I'm siGit, running on siGit Code & Deploy platform, browsing siGit Code coding agent repo.
Publish the Actions runner images to ghcr.io
packaging/actions-runner had no workflow, so the guest images could only be built by hand. Build both Dockerfile targets for linux/amd64 and push them as ghcr.io/getsigit/actions-runner and actions-runner-qa on a push to development that touches the image. A pull request builds without pushing. The README covers making a root filesystem from a published image with crane, for hosts that have no container runtime. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seto Elkahfi committed
Nov 2, 2026 at 16:29 UTC
e73dd441dc2e0f16be04ce563e9bf4ed6c578ad2
2 files changed
+106
-1
.github/workflows/release-actions-runner-image.yml
new
+83
@@ -0,0 +1,83 @@
1
+name: Release Actions runner image
2
+
3
+# Builds the guest images for GitHub Actions jobs that run in a microVM:
4
+# ghcr.io/getsigit/actions-runner and ghcr.io/getsigit/actions-runner-qa. A push
5
+# to development that touches the image publishes both. A pull request that
6
+# touches it builds them without pushing, so a broken Dockerfile shows up before
7
+# merge.
8
+on:
9
+ workflow_dispatch:
10
+ push:
11
+ branches:
12
+ - development
13
+ paths:
14
+ - packaging/actions-runner/**
15
+ - .github/workflows/release-actions-runner-image.yml
16
+ pull_request:
17
+ paths:
18
+ - packaging/actions-runner/**
19
+ - .github/workflows/release-actions-runner-image.yml
20
+
21
+concurrency:
22
+ group: ${{ github.workflow }}-${{ github.ref }}
23
+ cancel-in-progress: false
24
+
25
+permissions:
26
+ contents: read
27
+ packages: write
28
+
29
+jobs:
30
+ build:
31
+ name: Build ${{ matrix.target }}
32
+ runs-on: ubuntu-latest
33
+ timeout-minutes: 60
34
+
35
+ strategy:
36
+ fail-fast: false
37
+ matrix:
38
+ target:
39
+ - actions-runner
40
+ - actions-runner-qa
41
+
42
+ env:
43
+ IMAGE: ghcr.io/getsigit/${{ matrix.target }}
44
+ PUBLISH: ${{ github.event_name != 'pull_request' }}
45
+
46
+ steps:
47
+ - name: Checkout
48
+ uses: actions/checkout@v6
49
+
50
+ - name: Resolve tags
51
+ id: meta
52
+ shell: bash
53
+ run: |
54
+ if [[ "${PUBLISH}" == "true" ]]; then
55
+ {
56
+ echo "tags<<EOF"
57
+ echo "${IMAGE}:latest"
58
+ echo "${IMAGE}:$(git rev-parse HEAD)"
59
+ echo "EOF"
60
+ } >> "$GITHUB_OUTPUT"
61
+ else
62
+ echo "tags=${IMAGE}:pr-${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT"
63
+ fi
64
+
65
+ - uses: docker/setup-buildx-action@v4
66
+
67
+ - uses: docker/login-action@v4
68
+ if: env.PUBLISH == 'true'
69
+ with:
70
+ registry: ghcr.io
71
+ username: ${{ github.actor }}
72
+ password: ${{ secrets.GITHUB_TOKEN }}
73
+
74
+ - uses: docker/build-push-action@v7
75
+ with:
76
+ context: packaging/actions-runner
77
+ target: ${{ matrix.target }}
78
+ platforms: linux/amd64
79
+ push: ${{ env.PUBLISH == 'true' }}
80
+ tags: ${{ steps.meta.outputs.tags }}
81
+ labels: org.opencontainers.image.source=https://github.com/${{ github.repository }}
82
+ cache-from: type=gha,scope=${{ matrix.target }}
83
+ cache-to: type=gha,mode=max,scope=${{ matrix.target }}
packaging/actions-runner/README.md
+23
-1
@@ -16,11 +16,33 @@ two targets.
16
It holds no credentials. The runner starts with `run.sh --jitconfig`, using a one-job
17
configuration that arrives with the job, takes that job and exits.
18
19
+## Published images
20
+
21
+`.github/workflows/release-actions-runner-image.yml` builds both targets for `linux/amd64` and
22
+publishes them when a push to `development` changes this directory:
23
+
24
+- `ghcr.io/getsigit/actions-runner`
25
+- `ghcr.io/getsigit/actions-runner-qa`
26
+
27
+Each is tagged `latest` and with the commit it was built from.
28
+
29
## Making a root filesystem
30
31
+From a published image, on a host with `crane` and no container runtime:
32
+
33
+```sh
34
+mkdir rootfs
35
+crane export --platform linux/amd64 ghcr.io/getsigit/actions-runner:latest - \
36
+ | sudo tar -xpf - -C rootfs
37
+truncate -s 8G actions-runner.ext4
38
+sudo mkfs.ext4 -F -d rootfs actions-runner.ext4
39
+```
40
+
41
+From a local build:
42
+
43
```sh
44
docker build --target actions-runner -t actions-runner packaging/actions-runner
23
-cid=$(docker create actions-runner)
45
+cid=$(docker create actions-runner /bin/true)
46
docker export "$cid" | (mkdir rootfs && tar -x -C rootfs)
47
docker rm "$cid"
48
truncate -s 8G actions-runner.ext4