From 45be4a9fd933d30e51150015395575cc61cae63f Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Thu, 24 Sep 2026 07:08:08 +0000
Subject: [PATCH] =?UTF-8?q?fix(runner):=20=E6=9A=B4=E9=9C=B2=E5=86=85?=
 =?UTF-8?q?=E7=BD=AE=20SPIRE=20CLI?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/spire-identity-smoke.yml | 19 +++++--------------
 container/runner.Dockerfile               |  1 +
 2 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/.gitea/workflows/spire-identity-smoke.yml b/.gitea/workflows/spire-identity-smoke.yml
index 1d1c5d4..aabfd55 100644
--- a/.gitea/workflows/spire-identity-smoke.yml
+++ b/.gitea/workflows/spire-identity-smoke.yml
@@ -5,29 +5,20 @@ on:
 
 jobs:
   jwt-svid:
-    runs-on: self-hosted
-    container:
-      volumes:
-        - /run/spire/agent-sockets:/run/spire/agent-sockets:ro
+    runs-on: [self-hosted, pod]
     steps:
-      - name: Fetch pinned SPIRE CLI
+      - name: Verify bundled SPIRE CLI
         shell: bash
         run: |
           set -euo pipefail
-          archive=/tmp/spire.tar.gz
-          curl --fail --location --silent --show-error \
-            --output "$archive" \
-            https://github.com/spiffe/spire/releases/download/v1.15.3/spire-1.15.3-linux-amd64-musl.tar.gz
-          printf '%s  %s\n' \
-            ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7 \
-            "$archive" | sha256sum --check --status
-          tar -xzf "$archive" -C /tmp spire-1.15.3/bin/spire-agent
+          command -v spire-agent
+          spire-agent -version
 
       - name: Fetch short-lived zot JWT-SVID
         shell: bash
         run: |
           set -euo pipefail
-          /tmp/spire-1.15.3/bin/spire-agent api fetch jwt \
+          spire-agent api fetch jwt \
             -audience zot \
             -socketPath /run/spire/agent-sockets/spire-agent.sock \
             >/dev/null
diff --git a/container/runner.Dockerfile b/container/runner.Dockerfile
index 45cf798..6e2c66d 100644
--- a/container/runner.Dockerfile
+++ b/container/runner.Dockerfile
@@ -26,6 +26,7 @@ RUN groupadd --gid 2000 runner \
 COPY --from=runner /usr/local/bin/gitea-runner /usr/local/bin/gitea-runner
 COPY --from=controller /out/gitea-dynamic-runner /usr/local/bin/gitea-dynamic-runner
 COPY --from=spire /opt/spire/bin/spire-agent /opt/spire/bin/spire-agent
+RUN ln -s /opt/spire/bin/spire-agent /usr/local/bin/spire-agent
 COPY config/runner.yaml /etc/gitea-runner/config.yaml
 COPY --chmod=0755 scripts/gitea-job-started /usr/local/libexec/gitea-job-started
 COPY --chmod=0755 scripts/gitea-opensandbox-runner /usr/local/libexec/gitea-opensandbox-runner