github-runner
| Version | 2026.157.1917 |
| Repo | superproject |
A GitHub Actions self-hosted runner that builds CI jobs rootless inside a disposable box. Installs the pinned actions/runner release under ${HOME}/actions-runner (config.sh + run.sh, run as uid 1000) plus the CI toolchain — jq/git/go/cosign, qemu-user-static for aarch64 binfmt cross-builds, and the rootless nested container stack (podman/buildah/skopeo via container-nesting). The .NET runtime deps (icu/krb5/openssl/libunwind/lttng-ust) are declared explicitly because the runner’s installdependencies.sh has no Arch branch — so config.sh actually runs.
Services
Section titled “Services”github-runner
Acceptance plan
Section titled “Acceptance plan”This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.
| Intent | Step |
|---|---|
run |
mkdir=${HOME}/actions-runner |
run |
download=https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz |
run |
command=rh=$(getent passwd 1000 | cut -d: -f6) chown -R 1000:1000 “${rh}/actions-runner” |
run |
mkdir=${HOME}/.config/containers/registries.conf.d |
run |
write=${HOME}/.config/containers/registries.conf.d/ghcr-mirror.conf |
check |
the GitHub Actions runner is extracted under the home directory with its config.sh present |
check |
the runner’s run.sh service launcher is present |
check |
config.sh executes, proving the .NET native deps (icu/krb5/openssl/libunwind/lttng-ust) resolved on this distro |
check |
skopeo (rootless image copy) reports its version |
check |
buildah (rootless image build) reports its version |
check |
cosign (image signing) reports its version |
check |
the go toolchain used by CI jobs reports its version |
check |
the aarch64 qemu interpreter is installed so jobs can cross-build for arm64 via binfmt |
check |
the runner service process runs as the unprivileged uid 1000, never root |
check |
rootless nested podman works inside the box (no mount_too_revealing EPERM) |
check |
a CI job can actually pull and run a container image rootless |
check |
command=git –version |
check |
package=golang |
check |
package=icu |
check |
package=slirp4netns |
check |
package=libisoburn |
check |
package=cdrtools |
check |
package=swtpm |
check |
file=${HOME}/.config/containers/registries.conf.d/ghcr-mirror.conf |
check |
command=getcap /usr/bin/newuidmap |