Special the release tag signing sub key (#121)

Reviewed-on: https://gitea.com/gitea/act_runner/pulls/121

.gitea/workflows/release-tag.yml

@@ -0,0 +1,41 @@
+name: goreleaser
+
+on: 
+  push:
+    tags:
+      - '*'
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - run: git fetch --force --tags
+      - uses: actions/setup-go@v3
+        with:
+          go-version: '>=1.20.1'
+      - name: Import GPG key
+        id: import_gpg
+        uses: https://github.com/crazy-max/ghaction-import-gpg@v5
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.PASSPHRASE }}
+          fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
+      - name: goreleaser
+        uses: https://github.com/goreleaser/goreleaser-action@v4
+        with:
+            distribution: goreleaser-pro
+            version: latest
+            args: release
+        env:
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          AWS_REGION: ${{ secrets.AWS_REGION }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          S3_REGION: ${{ secrets.AWS_REGION }}
+          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
+          GORELEASER_FORCE_TOKEN: 'gitea'
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.goreleaser.yaml

@@ -103,5 +103,9 @@ snapshot:
 nightly:
   name_template: "{{ .Branch }}"
 
+gitea_urls:
+  api: https://gitea.com/api/v1
+  download: https://gitea.com
+
 # yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
 # vim: set ts=2 sw=2 tw=0 fo=cnqoj

Dockerfile

@@ -0,0 +1,17 @@
+FROM golang:alpine as builder
+RUN apk add --update-cache make git
+
+COPY . /opt/src/act_runner
+WORKDIR /opt/src/act_runner
+
+RUN make clean && make build
+
+FROM alpine as runner
+RUN apk add --update-cache \
+    git bash \
+    && rm -rf /var/cache/apk/*
+
+COPY --from=builder /opt/src/act_runner/act_runner /usr/local/bin/act_runner
+COPY run.sh /opt/act/run.sh
+
+ENTRYPOINT ["/opt/act/run.sh"]

Makefile

@@ -16,6 +16,10 @@ WINDOWS_ARCHS ?= windows/amd64
 GO_FMT_FILES := $(shell find . -type f -name "*.go" ! -name "generated.*")
 GOFILES := $(shell find . -type f -name "*.go" -o -name "go.mod" ! -name "generated.*")
 
+DOCKER_IMAGE ?= gitea/act_runner
+DOCKER_TAG ?= nightly
+DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)
+
 ifneq ($(shell uname), Darwin)
 	EXTLDFLAGS = -extldflags "-static" $(null)
 else
@@ -156,6 +160,10 @@ release-check: | $(DIST_DIRS)
 release-compress: | $(DIST_DIRS)
 	cd $(DIST)/release/; for file in `find . -type f -name "*"`; do echo "compressing $${file}" && $(GO) run $(GXZ_PAGAGE) -k -9 $${file}; done;
 
+.PHONY: docker
+docker:
+	docker build --disable-content-trust=false -t $(DOCKER_REF) .
+
 clean:
 	$(GO) clean -x -i ./...
 	rm -rf coverage.txt $(EXECUTABLE) $(DIST)

README.md

@@ -6,7 +6,7 @@ Act runner is a runner for Gitea based on [Gitea fork](https://gitea.com/gitea/a
 
 ### Prerequisites
 
-Docker Engine Community version is required. To install Docker CE, follow the official [install instructions](https://docs.docker.com/engine/install/).
+Docker Engine Community version is required for docker mode. To install Docker CE, follow the official [install instructions](https://docs.docker.com/engine/install/).
 
 ### Download pre-built binary
 
@@ -18,6 +18,12 @@ Visit https://dl.gitea.com/act_runner/ and download the right version for your p
 make build
 ```
 
+### Build a docker image
+
+```bash
+make docker
+```
+
 ## Quickstart
 
 ### Register
@@ -66,7 +72,6 @@ If the registry succeed, it will run immediately. Next time, you could run the r
 ./act_runner daemon
 ```
 
