重构为直接 OpenSandbox 生命周期调度

scripts/gitea-opensandbox-runner

@@ -3,8 +3,15 @@ set -euo pipefail
 
 : "${CI_SPIFFE_ID:?CI_SPIFFE_ID is required}"
 : "${SPIFFE_ENDPOINT_SOCKET:?SPIFFE_ENDPOINT_SOCKET is required}"
+: "${GITEA_RUNNER_REGISTRATION_TOKEN_URL:?GITEA_RUNNER_REGISTRATION_TOKEN_URL is required}"
 
 socket_path=${SPIFFE_ENDPOINT_SOCKET#unix://}
+token_file=$(mktemp)
+cleanup() {
+  rm -f -- "$token_file"
+}
+trap cleanup EXIT
+export GITEA_RUNNER_REGISTRATION_TOKEN_FILE="$token_file"
 deadline=$((SECONDS + 120))
 while (( SECONDS < deadline )); do
   if /opt/spire/bin/spire-agent api fetch x509 \
@@ -12,6 +19,10 @@ while (( SECONDS < deadline )); do
     -output json 2>/dev/null | \
     jq -e --arg id "$CI_SPIFFE_ID" \
       'any(.svids[]?; .spiffe_id == $id)' >/dev/null; then
+    umask 077
+    curl --fail --silent --show-error --retry 10 --retry-all-errors \
+      --connect-timeout 2 --max-time 30 \
+      "$GITEA_RUNNER_REGISTRATION_TOKEN_URL" >"$token_file"
     exec /usr/local/bin/run.sh
   fi
   sleep 1