-19 17:03:43 -06:00
Mark Young	fb13e93b86	Fix GHA segfault on ubuntu-jammy for libc-bin * backtrack binfmt to v7 via https://github.com/tonistiigi/binfmt/issues/240	2025-02-19 09:50:25 -06:00
Marcus Young	c3436f8af3	[Automated 🤖 ] Bump to version 2.322.0	2025-01-24 09:00:57 -06:00
myoung34andGitHub	1a5ad74d28	Merge pull request #417 from myoung34/fix_debian_sid Fix debian sid	2024-12-11 16:44:11 -05:00
Mark Young	50340d28c3	Fix debian sid	2024-12-11 15:59:31 -05:00
Marcus Young	ec7f582118	[Automated 🤖 ] Bump to version 2.321.0	2024-11-13 10:37:31 -07:00
myoung34andGitHub	c36f07ff88	Merge pull request #408 from myoung34/renovate/actions-checkout-digest Update actions/checkout digest to 11bd719	2024-10-23 11:53:12 -05:00
renovate[bot]andGitHub	1c4008bc0b	Update actions/checkout digest to 11bd719	2024-10-23 16:50:20 +00:00
myoung34andGitHub	8873f648e7	Merge pull request #404 from myoung34/renovate/actions-checkout-digest Update actions/checkout digest to eef6144	2024-10-07 13:49:32 -05:00
renovate[bot]andGitHub	90e9fe160a	Update actions/checkout digest to eef6144	2024-10-07 18:40:39 +00:00
myoung34andGitHub	47ce625b58	Merge pull request #403 from bodograumann/patch-1 Make sure there is no remnant runner config before configuring	2024-10-06 14:06:40 -05:00
Bodo Graumann	c6f70ddb46	Apply suggestions from PR	2024-10-05 20:08:27 +02:00
Bodo GraumannandGitHub	d4ee023016	Make sure there is no remnant runner config before configuring Closes #402	2024-10-05 09:25:14 +02:00
Marcus Young	706339b472	[Automated 🤖 ] Bump to version 2.320.0	2024-10-03 14:56:00 -05:00
myoung34andGitHub	a164a11b6b	Merge pull request #399 from myoung34/readme_update Add information on how to view and modify the included packages and configuration	2024-09-27 06:26:14 -05:00
Marcus Young	c9036e711f	Add information on how to view and modify the included packages and configuration	2024-09-27 06:25:45 -05:00
myoung34andGitHub	a55d4f9a42	Merge pull request #393 from vyadh/config-driven-install Config driven install	2024-09-26 16:14:54 -05:00
Kieron Wilkinson	b34e2f59c1	Added script source for software installs via config.json	2024-09-26 21:24:12 +01:00
Kieron Wilkinson	11d8d4c524	Select apt packages to install from config.json	2024-09-26 21:24:12 +01:00
Kieron Wilkinson	29667cc827	Created a build config file with initially user and group id. This allows users to specify ids that are consistent with their host users	2024-09-26 21:24:11 +01:00
myoung34andGitHub	5615bd29fd	Merge pull request #398 from myoung34/fix_readme Fix readme for tests	2024-09-25 08:40:48 -05:00
Marcus Young	e40248bf5b	Fix readme for tests	2024-09-25 08:40:29 -05:00
myoung34andGitHub	cf3f558db2	Merge pull request #395 from myoung34/goss_deprecation Goss: change deprecated file.contains to file.contents	2024-09-23 08:00:07 -05:00
Marcus Young	156484048d	Goss: change deprecated file.contains to file.contents	2024-09-20 22:02:21 -05:00
myoung34andGitHub	c54340de85	Merge pull request #394 from myoung34/retry_buildx Wrap all tests and docker/build-push-action into nick-fields/retry	2024-09-10 15:13:03 -05:00
Marcus Young	4ef971402a	Wrap all tests and docker/build-push-action into nick-fields/retry	2024-09-10 13:02:36 -05:00
myoung34andGitHub	a7d71289d1	Merge pull request #391 from myoung34/test_dir Fix temp dir location for tests	2024-09-09 13:33:36 -05:00
Mark Young	583d899630	Fix temp dir location for tests	2024-09-09 13:33:24 -05:00
myoung34andGitHub	560b1e0287	Merge pull request #390 from myoung34/add_dir_test Add runner dir test output to goss	2024-09-09 11:35:21 -05:00
Marcus Young	c69304a308	Add runner dir test output to goss	2024-09-09 11:34:02 -05:00
myoung34andGitHub	a8e227675c	Merge pull request #385 from vyadh/install-scripts Refactored to a set of install scripts to avoid adding further complexity to the base Dockerfile and make it easier to disable tools	2024-09-06 21:54:22 -05:00
Kieron Wilkinson	3f73ad68c9	Fixed shellcheck issues	2024-09-06 21:03:14 +01:00
Kieron Wilkinson	0bcea869f0	Refactored Dockerfile.base install into dedicated scripts Additionally, this change: - Configures upfront to reduce number of apt updates - Removes use of lsb-release to allow simplification and avoid unnecessary dependencies in the base image (i.e. Python)	2024-09-06 16:56:19 +01:00
myoung34andGitHub	b8ce68480a	Merge pull request #384 from yamoyamoto/chore/unset-envs-before-launch-service feat: Prevent exposure of configuration environment variables to runner workflows	2024-09-06 06:21:53 -05:00
tomoya-kawaguchi	35c099d07e	chore: use local var	2024-09-06 16:56:27 +09:00
tomoya-kawaguchi	bf069ba26b	docs: add UNSET_CONFIG_VARS settings	2024-09-06 16:56:27 +09:00
tomoya-kawaguchi	a3360fccaa	chore: unset configuration environment variables if flag is set	2024-09-06 16:54:52 +09:00
myoung34andGitHub	ab85a5a708	Merge pull request #389 from myoung34/base_and_defaults_test Remove the final command test from the base, make it a "defaults" test	2024-09-05 12:41:25 -05:00
Mark Young	e36338743e	Remove the final command test from the base, make it a "defaults" test	2024-09-05 12:40:05 -05:00
myoung34andGitHub	75bcd96989	Merge pull request #388 from myoung34/bugfix/platforms_slash Bugfix: fix platforms to remove slash	2024-09-05 12:34:05 -05:00
Mark Young	78d8042a48	Bugfix: fix platforms to remove slash	2024-09-05 12:33:41 -05:00
myoung34andGitHub	1ec6d387e6	Merge pull request #387 from myoung34/goss_tests Add goss tests	2024-09-05 11:59:50 -05:00
Marcus Young	0a4919d643	Add vars file for os,oscodename,arch in test matrix	2024-09-05 11:07:11 -05:00
Marcus Young	87dcaa1bb5	Add goss tests	2024-09-05 10:01:22 -05:00