runner-instance-scope #18

Merged

slanski merged 2 commits from runner-instance-scope into main

2026-08-03 12:47:07 +00:00

slanski commented

2026-08-03 12:46:51 +00:00

Owner

No description provided.

slanski added 2 commits

2026-08-03 12:46:51 +00:00

switch runner from adicom org scope to instance scope f0773a2f0f

Runner ci-rust was registered under the adicom organization — invisible
to jobs from cinnae/* repos (notably cinnae/infrastructure's new
build-ci-job-image workflow). Re-registered at instance level via Forgejo
UI (Site Administration → Actions → Runners → Create new runner) to serve
all orgs on this Forgejo instance.

This commit only updates the UUID; the matching Token goes into the
existing forgejo-runner-token Secret via kubectl patch (never committed).

Rollout (live cluster, do not wait for PR merge):
  1. kubectl -n forgejo patch secret forgejo-runner-token \
       -p '{"data":{"RUNNER_TOKEN":"<base64-of-new-token>"}}'
  2. kubectl apply -f helm/runners/20-configmap.yaml
  3. kubectl rollout restart deployment/forgejo-runner -n forgejo
  4. Verify in Forgejo UI → Site Administration → Actions → Runners
     that ci-rust appears with Type=Instance and Status=Idle.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat(runner): switch to prebuilt ci-job image + enable Kyverno PolicyException d14106b58a

Pre-bake kubectl/helm/cosign/syft in custom image to dodge runner's flaky
CDN egress (SSL timeouts mid-RUN). Wire auth registry mount in dind so it
can pull from private cinnae org packages (Forgejo has no per-package
visibility — inherits from owner). Enable PolicyException feature in Kyverno
and add a scoped exception for the privileged dind sidecar.

slanski merged commit 1f1142969f into main

2026-08-03 12:47:07 +00:00

slanski deleted branch runner-instance-scope

2026-08-03 12:47:07 +00:00

slanski referenced this pull request from a commit

2026-08-03 12:47:08 +00:00

runner-instance-scope (#18)