hla_framework_bd/docs/cicd_runner.md

CI/CD Runner

Host

TODO: Should we have a dedicated runner server?

sls-vserv-bd-01-dev

Setup

Resources:

• https://docs.gitea.com/usage/actions/act-runner
• https://linux.psi.ch/documentation/services/gitea/gitea-runner/

TODO: add commands we ran with Basil in the meeting TODO: need to regenerate ~/gitea-runner/.runner with correct label hla-dev

<install command>
sudo su svcusr-sls2hla
...

mkdir ~/.local/bin

# Install Node -- required for actions like repo checkout
cd /tmp
curl -LO https://nodejs.org/dist/v20.11.1/node-v20.11.1-linux-x64.tar.xz
tar -xf node-v20.11.1-linux-x64.tar.xz --strip-components=2 -C ~/.local/bin/ node-v20.11.1-linux-x64/bin/
rm node-v20.11.1-linux-x64.tar.xz

Manually run the runner

sudo su svcusr-sls2hla
/usr/local/bin/act_runner daemon

Run the runner as a systemd service

Edit the service file /etc/systemd/system/act_runner.service:

[Unit]
ConditionPathExists=/etc/act_runner/config.yaml
Description=Gitea Actions runner
Documentation=https://gitea.com/gitea/act_runner
After=podman.socket
Requires=podman.socket

[Service]
User=svcusr-sls2hla
WorkingDirectory=/home/svcusr-sls2hla/gitea-runner
ExecStart=/usr/local/bin/act_runner daemon --config /etc/act_runner/config.yaml
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=10
Restart=always

[Install]
WantedBy=multi-user.target

As your own user (not svcusr-sls2hla; need access to sudo):

# 1. Install Podman
sudo dnf install -y podman

# 2. Enable and start the system-wide Podman socket
sudo systemctl enable --now podman.socket

# 3. Create the symlink so the Gitea runner finds Podman at the expected Docker path
sudo ln -s /run/podman/podman.sock /var/run/docker.sock

# 4. Create podman group
sudo groupadd podman

# 5. Add service user to this new group
sudo usermod -aG podman svcusr-sls2hla

Configure podman socket:

sudo systemctl edit podman.socket

add this to the file:

[Socket]
SocketMode=0660
SocketGroup=podman

Enable and restart:

# Enable act_runner
sudo systemctl enable --now act_runner

# Reload configurations
sudo systemctl daemon-reload

# Restart the socket so it applies the new group owner
sudo systemctl restart podman.socket

# Fire up the runner
sudo systemctl restart act_runner.service

Check logs of systemd service

sudo su svcusr-sls2hla
journalctl -u act_runner.service -n 20

User

The gitea actions run as user svcusr-sls2hla

Auth

#TODO: this is a temporary workaround

I created an ssh key on sls-vserv-bd-hla01-dev (where the runner runs), and added the public key to my gitea profile ssh keys. That way the svcusr can clone the repos I can clone.