添加动态 Pod Runner 冒烟测试

.gitea/workflows/pod-smoke.yml

@@ -0,0 +1,22 @@
+name: dynamic Pod smoke test
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .gitea/workflows/pod-smoke.yml
+
+jobs:
+  pod-smoke:
+    name: pod-smoke
+    runs-on: [self-hosted, pod]
+    timeout-minutes: 5
+    steps:
+      - name: Verify disposable host environment
+        run: |
+          test -S /run/spire/agent-sockets/spire-agent.sock
+          /opt/spire/bin/spire-agent api fetch jwt \
+            -audience ci-smoke \
+            -socketPath /run/spire/agent-sockets/spire-agent.sock \
+            >/dev/null
+          test "$(id -u)" = 0

README.md

@@ -25,8 +25,7 @@ runs-on: [self-hosted, vm]
 - `guest-runner`：在 guest 中领取一次性 runner registration token，注册 ephemeral
   runner，执行一个 job 后关机。
 - `pod-worker`：在 Kubernetes 中创建一次性 privileged Pod；Pod 内的 workflow 使用
-  host executor，Docker、BuildKit 和 kind 等工具由 pipeline 按需 setup。Runner 固定在
+  host executor，Docker、BuildKit 和 kind 等工具由 pipeline 按需 setup。
-  支持原生 job hooks 的 3.x 版本，在 workflow 第一步前等待实际任务对应的 SVID。
 - `jwt-broker`：早期共享 Kubernetes runner 的过渡实验；目标架构不部署它，每个
   动态 Pod 或 VM 直接取得自己的 SPIFFE 身份。
 

container/runner.Dockerfile

@@ -1,20 +1,8 @@
 FROM ghcr.io/spiffe/spire-agent:1.15.3@sha256:41b0dcd8b258a69db9e2768292a060766fb76fd866e4bc925849981ea1b825ff AS spire
 
-FROM docker.io/gitea/runner:3.5.0@sha256:66b7da94dc7dcadb2e076bec6928221336a9a637196399281c4b766fe1288242 AS runner
+FROM docker.io/gitea/runner:2@sha256:66d80966792e621c9761c47919644198d35fd1c297e9a01e69ed3c1ae37db0c7
-
-# The runner daemon image is intentionally minimal and does not contain the
-# Node.js runtime required by JavaScript actions such as actions/checkout.
-# Run the daemon in Gitea's Ubuntu workflow image so host-mode jobs and their
-# actions share a GitHub Actions-compatible userspace.
-FROM docker.io/gitea/runner-images:ubuntu-latest@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
 USER root
-
-COPY --from=runner /usr/local/bin/gitea-runner /usr/local/bin/gitea-runner
-COPY --from=runner /usr/local/bin/run.sh /usr/local/bin/run.sh
 COPY --from=spire /opt/spire/bin/spire-agent /opt/spire/bin/spire-agent
 COPY config/runner.yaml /etc/gitea-runner/config.yaml
-COPY --chmod=0755 scripts/gitea-job-started /usr/local/libexec/gitea-job-started
+COPY scripts/gitea-job-started /usr/local/libexec/gitea-job-started
-
+RUN chmod 0755 /usr/local/libexec/gitea-job-started
-VOLUME ["/data"]
-WORKDIR /
-ENTRYPOINT ["/usr/local/bin/run.sh"]