buildy build

tools/truenas_github_runner/.env.example

@@ -0,0 +1,9 @@
+RUNNER_IMAGE=ghcr.io/REPLACE_ME/starpilot-truenas-runner:latest
+GITHUB_REPOSITORY_URL=https://github.com/REPLACE_ME/REPLACE_ME
+RUNNER_NAME=starpilot-truenas-runner
+RUNNER_LABELS=self-hosted,truenas,starpilot-build
+RUNNER_WORKDIR=/runner/_work
+RUNNER_TOKEN=REPLACE_WITH_ONE_TIME_GITHUB_RUNNER_TOKEN
+RUNNER_DATA_PATH=/mnt/tank/apps/starpilot-runner
+DOCKER_GID=
+REMOVE_RUNNER_ON_EXIT=0

tools/truenas_github_runner/Dockerfile

@@ -0,0 +1,41 @@
+FROM ubuntu:24.04
+
+ARG DEBIAN_FRONTEND=noninteractive
+ARG RUNNER_VERSION=2.334.0
+
+ENV RUNNER_HOME=/runner
+ENV RUNNER_WORKDIR=/runner/_work
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    docker.io \
+    git \
+    gosu \
+    jq \
+    sudo \
+    tar \
+    unzip \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN useradd --create-home --home-dir /home/runner --shell /bin/bash runner \
+  && usermod -aG sudo runner \
+  && echo "runner ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/runner
+
+WORKDIR /opt/actions-runner
+
+RUN curl -fsSL -o actions-runner.tar.gz \
+      "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz" \
+  && tar -xzf actions-runner.tar.gz \
+  && rm actions-runner.tar.gz \
+  && ./bin/installdependencies.sh \
+  && chown -R runner:runner /opt/actions-runner
+
+COPY tools/truenas_github_runner/entrypoint.sh /usr/local/bin/truenas-runner-entrypoint
+COPY tools/truenas_github_runner/healthcheck.sh /usr/local/bin/truenas-runner-healthcheck
+
+RUN chmod 755 /usr/local/bin/truenas-runner-entrypoint /usr/local/bin/truenas-runner-healthcheck
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=5 CMD ["/usr/local/bin/truenas-runner-healthcheck"]
+
+ENTRYPOINT ["/usr/local/bin/truenas-runner-entrypoint"]

tools/truenas_github_runner/docker-compose.yaml

@@ -0,0 +1,16 @@
+services:
+  starpilot-runner:
+    image: ${RUNNER_IMAGE}
+    container_name: starpilot-runner
+    restart: unless-stopped
+    environment:
+      GITHUB_REPOSITORY_URL: ${GITHUB_REPOSITORY_URL}
+      RUNNER_NAME: ${RUNNER_NAME}
+      RUNNER_LABELS: ${RUNNER_LABELS}
+      RUNNER_WORKDIR: ${RUNNER_WORKDIR}
+      RUNNER_TOKEN: ${RUNNER_TOKEN}
+      DOCKER_GID: ${DOCKER_GID:-}
+      REMOVE_RUNNER_ON_EXIT: ${REMOVE_RUNNER_ON_EXIT:-0}
+    volumes:
+      - ${RUNNER_DATA_PATH}:/runner
+      - /var/run/docker.sock:/var/run/docker.sock