-
 ### Configuration
 
 You can also configure the runner with a configuration file.
@@ -82,3 +87,9 @@ You can specify the configuration file path with `-c`/`--config` argument.
 ./act_runner -c config.yaml register # register with config file
 ./act_runner -c config.yaml deamon # run with config file
 ```
+
+### Run a docker container
+
+```sh
+docker run -e GITEA_INSTANCE_URL=http://192.168.8.18:3000 -e GITEA_RUNNER_REGISTRATION_TOKEN=<runner_token> -v /var/run/docker.sock:/var/run/docker.sock --name my_runner gitea/act_runner:nightly
+```

internal/app/cmd/exec.go

@@ -48,6 +48,7 @@ type executeArgs struct {
 	useGitIgnore          bool
 	containerCapAdd       []string
 	containerCapDrop      []string
+	containerOptions      string
 	artifactServerPath    string
 	artifactServerAddr    string
 	artifactServerPort    string
@@ -375,6 +376,7 @@ func runExec(ctx context.Context, execArgs *executeArgs) func(cmd *cobra.Command
 			// GitHubInstance:        t.client.Address(),
 			ContainerCapAdd:    execArgs.containerCapAdd,
 			ContainerCapDrop:   execArgs.containerCapDrop,
+			ContainerOptions:   execArgs.containerOptions,
 			AutoRemove:         true,
 			ArtifactServerPath: execArgs.artifactServerPath,
 			ArtifactServerPort: execArgs.artifactServerPort,
@@ -456,6 +458,7 @@ func loadExecCmd(ctx context.Context) *cobra.Command {
 	execCmd.Flags().BoolVar(&execArg.useGitIgnore, "use-gitignore", true, "Controls whether paths specified in .gitignore should be copied into container")
 	execCmd.Flags().StringArrayVarP(&execArg.containerCapAdd, "container-cap-add", "", []string{}, "kernel capabilities to add to the workflow containers (e.g. --container-cap-add SYS_PTRACE)")
 	execCmd.Flags().StringArrayVarP(&execArg.containerCapDrop, "container-cap-drop", "", []string{}, "kernel capabilities to remove from the workflow containers (e.g. --container-cap-drop SYS_PTRACE)")
+	execCmd.Flags().StringVarP(&execArg.containerOptions, "container-opts", "", "", "container options")
 	execCmd.PersistentFlags().StringVarP(&execArg.artifactServerPath, "artifact-server-path", "", ".", "Defines the path where the artifact server stores uploads and retrieves downloads from. If not specified the artifact server will not start.")
 	execCmd.PersistentFlags().StringVarP(&execArg.artifactServerPort, "artifact-server-port", "", "34567", "Defines the port where the artifact server listens (will only bind to localhost).")
 	execCmd.PersistentFlags().StringVarP(&execArg.defaultActionsUrl, "default-actions-url", "", "https://gitea.com", "Defines the default url of action instance.")

internal/app/poll/poller.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"sync"
-	"time"
 
 	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/bufbuild/connect-go"
@@ -20,23 +19,23 @@ import (
 )
 
 type Poller struct {
-	client   client.Client
+	client client.Client
-	runner   *run.Runner
+	runner *run.Runner
-	capacity int
+	cfg    *config.Config
 }
 
 func New(cfg *config.Config, client client.Client, runner *run.Runner) *Poller {
 	return &Poller{
-		client:   client,
+		client: client,
-		runner:   runner,
+		runner: runner,
-		capacity: cfg.Runner.Capacity,
+		cfg:    cfg,
 	}
 }
 
 func (p *Poller) Poll(ctx context.Context) {
-	limiter := rate.NewLimiter(rate.Every(2*time.Second), 1)
+	limiter := rate.NewLimiter(rate.Every(p.cfg.Runner.FetchInterval), 1)
 	wg := &sync.WaitGroup{}
-	for i := 0; i < p.capacity; i++ {
+	for i := 0; i < p.cfg.Runner.Capacity; i++ {
 		wg.Add(1)
 		go p.poll(ctx, wg, limiter)
 	}
@@ -63,7 +62,7 @@ func (p *Poller) poll(ctx context.Context, wg *sync.WaitGroup, limiter *rate.Lim
 }
 
 func (p *Poller) fetchTask(ctx context.Context) (*runnerv1.Task, bool) {
-	reqCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	reqCtx, cancel := context.WithTimeout(ctx, p.cfg.Runner.FetchTimeout)
 	defer cancel()
 
 	resp, err := p.client.FetchTask(reqCtx, connect.NewRequest(&runnerv1.FetchTaskRequest{}))
@@ -75,7 +74,7 @@ func (p *Poller) fetchTask(ctx context.Context) (*runnerv1.Task, bool) {
 		return nil, false
 	}
 
-	if resp.Msg.Task == nil {
+	if resp == nil || resp.Msg == nil || resp.Msg.Task == nil {
 		return nil, false
 	}
 	return resp.Msg.Task, true

internal/app/run/runner.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -60,6 +61,14 @@ func NewRunner(cfg *config.Config, reg *config.Registration, cli client.Client)
 		}
 	}
 
+	// set artifact gitea api
+	artifactGiteaAPI := strings.TrimSuffix(cli.Address(), "/") + "/api/actions_pipeline/"
