I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.
development
| 1 | # actions-runner |
| 2 | |
| 3 | Guest image for GitHub Actions jobs that run in a microVM. See the Dockerfile header for the |
| 4 | two targets. |
| 5 | |
| 6 | ## What the image holds |
| 7 | |
| 8 | - The Actions runner at `/opt/actions-runner`, pinned by version and sha256. Bump |
| 9 | `RUNNER_VERSION` and `RUNNER_SHA256` together; the digest is in the release notes. |
| 10 | Node is pinned the same way (`NODE_VERSION` with `NODE_SHA256` from `SHASUMS256.txt`), |
| 11 | and pnpm to an exact version. |
| 12 | - git, node, pnpm, jq, gh, python3 and a C toolchain. |
| 13 | - systemd as init. The microVM boots it, and the guest agent that talks to the host is installed |
| 14 | as a unit when the root filesystem is baked. |
| 15 | |
| 16 | It holds no credentials. The runner starts with `run.sh --jitconfig`, using a one-job |
| 17 | configuration that arrives with the job, takes that job and exits. |
| 18 | |
| 19 | ## Making a root filesystem |
| 20 | |
| 21 | ```sh |
| 22 | docker build --target actions-runner -t actions-runner packaging/actions-runner |
| 23 | cid=$(docker create actions-runner) |
| 24 | docker export "$cid" | (mkdir rootfs && tar -x -C rootfs) |
| 25 | docker rm "$cid" |
| 26 | truncate -s 8G actions-runner.ext4 |
| 27 | mkfs.ext4 -F -d rootfs actions-runner.ext4 |
| 28 | ``` |
| 29 | |
| 30 | The host-side tooling then installs the guest agent into the image and snapshots it. That step |
| 31 | lives with the runner, not here. |
| 32 | |
| 33 | ## Egress |
| 34 | |
| 35 | Inside the microVM the runner reaches the network only through the host's allowlisting proxy, |
| 36 | through `HTTPS_PROXY`. A workflow that needs a host beyond the allowlist fails at connect time. |