feat(runner): add a Forgejo runner deploy kit #116

Open

nsaspy wants to merge 1 commit from feat/runner-deploy-kit into main

nsaspy commented

2026-09-06 18:27:53 +00:00

Owner

What changed

scripts/forgejo-runner/ packages the runner setup that came out of the CI outage:

config.template.yml - authoritative runner config: labels for the nix-ci host lane and the android-ci docker lane, capacity: 1, timeout: 3h, cache on.
deploy.sh - renders the config into a state dir, registers a repository-scoped runner, installs a systemd --user unit, and only reports success after the runner declared its labels to the instance.
docs/forgejo-runner-deploy.md - runbook: deploy commands, lane table, sandboxing and scaling rules.
DOX: scripts/AGENTS.md owns the kit, docs/AGENTS.md indexes the runbook; .github/AGENTS.md gains the Forgejo CI contracts learned during the outage (mirror gaps, token semantics, artifact limits).

Why

Two production failure modes: a user-scoped runner registration never received dispatched tasks, and label/timeout/capacity misconfiguration let concurrent builds cancel every job on the docker runner. The kit encodes the working configuration so runners can be deployed on any host reproducibly.

Verification

bash -n deploy.sh
rendered config parses (PyYAML assertions + forgejo-runner daemon loads it)
rendered unit passes systemd-analyze verify
argument error paths fail with actionable messages
local deploy on this host (previous session) registered, declared labels, and executed CI jobs

Deploy is operator-run by design: merge, then follow docs/forgejo-runner-deploy.md on the target host.

## What changed `scripts/forgejo-runner/` packages the runner setup that came out of the CI outage: - `config.template.yml` - authoritative runner config: labels for the `nix-ci` host lane and the `android-ci` docker lane, `capacity: 1`, `timeout: 3h`, cache on. - `deploy.sh` - renders the config into a state dir, registers a **repository-scoped** runner, installs a `systemd --user` unit, and only reports success after the runner declared its labels to the instance. - `docs/forgejo-runner-deploy.md` - runbook: deploy commands, lane table, sandboxing and scaling rules. - DOX: `scripts/AGENTS.md` owns the kit, `docs/AGENTS.md` indexes the runbook; `.github/AGENTS.md` gains the Forgejo CI contracts learned during the outage (mirror gaps, token semantics, artifact limits). ## Why Two production failure modes: a user-scoped runner registration never received dispatched tasks, and label/timeout/capacity misconfiguration let concurrent builds cancel every job on the docker runner. The kit encodes the working configuration so runners can be deployed on any host reproducibly. ## Verification - `bash -n deploy.sh` - rendered config parses (PyYAML assertions + `forgejo-runner daemon` loads it) - rendered unit passes `systemd-analyze verify` - argument error paths fail with actionable messages - local deploy on this host (previous session) registered, declared labels, and executed CI jobs Deploy is operator-run by design: merge, then follow `docs/forgejo-runner-deploy.md` on the target host.

nsaspy added 1 commit

2026-09-06 18:27:53 +00:00

feat(runner): add a Forgejo runner deploy kit 9321559cc5

Production incidents from the CI outage showed two ways a runner ends
up idle while jobs wait forever: user-scoped registrations never get
tasks dispatched, and label/timeout/capacity misconfiguration made the
docker runner cancel every job under load.

scripts/forgejo-runner/ packages the working setup:

- config.template.yml: repo-scoped runner defaults (labels for the
  nix-ci host lane and the android-ci docker lane, capacity 1,
  3h timeout, cache on).
- deploy.sh: renders the config, registers with the REPOSITORY
  registration token, installs a systemd --user unit, and verifies the
  runner declared itself before reporting success.
- docs/forgejo-runner-deploy.md: runbook covering the lanes, the
  host-vs-docker sandboxing constraint, and scaling rules.

Verified: bash -n, rendered config parses (yaml + forgejo-runner
daemon), rendered unit passes systemd-analyze verify, argument error
paths fail with actionable messages.

mara referenced this pull request

2026-09-08 01:14:10 +00:00

[P1] Scheduled runs need hard deadlines, restart recovery, and terminal-result validation #108

This pull request has changes conflicting with the target branch.

scripts/AGENTS.md

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'feat(runner): add a Forgejo runner deploy kit' (#116) from feat/runner-deploy-kit into main

Merge commit body

Reviewed-on: https://git.starintel.actor/nsaspy/a0-symbolics/pulls/116

Merge pull request 'feat(runner): add a Forgejo runner deploy kit' (#116) from feat/runner-deploy-kit into main

Reviewed-on: https://git.starintel.actor/nsaspy/a0-symbolics/pulls/116

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/runner-deploy-kit:feat/runner-deploy-kit

git switch feat/runner-deploy-kit

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff feat/runner-deploy-kit

git switch feat/runner-deploy-kit

git rebase main

git switch main

git merge --ff-only feat/runner-deploy-kit

git switch feat/runner-deploy-kit

git rebase main

git switch main

git merge --no-ff feat/runner-deploy-kit

git switch main

git merge --squash feat/runner-deploy-kit