cluade-reviewer-andresmgsl
903d8371b3
rig's CI story was GitHub-shaped end to end. This makes it work against a self-hosted Forgejo, in three pieces. The registry fetch becomes forge-aware. templates_resolve hardcoded three github.com archive URLs; RIG_TEMPLATES_HOST now selects the grammar, because the forges genuinely differ — GitHub serves refs/tags, refs/heads and bare paths, Forgejo serves exactly one, and emitting the other two there would mean two guaranteed 404s per fetch and a failure message listing URLs that never could have worked. Measured against forgejo.heavyduty.builders, not inferred. The default stays GitHub, so every existing caller is unchanged. install.sh's snapshot reads the same variable through a byte-identical copy of the builder, diffed by the tests: a snapshot cached from a forge converge would never fetch from is worse than no snapshot, and the pin-in-the-name staleness guard cannot catch a wrong-ORIGIN snapshot, only an old one. ci-box is a tenant, not a machine role. The topology is a fleet machine hosting boxes, one of which runs CI — a '-box' guest by rig's own family rule. That also deletes the docker-in-docker layer the usual setup needs: bootstrap-tenant.sh already installs Docker and adds the tenant user to the group, and the isolation a privileged dind sidecar buys is already paid for by a box that is network-isolated, inbound-less and disposable. rig runner install refuses Docker for good reason — it converges a MACHINE, where the blast radius is the machine. Here it is a guest that gets thrown away. rig forgejo-runner is a new family beside rig runner, which is untouched. Forgejo registers against an INSTANCE and the token carries the scope, so there is no --repo to converge toward and nothing to compare; folding that into one command would make every guard bimodal to share a flag name while the contract underneath differs. assert_runner_instance asks the same trust-boundary question about the axis Forgejo actually has. There is no repoint and no --local, and both absences are explained where an operator arriving from the GitHub sibling will hit them. Forgejo's .runner holds the runner's own long-lived token, unlike GitHub's, so it is installed 0600 and the mode is re-asserted on every converge — a mode that drifted leaks the secret silently, since nothing fails and the runner keeps working. status reports it and never prints the token. Both downloads verify the published .sha256 before installing: this binary lands as root and is executed by a systemd unit. bootstrap --undo learns the guard for the same hazard on the other forge, and it matters more here — Forgejo has no deregistration endpoint, so the ghost it would strand has to be deleted by hand. Known prerequisite, documented rather than assumed: the fetch is unauthenticated by contract, and a Forgejo with REQUIRE_SIGNIN_VIEW=true answers 404 for repos it reports as public. Hosting a registry there needs FORGEJO__service__REQUIRE_SIGNIN_VIEW=false. The refusal names that case, because it is indistinguishable from a wrong ref. forgejo#109 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
91 lines
3.5 KiB
Bash
Executable file
91 lines
3.5 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# rig forgejo-runner status — what is this box's Forgejo runner registered to?
|
|
# Read-only: reports what is already on the box. No credential, no network call.
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"
|
|
# shellcheck source=SCRIPTDIR/lib/forgejo-runner-config.sh
|
|
. "$HERE/lib/forgejo-runner-config.sh"
|
|
|
|
log() { printf 'rig-forgejo-runner: %s\n' "$*"; }
|
|
warn() { printf 'rig-forgejo-runner: WARNING: %s\n' "$*" >&2; }
|
|
die() { printf 'rig-forgejo-runner: ERROR: %s\n' "$1" >&2; exit "${2:-1}"; }
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
usage: rig forgejo-runner status [--user <name>]
|
|
|
|
--user <name> unprivileged service user (default: the tenant user `ci`
|
|
when it exists, else forgejo-runner)
|
|
|
|
Prints the Forgejo instance this box's runner is registered to, its runner
|
|
name, the labels rig recorded when it registered, the install directory, and
|
|
the systemd unit and its state.
|
|
|
|
Reads only the runner's own on-disk config — no token, no network call. The
|
|
registration secret that config holds is never printed. Exits 1 when no runner
|
|
is installed.
|
|
EOF
|
|
}
|
|
|
|
# --- args (validated before the root check, so errors are testable) ---------
|
|
RUNNER_USER=""
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--user)
|
|
[ $# -ge 2 ] || die "--user needs a value" 2
|
|
RUNNER_USER="$2"; shift 2 ;;
|
|
-h|--help) usage; exit 0 ;;
|
|
*) die "unknown flag: $1" 2 ;;
|
|
esac
|
|
done
|
|
|
|
if [ -z "$RUNNER_USER" ]; then
|
|
if id -u ci >/dev/null 2>&1; then RUNNER_USER="ci"; else RUNNER_USER="forgejo-runner"; fi
|
|
fi
|
|
|
|
# --- validation ------------------------------------------------------------
|
|
[ "$RUNNER_USER" != "root" ] || die "runner user must not be root" 2
|
|
|
|
# --- guards ----------------------------------------------------------------
|
|
[ "$(id -u)" -eq 0 ] || die "must run as root"
|
|
|
|
id -u "$RUNNER_USER" >/dev/null 2>&1 \
|
|
|| die "no runner installed (no ${RUNNER_USER} user on this box)"
|
|
USER_HOME="$(getent passwd "$RUNNER_USER" | cut -d: -f6)"
|
|
RUNNER_DIR="$USER_HOME/forgejo-runner"
|
|
[ -e "$RUNNER_DIR/.runner" ] \
|
|
|| die "no runner registered in ${RUNNER_DIR}"
|
|
|
|
# --- read the runner's own config -------------------------------------------
|
|
INSTANCE="$(forgejo_runner_instance "$RUNNER_DIR")"
|
|
RUNNER_NAME="$(forgejo_runner_name "$RUNNER_DIR")"
|
|
|
|
if [ -r "$RUNNER_DIR/.rig-labels" ]; then
|
|
LABELS="$(cat "$RUNNER_DIR/.rig-labels")"
|
|
else
|
|
LABELS="(not recorded on this box — see the instance's Actions > Runners)"
|
|
fi
|
|
|
|
UNIT=/etc/systemd/system/forgejo-runner.service
|
|
if [ -e "$UNIT" ]; then
|
|
STATE="$(systemctl is-active forgejo-runner 2>/dev/null || true)"
|
|
SERVICE="forgejo-runner.service (${STATE:-unknown})"
|
|
else
|
|
SERVICE="(not installed as a service)"
|
|
fi
|
|
|
|
log "instance: ${INSTANCE:-unknown}"
|
|
log "name: ${RUNNER_NAME:-unknown}"
|
|
log "labels: ${LABELS}"
|
|
log "dir: ${RUNNER_DIR}"
|
|
log "service: ${SERVICE}"
|
|
|
|
# status is the only command an operator runs when nothing is obviously wrong,
|
|
# which makes it the right place to notice a mode that drifted. It reports and
|
|
# does not fix: converging state is `install`'s job, and a read-only verb that
|
|
# quietly writes is a worse surprise than a loud warning.
|
|
MODE="$(stat -c '%a' "$RUNNER_DIR/.runner" 2>/dev/null || true)"
|
|
if [ -n "$MODE" ] && [ "$MODE" != "$FORGEJO_RUNNER_FILE_MODE" ]; then
|
|
warn ".runner is mode ${MODE}, not ${FORGEJO_RUNNER_FILE_MODE} — it holds this runner's registration secret, and every account on this box can read it. Re-run 'rig forgejo-runner install --instance ${INSTANCE:-<url>}' to converge the mode."
|
|
fi
|