pdurlej/platform

Fork 0

docs(ci): version Forgejo runner runtime files #650

Merged

pdurlej merged 1 commit from codex/m06-forgejo-runner-infra-as-code into main

2026-05-30 17:44:43 +02:00

codex commented

2026-05-30 17:32:57 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Summary

Versions the current rs2000 Docker Forgejo Actions runner runtime files so the runner can be rebuilt from repository state instead of from host-local memory.

Canary Context Pack

Product story

The platform runner should be reconstructable from git. The live rs2000 runner currently depends on hand-edited compose/config files under /opt/forgejo-runner, which creates bus-factor and re-provisioning drift.

What changed

Added infra/forgejo-runner/docker-compose.yml matching /opt/forgejo-runner/docker-compose.yml.
Added infra/forgejo-runner/config.yaml matching /opt/forgejo-runner/data/config.yaml.
Added a small README and rebuild runbook.
Linked the versioned files from the existing Forgejo Actions runner runbook.
Added tests that guard against committing runner registration tokens/PAT-style secret values and verify the canary mount source remains whitelisted.

Why it changed

Issue #531 recorded that #527 required live edits to runner files which were not versioned and would not survive runner host reprovisioning.

Files touched

infra/forgejo-runner/docker-compose.yml
infra/forgejo-runner/config.yaml
infra/forgejo-runner/README.md
runbooks/forgejo-actions-runner.md
runbooks/forgejo-runner-rebuild.md
control-plane/platformctl/tests/test_forgejo_runner_infra.py

Relevant context

#531
runbooks/forgejo-actions-runner.md
Forgejo runner v7.0.0 valid_volumes behavior noted in #531

Runtime evidence

Read-only RS2000 comparison only. No runtime mutation.

diff -u between the live RS2000 files and the versioned files returned clean for:

/opt/forgejo-runner/docker-compose.yml
/opt/forgejo-runner/data/config.yaml

Known constraints

The compose file contains only steady-state runtime configuration. Registration token and .runner identity remain runtime-local state and are intentionally not versioned.

Explicit out-of-scope

Runner bootstrap automation
Re-registering the runner
Restarting the runner
Changing canary or Patchwarden workflow behavior

Requested decision

Merge if checks are green. This is infra-as-code documentation plus static tests only.

Merge blockers

Any secret value detected in versioned runner files
Drift from the live RS2000 runner files
Workflow/test regression

Spec sources read

#531 issue body: target files, proposed repository location, validation contract
runbooks/forgejo-actions-runner.md: existing runner operational context
Live RS2000 files: /opt/forgejo-runner/docker-compose.yml, /opt/forgejo-runner/data/config.yaml

Validation

ssh rs2000 ... diff -u ... - no drift for both runner files
PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_forgejo_runner_infra.py control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py - 35 passed
PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json - exitCode 0

