Extract GitHub runner job under workspace

[intel352]

Summary

• extract the bundled GitHub Actions runner under /workspace/.github-actions-runner instead of /home/runner/actions-runner
• keep the runner-job image compatible with workflow-compute's read-only rootfs sandbox and /workspace:rw mount
• extend release packaging coverage so future image changes cannot regress to /home/runner

Root cause

Retained STG Linux diagnostics showed the provider-owned runner image started under workflow-compute, then failed in the entrypoint with:

mkdir: cannot create directory '/home/runner': Permission denied

The dynamic provider sandbox uses a read-only root filesystem and a writable /workspace mount, so runner extraction must happen under /workspace.

TDD / regression proof

With the packaging test updated first and the Dockerfile/entrypoint reverted to /home/runner, the focused test failed with the expected missing /workspace assertion.

With the fix restored:

$ GOWORK=off go test ./... -count=1
ok   github.com/GoCodeAlone/workflow-plugin-github
ok   github.com/GoCodeAlone/workflow-plugin-github/cmd/github-actions-runner-job
ok   github.com/GoCodeAlone/workflow-plugin-github/internal

$ GOWORK=off go build ./cmd/github-actions-runner-job
# exit 0

Runtime launch validation

Ran the real image locally with the workflow-compute sandbox shape:

docker run --rm -i --read-only --cap-drop ALL --security-opt no-new-privileges \
  --pids-limit 256 --tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
  --user "$(id -u):$(id -g)" -v "$tmp:/workspace:rw" -w /workspace \
  workflow-plugin-github-runner-job:local --spec

Evidence:

• exit code 0
• output contained deterministic runner name/labels
• extracted /workspace/.github-actions-runner/config.sh
• extracted /workspace/.github-actions-runner/run.sh

Adversarial self-review

• Checked one-sided boundary wiring: the image now writes only to the sandbox writable mount used by workflow-compute.
• Checked cross-platform/runtime mismatch: workflow-compute overrides image USER with host UID/GID; the launch validation includes that shape.
• Checked regression coverage: tests reject WORKDIR /home/runner and the old GITHUB_ACTIONS_RUNNER_DIR fallback.
• Checked artifact/env leakage: no secrets or runner tokens are added to tests or PR evidence.

[Copilot]

Pull request overview

Updates the GitHub Actions runner-job image to extract the bundled runner into the workflow-compute writable mount (/workspace) instead of /home/runner, ensuring compatibility with read-only root filesystem sandboxing.

Changes:

• Move the runner extraction target to /workspace/.github-actions-runner (Dockerfile + entrypoint default).
• Set container WORKDIR to /workspace for sandbox compatibility.
• Strengthen release packaging tests to prevent regressions back to /home/runner and assert required entrypoint behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
release_packaging_test.go	Updates packaging assertions to enforce /workspace runner dir and reject /home/runner regressions.
cmd/github-actions-runner-job/entrypoint.sh	Defaults runner extraction directory to /workspace/.github-actions-runner and ensures parent exists before extraction.
cmd/github-actions-runner-job/Dockerfile	Switches WORKDIR and default GITHUB_ACTIONS_RUNNER_DIR to /workspace paths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.