feat: runner follow-ups — bootstrap role + latest-version resolution #4

Merged

dan-claude-bot merged 2 commits from feat/runner-bootstrap-role into main

2026-07-11 18:46:57 +00:00

dan-claude-bot commented

2026-07-11 18:36:43 +00:00

(Migrated from github.com)

What

Two follow-ups to #3 (the first commit was pushed to that branch minutes after it merged, so both ride this PR):

rig bootstrap runner — a third bootstrap role alongside control-plane|workload. It defaults --ts-tag to tag:ci and refuses tag:server (exit 2, validated before the root check): a runner executes repo-controlled code, and advertising the server tag would extend every grant your servers hold to that code. The pairing rhymes with the existing shape: bootstrap control-plane → coolify install, bootstrap runner → runner install.

runner install --version becomes optional — omitted, rig resolves the latest actions/runner release at install time by following the releases/latest redirect (no API call, no rate limit, no JSON parsing on a dependency-free box; result validated against a digits-and-dots pattern before use):

rig bootstrap runner --hostname my-ci-box
rig runner install --repo acme/widgets

This is safe here, and only here, because the runner self-updates regardless of what you install — the install-time version is a starting point, not a contract. coolify install deliberately keeps its mandatory pin: Coolify never self-updates (AUTOUPDATE=false), so its version is a verified API surface. --version remains for deterministic, auditable installs. The plan addendum in docs/plans/2026-07-11-runner-install.md records both changes.

Testing

bash test/cli.sh: 27 passed, 0 failed (the tag:server refusal, the runner role parsing through to the non-root refusal, --version needs a value replacing the retired version-required check).
shellcheck: clean at default severity.
Latest-resolution verified live: the redirect probe resolves 2.335.1 today.

🤖 Generated with Claude Code

## What Two follow-ups to #3 (the first commit was pushed to that branch minutes after it merged, so both ride this PR): **`rig bootstrap runner`** — a third bootstrap role alongside `control-plane|workload`. It defaults `--ts-tag` to `tag:ci` and **refuses `tag:server`** (exit 2, validated before the root check): a runner executes repo-controlled code, and advertising the server tag would extend every grant your servers hold to that code. The pairing rhymes with the existing shape: `bootstrap control-plane` → `coolify install`, `bootstrap runner` → `runner install`. **`runner install --version` becomes optional** — omitted, rig resolves the latest `actions/runner` release at install time by following the `releases/latest` redirect (no API call, no rate limit, no JSON parsing on a dependency-free box; result validated against a digits-and-dots pattern before use): ```sh rig bootstrap runner --hostname my-ci-box rig runner install --repo acme/widgets ``` This is safe here, and only here, because the runner **self-updates regardless** of what you install — the install-time version is a starting point, not a contract. `coolify install` deliberately keeps its mandatory pin: Coolify never self-updates (`AUTOUPDATE=false`), so its version is a verified API surface. `--version` remains for deterministic, auditable installs. The plan addendum in `docs/plans/2026-07-11-runner-install.md` records both changes. ## Testing - `bash test/cli.sh`: 27 passed, 0 failed (the `tag:server` refusal, the `runner` role parsing through to the non-root refusal, `--version needs a value` replacing the retired version-required check). - `shellcheck`: clean at default severity. - Latest-resolution verified live: the redirect probe resolves `2.335.1` today. 🤖 Generated with [Claude Code](https://claude.com/claude-code)