tools/truenas_github_runner/entrypoint.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+RUNNER_HOME="${RUNNER_HOME:-/runner}"
+RUNNER_WORKDIR="${RUNNER_WORKDIR:-${RUNNER_HOME}/_work}"
+RUNNER_LABELS="${RUNNER_LABELS:-self-hosted,truenas,starpilot-build}"
+RUNNER_NAME="${RUNNER_NAME:-$(hostname)}"
+REMOVE_RUNNER_ON_EXIT="${REMOVE_RUNNER_ON_EXIT:-0}"
+RUNNER_ALLOW_RUNASROOT=1
+
+export RUNNER_ALLOW_RUNASROOT
+
+log() {
+  printf '[truenas-runner] %s\n' "$*"
+}
+
+fail() {
+  printf '[truenas-runner] ERROR: %s\n' "$*" >&2
+  exit 1
+}
+
+require_env() {
+  local name="$1"
+  [[ -n "${!name:-}" ]] || fail "Missing required environment variable: ${name}"
+}
+
+ensure_docker_access() {
+  if [[ ! -S /var/run/docker.sock ]]; then
+    fail "Docker socket /var/run/docker.sock is not mounted."
+  fi
+
+  if [[ -n "${DOCKER_GID:-}" ]]; then
+    if ! getent group docker-host >/dev/null 2>&1; then
+      groupadd --gid "${DOCKER_GID}" docker-host
+    fi
+    usermod -aG docker-host runner
+  fi
+}
+
+prepare_dirs() {
+  mkdir -p "${RUNNER_HOME}" "${RUNNER_WORKDIR}" "${RUNNER_HOME}/.state" "${RUNNER_HOME}/.config"
+
+  chown -R runner:runner "${RUNNER_HOME}"
+}
+
+restore_runner_config() {
+  local file=""
+  for file in .runner .credentials .credentials_rsaparams; do
+    if [[ -f "${RUNNER_HOME}/.config/${file}" ]]; then
+      cp -f "${RUNNER_HOME}/.config/${file}" "/opt/actions-runner/${file}"
+      chown runner:runner "/opt/actions-runner/${file}"
+    else
+      rm -f "/opt/actions-runner/${file}"
+    fi
+  done
+}
+
+persist_runner_config() {
+  local file=""
+  for file in .runner .credentials .credentials_rsaparams; do
+    if [[ -f "/opt/actions-runner/${file}" ]]; then
+      cp -f "/opt/actions-runner/${file}" "${RUNNER_HOME}/.config/${file}"
+      chown runner:runner "${RUNNER_HOME}/.config/${file}"
+    fi
+  done
+}
+
+configure_runner() {
+  require_env GITHUB_REPOSITORY_URL
+
+  if [[ -f /opt/actions-runner/.runner ]]; then
+    log "Existing runner configuration detected; skipping registration."
+    return
+  fi
+
+  require_env RUNNER_TOKEN
+
+  log "Registering GitHub runner ${RUNNER_NAME} for ${GITHUB_REPOSITORY_URL}"
+
+  gosu runner /opt/actions-runner/config.sh \
+    --url "${GITHUB_REPOSITORY_URL}" \
+    --token "${RUNNER_TOKEN}" \
+    --name "${RUNNER_NAME}" \
+    --labels "${RUNNER_LABELS}" \
+    --work "${RUNNER_WORKDIR}" \
+    --unattended \
+    --replace
+}
+
+cleanup() {
+  local exit_code=$?
+
+  if [[ -n "${runner_pid:-}" ]]; then
+    kill "${runner_pid}" >/dev/null 2>&1 || true
+    wait "${runner_pid}" || true
+  fi
+
+  if [[ "${REMOVE_RUNNER_ON_EXIT}" == "1" && -n "${RUNNER_TOKEN:-}" && -f /opt/actions-runner/.runner ]]; then
+    log "Removing runner registration on exit."
+    gosu runner /opt/actions-runner/config.sh remove --token "${RUNNER_TOKEN}" || true
+  fi
+
+  exit "${exit_code}"
+}
+
+trap cleanup EXIT INT TERM
+
+ensure_docker_access
+prepare_dirs
+restore_runner_config
+configure_runner
+persist_runner_config
+
+touch "${RUNNER_HOME}/.state/configured"
+chown runner:runner "${RUNNER_HOME}/.state/configured"
+
+log "Starting runner ${RUNNER_NAME}"
+gosu runner /opt/actions-runner/run.sh &
+runner_pid=$!
+wait "${runner_pid}"

tools/truenas_github_runner/healthcheck.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+RUNNER_HOME="${RUNNER_HOME:-/runner}"
+
+test -f /opt/actions-runner/.runner
+test -f "${RUNNER_HOME}/.state/configured"
+pgrep -f "Runner.Listener" >/dev/null