hla_framework_bd/docs/developer/cicd_runner.md

CI/CD Runner

Hosts

• sls-vserv-bd-01(-dev)
  • Runs shellbox commands (and ioc install ...?)
• sls-vserv-bd-hla01(-dev)
  • Runs everything else

Setup

Resources:

• https://docs.gitea.com/usage/actions/act-runner
• https://linux.psi.ch/documentation/services/gitea/gitea-runner/

Register the runner: (by default the name is the machine name sls-vserv-bd-hla01-dev.psi.ch)

sudo su svcusr-sls2hla
mkdir ~/gitea-runner
cd ~/gitea-runner
/usr/local/bin/act_runner register --instance https://gitea.psi.ch/ --labels hla-dev --token <token> --no-interactive

Note, if you use a systemd service with a config file as in the example below, the labels will be read from that file.

This generates a .runner file.

Set up deployment dirs (not directly related to the gitea cicd runner setup)

mkdir /sls/bd/hla
chmod 755 /sls/bd/hla
...

Install Node -- required for actions like repo checkout

mkdir ~/.local/bin

cd /tmp
curl -LO https://nodejs.org/dist/v20.11.1/node-v20.11.1-linux-x64.tar.xz
tar -xf node-v20.11.1-linux-x64.tar.xz --strip-components=2 -C ~/.local/bin/ node-v20.11.1-linux-x64/bin/
rm node-v20.11.1-linux-x64.tar.xz

Manually run the runner

sudo su svcusr-sls2hla
/usr/local/bin/act_runner daemon

Run the runner as a systemd service

Edit the service file /etc/systemd/system/act_runner.service:

[Unit]
ConditionPathExists=/etc/act_runner/config.yaml
Description=Gitea Actions runner
Documentation=https://gitea.com/gitea/act_runner
After=podman.socket
Requires=podman.socket

[Service]
User=svcusr-sls2hla
WorkingDirectory=/home/svcusr-sls2hla/gitea-runner
Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/svcusr-sls2hla/.local/bin"
ExecStart=/usr/local/bin/act_runner daemon --config /etc/act_runner/config.yaml
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=10
Restart=always

[Install]
WantedBy=multi-user.target

As your own user (not svcusr-sls2hla; need access to sudo):

# 1. Install Podman
sudo dnf install -y podman

# 2. Enable and start the system-wide Podman socket
sudo systemctl enable --now podman.socket

# 3. Create the symlink so the Gitea runner finds Podman at the expected Docker path
sudo ln -s /run/podman/podman.sock /var/run/docker.sock

# 4. Create podman group
sudo groupadd podman

# 5. Add service user to this new group
sudo usermod -aG podman svcusr-sls2hla

Configure podman socket:

sudo systemctl edit podman.socket

add this to the file:

[Socket]
SocketMode=0660
SocketGroup=podman

Created uv cache dir, for UV_CACHE_DIR:

sudo mkdir -m 777 /var/cache/uv

Change the location of the act cache and working directory (uv .venvs are built here, take up lots of space)

sudo mkdir -m 777 /var/lib/act_runner/cache
sudo mkdir -m 777 /var/lib/act_runner/work

and edit /etc/act_runner/config.yaml

cache:
  dir: "/var/lib/act_runner/cache"
host:
  # The parent directory of a job's working directory.
  # If it's empty, $HOME/.cache/act/ will be used.
  workdir_parent: "/var/lib/act_runner/work"

Configure the runner labels: (edit /etc/act_runner/config.yaml)

runner:
  labels:
    - "hla-dev"

Enable and restart:

# Enable act_runner
sudo systemctl enable --now act_runner

# Reload configurations
sudo systemctl daemon-reload

# Restart the socket so it applies the new group owner
sudo systemctl restart podman.socket

# Fire up the runner
sudo systemctl restart act_runner.service

Check logs of systemd service

sudo su svcusr-sls2hla
journalctl -u act_runner.service -n 20

Should show

Jul 24 10:05:30 sls-vserv-bd-hla01-dev.psi.ch act_runner[3662214]: time="2026-07-24T10:05:30+02:00" level=info msg="Starting runner daemon"
Jul 24 10:05:30 sls-vserv-bd-hla01-dev.psi.ch act_runner[3662214]: time="2026-07-24T10:05:30+02:00" level=info msg="labels updated to: [hla-dev:host]"
Jul 24 10:05:30 sls-vserv-bd-hla01-dev.psi.ch act_runner[3662214]: time="2026-07-24T10:05:30+02:00" level=info msg="runner: sls-vserv-bd-hla01-dev.psi.ch, with version: v2.0.0, with labels: [hla-dev], declare successfully"
...

User

The gitea actions run as user svcusr-sls2hla

Auth

#TODO: this is a temporary workaround

I created an ssh key on sls-vserv-bd-hla01-dev (where the runner runs), and added the public key to my gitea profile ssh keys. That way the svcusr can clone the repos I can clone.