将 Pod smoke 改为手动触发

Merge remote-tracking branch 'origin/main' into test/pod-smoke
Merge pull request：升级动态 Runner 到 3.5.0
2026-09-16 16:42:49 +00:00 · 2026-09-16 16:06:55 +00:00 · 2026-09-16 15:58:19 +00:00 · 2026-09-16 15:57:15 +00:00 · 2026-09-16 15:32:38 +00:00 · 2026-09-16 15:20:02 +00:00
4 changed files with 25 additions and 3 deletions
@@ -0,0 +1,19 @@
+name: dynamic Pod smoke test
+
+on:
+  workflow_dispatch:
+
+jobs:
+  pod-smoke:
+    name: pod-smoke
+    runs-on: [self-hosted, pod]
+    timeout-minutes: 5
+    steps:
+      - name: Verify disposable host environment
+        run: |
+          test -S /run/spire/agent-sockets/spire-agent.sock
+          /opt/spire/bin/spire-agent api fetch jwt \
+            -audience ci-smoke \
+            -socketPath /run/spire/agent-sockets/spire-agent.sock \
+            >/dev/null
+          test "$(id -u)" = 0
@@ -25,7 +25,8 @@ runs-on: [self-hosted, vm]
 - `guest-runner`：在 guest 中领取一次性 runner registration token，注册 ephemeral
  runner，执行一个 job 后关机。
 - `pod-worker`：在 Kubernetes 中创建一次性 privileged Pod；Pod 内的 workflow 使用
-  host executor，Docker、BuildKit 和 kind 等工具由 pipeline 按需 setup。
+  host executor，Docker、BuildKit 和 kind 等工具由 pipeline 按需 setup。Runner 固定在
+  支持原生 job hooks 的 3.x 版本，在 workflow 第一步前等待实际任务对应的 SVID。
 - `jwt-broker`：早期共享 Kubernetes runner 的过渡实验；目标架构不部署它，每个
  动态 Pod 或 VM 直接取得自己的 SPIFFE 身份。

@@ -7,7 +7,9 @@ COPY src ./src
 RUN python -m venv /venv && /venv/bin/pip install --no-cache-dir .

 FROM python:3.12.11-alpine3.22
-RUN addgroup -S -g 65532 runner && adduser -S -D -H -u 65532 -G runner runner
+RUN addgroup -S -g 65532 runner \
+    && adduser -S -D -H -u 65532 -G runner runner \
+    && install -d -o 65532 -g 65532 /var/run/secrets/kubernetes.io/serviceaccount
 COPY --from=build /venv /venv
 COPY --from=spire /opt/spire/bin/spire-agent /opt/spire/bin/spire-agent
 USER 65532:65532
@@ -1,6 +1,6 @@
 FROM ghcr.io/spiffe/spire-agent:1.15.3@sha256:41b0dcd8b258a69db9e2768292a060766fb76fd866e4bc925849981ea1b825ff AS spire

-FROM docker.io/gitea/runner:2@sha256:66d80966792e621c9761c47919644198d35fd1c297e9a01e69ed3c1ae37db0c7
+FROM docker.io/gitea/runner:3.5.0@sha256:66b7da94dc7dcadb2e076bec6928221336a9a637196399281c4b766fe1288242
 USER root
 COPY --from=spire /opt/spire/bin/spire-agent /opt/spire/bin/spire-agent
 COPY config/runner.yaml /etc/gitea-runner/config.yaml
Author	SHA1	Message	Date
panxiao81	bb73a48695	将 Pod smoke 改为手动触发 test / python (pull_request) Successful in 14s Details test / shell (pull_request) Successful in 20s Details	2026-09-16 16:42:49 +00:00
panxiao81	99ef62bfa0	Merge remote-tracking branch 'origin/main' into test/pod-smoke dynamic Pod smoke test / pod-smoke (pull_request) Successful in 5s Details test / python (pull_request) Successful in 10s Details test / shell (pull_request) Successful in 18s Details	2026-09-16 16:06:55 +00:00
panxiao81	33cbd23861	Merge pull request：升级动态 Runner 到 3.5.0 test / shell (push) Successful in 16s Details test / python (push) Successful in 9s Details	2026-09-16 15:58:19 +00:00
panxiao81	0dfdbd46c8	升级动态 Runner 到 3.5.0 test / shell (pull_request) Successful in 15s Details test / python (pull_request) Successful in 9s Details	2026-09-16 15:57:15 +00:00
panxiao81	21aabe162f	添加动态 Pod Runner 冒烟测试 test / python (pull_request) Successful in 9s Details test / shell (pull_request) Successful in 16s Details dynamic Pod smoke test / pod-smoke (pull_request) Failing after 1s Details	2026-09-16 15:32:38 +00:00
panxiao81	cbfcb10143	Merge pull request：修复服务账号令牌挂载点 test / python (push) Successful in 9s Details test / shell (push) Successful in 15s Details	2026-09-16 15:20:02 +00:00
panxiao81	3ec528623a	修复只读根文件系统下的服务账号令牌挂载 test / python (pull_request) Successful in 10s Details test / shell (pull_request) Successful in 21s Details	2026-09-16 15:18:21 +00:00
panxiao81	11669ea81a	Merge pull request：统一动态 Runner 命名并记录协议调度路线 test / python (push) Successful in 9s Details test / shell (push) Successful in 17s Details	2026-09-16 14:54:44 +00:00