Closes #531

Canary status: missing - fire canary 3+3 manually before merge ## Summary Versions the current `rs2000` Docker Forgejo Actions runner runtime files so the runner can be rebuilt from repository state instead of from host-local memory. ## Canary Context Pack ### Product story The platform runner should be reconstructable from git. The live `rs2000` runner currently depends on hand-edited compose/config files under `/opt/forgejo-runner`, which creates bus-factor and re-provisioning drift. ### What changed - Added `infra/forgejo-runner/docker-compose.yml` matching `/opt/forgejo-runner/docker-compose.yml`. - Added `infra/forgejo-runner/config.yaml` matching `/opt/forgejo-runner/data/config.yaml`. - Added a small README and rebuild runbook. - Linked the versioned files from the existing Forgejo Actions runner runbook. - Added tests that guard against committing runner registration tokens/PAT-style secret values and verify the canary mount source remains whitelisted. ### Why it changed Issue #531 recorded that #527 required live edits to runner files which were not versioned and would not survive runner host reprovisioning. ### Files touched - `infra/forgejo-runner/docker-compose.yml` - `infra/forgejo-runner/config.yaml` - `infra/forgejo-runner/README.md` - `runbooks/forgejo-actions-runner.md` - `runbooks/forgejo-runner-rebuild.md` - `control-plane/platformctl/tests/test_forgejo_runner_infra.py` ### Relevant context - #531 - `runbooks/forgejo-actions-runner.md` - Forgejo runner v7.0.0 `valid_volumes` behavior noted in #531 ### Runtime evidence Read-only RS2000 comparison only. No runtime mutation. `diff -u` between the live RS2000 files and the versioned files returned clean for: - `/opt/forgejo-runner/docker-compose.yml` - `/opt/forgejo-runner/data/config.yaml` ### Known constraints The compose file contains only steady-state runtime configuration. Registration token and `.runner` identity remain runtime-local state and are intentionally not versioned. ### Explicit out-of-scope - Runner bootstrap automation - Re-registering the runner - Restarting the runner - Changing canary or Patchwarden workflow behavior ### Requested decision Merge if checks are green. This is infra-as-code documentation plus static tests only. ### Merge blockers - Any secret value detected in versioned runner files - Drift from the live RS2000 runner files - Workflow/test regression ## Spec sources read - #531 issue body: target files, proposed repository location, validation contract - `runbooks/forgejo-actions-runner.md`: existing runner operational context - Live RS2000 files: `/opt/forgejo-runner/docker-compose.yml`, `/opt/forgejo-runner/data/config.yaml` ## Validation - `ssh rs2000 ... diff -u ...` - no drift for both runner files - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_forgejo_runner_infra.py control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py` - 35 passed - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json` - exitCode 0 Closes #531

codex added 1 commit

2026-05-30 17:32:57 +02:00

docs(ci): version Forgejo runner runtime files

canary-required / collect-diff (pull_request) Successful in 6s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 7s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 26s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 22s

Details

python-ci / Python 3.11 (pull_request) Successful in 41s

Details

python-ci / Python 3.12 (pull_request) Successful in 46s

Details

python-ci / Python 3.13 (pull_request) Successful in 46s

Details

workflow-lint / lint (pull_request) Successful in 7s

Details

canary-required / canary (pull_request) Successful in 15s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 23s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m16s

Details

0b85899bc4

codex added the

agent/codex

class/security-sensitive

labels

2026-05-30 17:33:23 +02:00

codex commented

2026-05-30 17:38:59 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 650
Commit: 0b85899bc4e91c92c78af7b66f930c039be9c57a
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium Docker socket mount grants host-equivalent privilege to runner container
- Evidence: infra/forgejo-runner/docker-compose.yml line 16: - /var/run/docker.sock:/var/run/docker.sockcombined withuser: 0:0 at line 7
- Next: Document the privilege implication in the README or runbook. Consider whether namespace isolation or rootless Docker could reduce blast radius in future work. This is existing operational state being versioned, not a new risk.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
blocker Host Docker socket mounted as root in runner compose
- Evidence: infra/forgejo-runner/docker-compose.yml adds user: 0:0and- /var/run/docker.sock:/var/run/docker.sock``
- Next: Add a security warning to the README/runbook and evaluate rootless Docker or a Docker-in-Docker sidecar; any runner compromise or untrusted workflow yields host root.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `650` - Commit: `0b85899bc4e91c92c78af7b66f930c039be9c57a` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Docker socket mount grants host-equivalent privilege to runner container - Evidence: `infra/forgejo-runner/docker-compose.yml line 16: `- /var/run/docker.sock:/var/run/docker.sock` combined with `user: 0:0` at line 7` - Next: Document the privilege implication in the README or runbook. Consider whether namespace isolation or rootless Docker could reduce blast radius in future work. This is existing operational state being versioned, not a new risk. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`blocker`** Host Docker socket mounted as root in runner compose - Evidence: `infra/forgejo-runner/docker-compose.yml adds `user: 0:0` and `- /var/run/docker.sock:/var/run/docker.sock`` - Next: Add a security warning to the README/runbook and evaluate rootless Docker or a Docker-in-Docker sidecar; any runner compromise or untrusted workflow yields host root. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.