github-runner

Repo	box/github.com/opencharly/pod-github-runner:v2026.279.0028

A GitHub Actions self-hosted runner that builds CI jobs rootless inside a disposable box. Installs the pinned actions/runner release under ${HOME}/actions-runner (config.sh + run.sh, run as uid 1000) plus the CI toolchain — jq/git/go/cosign, qemu-user-static for aarch64 binfmt cross-builds, and the rootless nested container stack (podman/buildah/skopeo via container-nesting). The .NET runtime deps (icu/krb5/openssl/libunwind/lttng-ust) are declared explicitly because the runner’s installdependencies.sh has no Arch branch — so config.sh actually runs.

Services

• github-runner

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
run	mkdir=${HOME}/actions-runner
run	download=https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz
run	command=rh=$(getent passwd 1000 | cut -d: -f6) chown -R 1000:1000 “${rh}/actions-runner”
run	mkdir=${HOME}/.config/containers/registries.conf.d
run	write=${HOME}/.config/containers/registries.conf.d/ghcr-mirror.conf
check	the GitHub Actions runner is extracted under the home directory with its config.sh present
check	the runner’s run.sh service launcher is present
check	config.sh executes, proving the .NET native deps (icu/krb5/openssl/libunwind/lttng-ust) resolved on this distro
check	skopeo (rootless image copy) reports its version
check	buildah (rootless image build) reports its version
check	cosign (image signing) reports its version
check	the go toolchain used by CI jobs reports its version
check	the aarch64 qemu interpreter is installed so jobs can cross-build for arm64 via binfmt
check	the runner service process runs as the unprivileged uid 1000, never root
check	rootless nested podman works inside the box (no mount_too_revealing EPERM)
check	a CI job can actually pull and run a container image rootless
check	command=git –version
check	package=golang
check	package=icu
check	package=slirp4netns
check	package=libisoburn
check	package=cdrtools
check	package=swtpm
check	file=${HOME}/.config/containers/registries.conf.d/ghcr-mirror.conf
check	command=getcap /usr/bin/newuidmap
check	hostname(1) resolves on PATH, so charly’s venue tests can prove a peer ran host-locally
check	package=inetutils
check	package=tree
check	package=shellcheck
check	package=shfmt
check	package=actionlint
check	package=golangci-lint
check	package=nodejs
check	package=npm
check	package=python-pip
check	package=uv
check	package=cmake
check	package=unzip
check	package=zip
check	package=7zip
check	package=wget
check	package=rsync
check	package=yq
check	package=ripgrep
check	package=moreutils
check	package=bc
check	package=less
check	package=lsof
check	package=strace
check	package=openbsd-netcat
check	package=bind
check	the container’s job environment runs with a UTF-8 locale, not the base image’s ASCII POSIX default
check	TZ is set explicitly, so job-log timestamps do not depend on the base image’s /etc/localtime