feat: bootstrap official runner through SPIFFE facade

internal/taskworker/worker.go

@@ -34,11 +34,26 @@ type Metadata struct {
 	Annotations map[string]string
 }
 
+// LaunchSpec contains the durable resource metadata and the short-lived
+// executor environment. Environment values configure the one-shot runner but
+// are deliberately excluded from labels and annotations.
+type LaunchSpec struct {
+	Metadata    Metadata
+	Environment map[string]string
+}
+
+// Bootstrap produces assignment-scoped executor configuration. Implementations
+// must be deterministic so a redelivery after controller restart creates the
+// same credentials without storing another lifecycle record.
+type Bootstrap interface {
+	Environment(taskassignment.Assignment) (map[string]string, error)
+}
+
 // Backend is implemented by the native Pod and OpenSandbox adapters.
 // Every method must be idempotent.
 type Backend interface {
 	Find(context.Context, string) (*Executor, error)
-	Create(context.Context, taskassignment.Assignment, Metadata) (*Executor, error)
+	Create(context.Context, taskassignment.Assignment, LaunchSpec) (*Executor, error)
 	BindIdentity(context.Context, *Executor, taskidentity.Identity) error
 	Delete(context.Context, *Executor) error
 }
@@ -53,16 +68,17 @@ type TaskState interface {
 // Worker has no correctness-critical in-memory state. Handle may be called
 // again for the same assignment after any operation.
 type Worker struct {
-	Backend Backend
-	Tasks   TaskState
+	Backend   Backend
+	Tasks     TaskState
+	Bootstrap Bootstrap
 }
 
 // Accept completes the durable handoff from JetStream to the backend. Once it
 // returns true, all recovery information exists in Kubernetes/OpenSandbox and
 // the assignment message can be acknowledged immediately.
 func (w Worker) Accept(ctx context.Context, assignment taskassignment.Assignment) (bool, error) {
-	if w.Backend == nil || w.Tasks == nil {
-		return false, errors.New("backend and Gitea task state are required")
+	if w.Backend == nil || w.Tasks == nil || w.Bootstrap == nil {
+		return false, errors.New("backend, Gitea task state, and runner bootstrap are required")
 	}
 	if assignment.ID == "" || assignment.Task == nil {
 		return false, errors.New("valid assignment is required")
@@ -84,7 +100,11 @@ func (w Worker) Accept(ctx context.Context, assignment taskassignment.Assignment
 		return true, nil
 	}
 	if executor == nil {
-		executor, err = w.Backend.Create(ctx, assignment, BackendMetadata(assignment))
+		launch, launchErr := w.launchSpec(assignment)
+		if launchErr != nil {
+			return false, launchErr
+		}
+		executor, err = w.Backend.Create(ctx, assignment, launch)
 		if err != nil {
 			return false, err
 		}
@@ -101,8 +121,8 @@ func (w Worker) Accept(ctx context.Context, assignment taskassignment.Assignment
 // Handle performs one reconciliation. Done means the queue message may be
 // acknowledged. A false result should remain pending and be reconciled again.
 func (w Worker) Handle(ctx context.Context, assignment taskassignment.Assignment) (done bool, err error) {
-	if w.Backend == nil || w.Tasks == nil {
-		return false, errors.New("backend and Gitea task state are required")
+	if w.Backend == nil || w.Tasks == nil || w.Bootstrap == nil {
+		return false, errors.New("backend, Gitea task state, and runner bootstrap are required")
 	}
 	if assignment.ID == "" || assignment.Task == nil {
 		return false, errors.New("valid assignment is required")
@@ -126,7 +146,11 @@ func (w Worker) Handle(ctx context.Context, assignment taskassignment.Assignment
 	}
 
 	if executor == nil {
-		executor, err = w.Backend.Create(ctx, assignment, BackendMetadata(assignment))
+		launch, launchErr := w.launchSpec(assignment)
+		if launchErr != nil {
+			return false, launchErr
+		}
+		executor, err = w.Backend.Create(ctx, assignment, launch)
 		if err != nil {
 			return false, err
 		}
@@ -154,6 +178,14 @@ func (w Worker) Handle(ctx context.Context, assignment taskassignment.Assignment
 	}
 }
 
+func (w Worker) launchSpec(assignment taskassignment.Assignment) (LaunchSpec, error) {
+	environment, err := w.Bootstrap.Environment(assignment)
+	if err != nil {
+		return LaunchSpec{}, err
+	}
+	return LaunchSpec{Metadata: BackendMetadata(assignment), Environment: environment}, nil
+}
+
 // BackendMetadata is the shared metadata contract for Pods and OpenSandbox.
 func BackendMetadata(assignment taskassignment.Assignment) Metadata {
 	return Metadata{