A Forgejo Actions Runner, Registered By Shared Secret

forgejo-runner

Forgejo Runner from the vendor's release: a hardened unit that takes jobs from your Forgejo, registered the way Forgejo now asks for - a shared secret, and a connection in the runner's config.yml - rather than through the register command that 13.2 deprecates. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no forgejo-runner; Forgejo publishes each release with a SHA-256 file beside it. The role downloads both and has Ansible's get_url refuse the binary unless it matches, then installs it as root's in /usr/local/bin, pinned by forgejo_runner_version.

Registered without the deprecated commands. In 13.2 forgejo-runner register and create-runner-file both say "(deprecated)". The role makes a secret of 40 hexadecimal characters once, registers it on the Forgejo host with forgejo forgejo-cli actions register - delegated to forgejo_runner_forgejo_host, as Forgejo's own user, the secret on stdin and never in a command line - and writes the connection into config.yml: Forgejo's URL, the UUID Forgejo derives from the secret, and the path of the token file, so config.yml holds no secret. Two details are measured, not guessed: the token is the whole secret (the part after the identifier is refused as "unregistered runner"), and a trailing newline on stdin makes it 41 characters, which Forgejo refuses. Registering the same secret again updates the runner's name and labels in place, so the role does it on every run. No .runner file is written. A runner made in Forgejo's web interface works too: give its UUID and token instead, with forgejo_runner_register: false.

A host runner is a door into this host. A job on a host label runs on this machine as forgejo-runner, inside the unit's sandbox: the live test's job sees /home hidden, a /tmp of its own, a world-writable directory elsewhere read-only, and no new privileges - and with the sandbox removed, all four flip (measured both ways). What the sandbox cannot hide is the runner's own token: the daemon reads it as that user, so a job can read it too (measured). Anyone who can push a workflow to a repository this runner serves can therefore act as the runner. Scope it to an owner or a repository you trust (forgejo_runner_scope), or keep the instance's accounts to people you would give a shell on this host. systemd's LoadCredential= would hand the token to that same user, so a job could read it there as well; it also could not be opened in the container this role is tested in (measured).

What a failure looks like. With a wrong token or an unreachable Forgejo at start, the runner exits and systemd restarts it (both measured). The role watches for one steady process, so it fails the run instead of reporting a runner that never connects (measured with a token Forgejo does not know). Once the runner is registered, a Forgejo outage only makes it log fetch errors and keep polling; it is idle again when Forgejo is back (measured).

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.