+	envs["ACTIONS_RUNTIME_URL"] = artifactGiteaAPI
+
+	// Set specific environments to distinguish between Gitea and GitHub
+	envs["GITEA_ACTIONS"] = "true"
+	envs["GITEA_ACTIONS_RUNNER_VERSION"] = ver.Version()
+
 	return &Runner{
 		name:   reg.Name,
 		cfg:    cfg,
@@ -149,6 +158,9 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		preset.Token = t
 	}
 
+	// use task token to action api token
+	r.envs["ACTIONS_RUNTIME_TOKEN"] = preset.Token
+
 	eventJSON, err := json.Marshal(preset.Event)
 	if err != nil {
 		return err
@@ -180,6 +192,8 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		ContainerNamePrefix:   fmt.Sprintf("GITEA-ACTIONS-TASK-%d", task.Id),
 		ContainerMaxLifetime:  maxLifetime,
 		ContainerNetworkMode:  r.cfg.Container.NetworkMode,
+		ContainerOptions:      r.cfg.Container.Options,
+		Privileged:            r.cfg.Container.Privileged,
 		DefaultActionInstance: taskContext["gitea_default_actions_url"].GetStringValue(),
 		PlatformPicker:        r.labels.PickPlatform,
 	}

internal/pkg/config/config.example.yaml

@@ -22,6 +22,10 @@ runner:
   timeout: 3h
   # Whether skip verifying the TLS certificate of the Gitea instance.
   insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
 
 cache:
   # Enable cache server to use actions/cache.
@@ -40,3 +44,7 @@ cache:
 container:
   # Which network to use for the job containers. Could be bridge, host, none, or the name of a custom network.
   network_mode: bridge
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options:

internal/pkg/config/config.go

@@ -18,12 +18,14 @@ type Config struct {
 		Level string `yaml:"level"`
 	} `yaml:"log"`
 	Runner struct {
-		File     string            `yaml:"file"`
+		File          string            `yaml:"file"`
-		Capacity int               `yaml:"capacity"`
+		Capacity      int               `yaml:"capacity"`
-		Envs     map[string]string `yaml:"envs"`
+		Envs          map[string]string `yaml:"envs"`
-		EnvFile  string            `yaml:"env_file"`
+		EnvFile       string            `yaml:"env_file"`
-		Timeout  time.Duration     `yaml:"timeout"`
+		Timeout       time.Duration     `yaml:"timeout"`
-		Insecure bool              `yaml:"insecure"`
+		Insecure      bool              `yaml:"insecure"`
+		FetchTimeout  time.Duration     `yaml:"fetch_timeout"`
+		FetchInterval time.Duration     `yaml:"fetch_interval"`
 	} `yaml:"runner"`
 	Cache struct {
 		Enabled *bool  `yaml:"enabled"` // pointer to distinguish between false and not set, and it will be true if not set
@@ -33,7 +35,9 @@ type Config struct {
 	} `yaml:"cache"`
 	Container struct {
 		NetworkMode string `yaml:"network_mode"`
-	}
+		Privileged  bool   `yaml:"privileged"`
+		Options     string `yaml:"options"`
+	} `yaml:"container"`
 }
 
 // LoadDefault returns the default configuration.
@@ -90,6 +94,12 @@ func LoadDefault(file string) (*Config, error) {
 	if cfg.Container.NetworkMode == "" {
 		cfg.Container.NetworkMode = "bridge"
 	}
+	if cfg.Runner.FetchTimeout <= 0 {
+		cfg.Runner.FetchTimeout = 5 * time.Second
+	}
+	if cfg.Runner.FetchInterval <= 0 {
+		cfg.Runner.FetchInterval = 2 * time.Second
+	}
 
 	return cfg, nil
 }

run.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+if [[ ! -d /data ]]; then
+  mkdir -p /data
+fi
+
+cd /data
+
+CONFIG_ARG=""
+if [[ ! -z "${CONFIG_FILE}" ]]; then
+  CONFIG_ARG="--config ${CONFIG_FILE}"
+fi
+
+# Use the same ENV variable names as https://github.com/vegardit/docker-gitea-act-runner
+
+if [[ ! -s .runner ]]; then
+  try=$((try + 1))
+  success=0
+
+  # The point of this loop is to make it simple, when running both act_runner and gitea in docker,
+  # for the act_runner to wait a moment for gitea to become available before erroring out.  Within
+  # the context of a single docker-compose, something similar could be done via healthchecks, but
+  # this is more flexible.
+  while [[ $success -eq 0 ]] && [[ $try -lt ${GITEA_MAX_REG_ATTEMPTS:-10} ]]; do
+    act_runner register \
+      --instance "${GITEA_INSTANCE_URL}" \
+      --token    "${GITEA_RUNNER_REGISTRATION_TOKEN}" \
+      --name     "${GITEA_RUNNER_NAME:-`hostname`}" \
+      --labels   "${GITEA_RUNNER_LABELS}" \
+      ${CONFIG_ARG} --no-interactive > /tmp/reg.log 2>&1
+
+    cat /tmp/reg.log
+
+    cat /tmp/reg.log | grep 'Runner registered successfully' > /dev/null
+    if [[ $? -eq 0 ]]; then
+      echo "SUCCESS"
+      success=1
+    else
+      echo "Waiting to retry ..."
+      sleep 5
+    fi
+  done
+fi
+
+act_runner daemon ${CONFIG_ARG}