From fff432cd24097e884e6a154cf929f9d50313ff44 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Mon, 29 Jun 2026 02:12:50 -0400 Subject: [PATCH 1/2] fix: extract runner job under workspace --- cmd/github-actions-runner-job/Dockerfile | 4 ++-- cmd/github-actions-runner-job/entrypoint.sh | 3 ++- release_packaging_test.go | 11 +++++++++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/cmd/github-actions-runner-job/Dockerfile b/cmd/github-actions-runner-job/Dockerfile index e10fc24..49dcd0d 100644 --- a/cmd/github-actions-runner-job/Dockerfile +++ b/cmd/github-actions-runner-job/Dockerfile @@ -29,7 +29,7 @@ COPY --chmod=0755 ${RUNNER_JOB_BINARY} /usr/local/bin/github-actions-runner-job COPY --chmod=0755 cmd/github-actions-runner-job/entrypoint.sh /usr/local/bin/github-actions-runner-job-entrypoint USER runner -WORKDIR /home/runner +WORKDIR /workspace ENV GITHUB_ACTIONS_RUNNER_ARCHIVE=/opt/actions-runner/actions-runner.tar.gz -ENV GITHUB_ACTIONS_RUNNER_DIR=/home/runner/actions-runner +ENV GITHUB_ACTIONS_RUNNER_DIR=/workspace/.github-actions-runner ENTRYPOINT ["/usr/local/bin/github-actions-runner-job-entrypoint"] diff --git a/cmd/github-actions-runner-job/entrypoint.sh b/cmd/github-actions-runner-job/entrypoint.sh index 2901df6..bd147b0 100644 --- a/cmd/github-actions-runner-job/entrypoint.sh +++ b/cmd/github-actions-runner-job/entrypoint.sh @@ -2,7 +2,7 @@ set -euo pipefail archive="${GITHUB_ACTIONS_RUNNER_ARCHIVE:-/opt/actions-runner/actions-runner.tar.gz}" -runner_dir="${GITHUB_ACTIONS_RUNNER_DIR:-/home/runner/actions-runner}" +runner_dir="${GITHUB_ACTIONS_RUNNER_DIR:-/workspace/.github-actions-runner}" if [ ! -f "$archive" ]; then echo "github-actions-runner-job: runner archive not found at $archive" >&2 @@ -10,6 +10,7 @@ if [ ! -f "$archive" ]; then fi if [ ! -x "$runner_dir/config.sh" ]; then + mkdir -p "$(dirname "$runner_dir")" mkdir -p "$runner_dir" tar --no-same-owner -xzf "$archive" -C "$runner_dir" fi diff --git a/release_packaging_test.go b/release_packaging_test.go index 58eea4a..284fe1e 100644 --- a/release_packaging_test.go +++ b/release_packaging_test.go @@ -109,7 +109,8 @@ func TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive(t *testing.T) `echo "${runner_sha256} /opt/actions-runner/actions-runner.tar.gz" | sha256sum -c -`, "tar -tzf /opt/actions-runner/actions-runner.tar.gz ./config.sh ./run.sh >/dev/null", "GITHUB_ACTIONS_RUNNER_ARCHIVE=/opt/actions-runner/actions-runner.tar.gz", - "GITHUB_ACTIONS_RUNNER_DIR=/home/runner/actions-runner", + "GITHUB_ACTIONS_RUNNER_DIR=/workspace/.github-actions-runner", + "WORKDIR /workspace", "COPY --chmod=0755 cmd/github-actions-runner-job/entrypoint.sh /usr/local/bin/github-actions-runner-job-entrypoint", `ENTRYPOINT ["/usr/local/bin/github-actions-runner-job-entrypoint"]`, } { @@ -125,9 +126,10 @@ func TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive(t *testing.T) entrypointText := string(entrypoint) for _, want := range []string{ "${GITHUB_ACTIONS_RUNNER_ARCHIVE:-/opt/actions-runner/actions-runner.tar.gz}", - "${GITHUB_ACTIONS_RUNNER_DIR:-/home/runner/actions-runner}", + "${GITHUB_ACTIONS_RUNNER_DIR:-/workspace/.github-actions-runner}", `[ ! -f "$archive" ]`, "runner archive not found", + `mkdir -p "$(dirname "$runner_dir")"`, `tar --no-same-owner -xzf "$archive" -C "$runner_dir"`, `exec /usr/local/bin/github-actions-runner-job "$@"`, } { @@ -135,6 +137,11 @@ func TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive(t *testing.T) t.Fatalf("runner job entrypoint must include %q", want) } } + if strings.Contains(dockerfile, "WORKDIR /home/runner") || + strings.Contains(dockerfile, "GITHUB_ACTIONS_RUNNER_DIR=/home/runner/actions-runner") || + strings.Contains(entrypointText, "GITHUB_ACTIONS_RUNNER_DIR:-/home/runner/actions-runner") { + t.Fatal("runner job image must extract the runner under the writable /workspace mount, not /home/runner") + } } func TestReleaseArchiveCheckRejectsProviderBuildOutsideArchive(t *testing.T) { From 6d1b06b016a5de3a09c963c17ce7643744d60f60 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Mon, 29 Jun 2026 02:20:43 -0400 Subject: [PATCH 2/2] fix: create runner workspace explicitly --- cmd/github-actions-runner-job/Dockerfile | 4 +++- release_packaging_test.go | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/cmd/github-actions-runner-job/Dockerfile b/cmd/github-actions-runner-job/Dockerfile index 49dcd0d..6016ead 100644 --- a/cmd/github-actions-runner-job/Dockerfile +++ b/cmd/github-actions-runner-job/Dockerfile @@ -23,7 +23,9 @@ RUN set -eux; \ echo "${runner_sha256} /opt/actions-runner/actions-runner.tar.gz" | sha256sum -c -; \ tar -tzf /opt/actions-runner/actions-runner.tar.gz ./config.sh ./run.sh >/dev/null; \ chmod 0644 /opt/actions-runner/actions-runner.tar.gz; \ - useradd -m -s /bin/bash runner + useradd -m -s /bin/bash runner; \ + mkdir -p /workspace; \ + chown runner:runner /workspace COPY --chmod=0755 ${RUNNER_JOB_BINARY} /usr/local/bin/github-actions-runner-job COPY --chmod=0755 cmd/github-actions-runner-job/entrypoint.sh /usr/local/bin/github-actions-runner-job-entrypoint diff --git a/release_packaging_test.go b/release_packaging_test.go index 284fe1e..2c4fefe 100644 --- a/release_packaging_test.go +++ b/release_packaging_test.go @@ -108,6 +108,8 @@ func TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive(t *testing.T) `arm64) runner_sha256="69ac7e5692f877189e7dddf4a1bb16cbbd6425568cd69a0359895fac48b9ad3b"`, `echo "${runner_sha256} /opt/actions-runner/actions-runner.tar.gz" | sha256sum -c -`, "tar -tzf /opt/actions-runner/actions-runner.tar.gz ./config.sh ./run.sh >/dev/null", + "mkdir -p /workspace", + "chown runner:runner /workspace", "GITHUB_ACTIONS_RUNNER_ARCHIVE=/opt/actions-runner/actions-runner.tar.gz", "GITHUB_ACTIONS_RUNNER_DIR=/workspace/.github-actions-runner", "WORKDIR /workspace",