In the 2 weeks since my last post I’ve spent a bunch of time getting my Forgejo Action Runner working. Although really it’s more “getting certain things working on the runner”. After years of using, making, and fixing Github Actions for work, the bulk of this stuff has been relatively straightforward. Having my runners run on SELinux is a separate problem… Alas, what am I doing with my CI?

Nothing special.

Really, it just fairly mundane things like:

• publishing this site to grebedoc.dev
• running all manner of PR workflows
• releasing multi arch artifacts for my Go projects
• failing to release multi arch artifacts for my Rust projects
• building its own image

Having this flexibility is great, since now I can treat Codeberg as I would any other forge (almost).

I will eventually release the Helm chart I made for the Forgejo Actions Runner, but I need to get my Helm releasing pipeline sorted first.

Maybe the only real thing of interest that can come from this is my runner image. I like the concept of 1 mega-runner image that contains almost everything you would need such that you can just do things in bash without needing to run extra installations.

There are some quirks to this. Firstly, I am too lazy to set up Harbor or something similar, so I’m just using DockerHub (is that what it’s called?). This has one huge caveat since I just want to use a single latest tag: it can leave a lot of dangling images that don’t get cleaned up. This is actually a problem with every container repository AFAIK but DockerHub makes it so much worse by not making it easy to remove those dangling images. No API, no CLI, no retention rules, only manual actions via the DockerHub site. I’ve read that skopeo can do it, but I’m yet to test it. For now it’s just clicking and typing ‘delete’ several times a week.

Secondly, I’m using docker to build this instead of buildah which I use everywhere else. I thought there wouldn’t be a difference but alas, the helm one-line installer fails in CI, so I had to do it the annoying way. Oh well.

As you will see below, I had a nice starting point. What is missing is go stuff like golines and staticcheck. This is because I’ve found that since I’m lazy at updating the go version, it’s easier to link them up dynamically in my go workflows, like so:

- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
  with:
    go-version-file: "go.mod"

- name: Install dependencies
  run: |
    go install github.com/golangci/golines@latest
    go install honnef.co/go/tools/cmd/staticcheck@latest

The CI is (unsurprisingly) still not done. I need to fix up caching, albeit that’s mainly in my workflows themselves, but caching go and cargo packages is an interesting concept that is probably a time sink for almost no returns. But now I can (almost) write dead simple workflows to run the most basic of checks.

Here’s the Dockerfile for my runner. It is about 2GB which isn’t quite that bad. How many errors and bad practices can you spot? ;)

# pinched from https://codeberg.org/wetneb/ubuntu_act_with_rust

FROM ghcr.io/catthehacker/ubuntu:act-24.04

RUN apt-get update
RUN apt-get install -y rustup apt-transport-https ca-certificates curl git jq make docker.io gpg
RUN rustup set auto-self-update disable
ENV PATH="/root/.cargo/bin:${PATH}"
RUN rustup install 1.98.0

# Install 'cargo binstall'
RUN curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash

# Install 'git-cliff'
RUN cargo binstall git-cliff --version 2.13.1 -y

# Install 'bindgen', 'audit', 'outdated'
RUN cargo binstall -y bindgen-cli cbindgen cargo-audit cargo-outdated

# Install 'shellcheck'
RUN apt-get install shellcheck

# Install Helm
# needs to be the long way it seems
ENV HELM_BUILDKITE_APT_KEY_ID="DDF78C3E6EBB2D2CC223C95C62BA89D07698DBC6"
RUN curl -fsSL https://packages.buildkite.com/helm-linux/helm-debian/gpgkey > "${TMPDIR:-/tmp}/helm.gpg"
RUN if [ "$(gpg --show-keys --with-colons "${TMPDIR:-/tmp}/helm.gpg" | awk -F: '$1 == "fpr" {print $10}' | head -n 1)" != "${HELM_BUILDKITE_APT_KEY_ID}" ]; then echo "ERROR: Unexpected Helm APT key ID: potential key compromise"; exit 1; fi
RUN cat "${TMPDIR:-/tmp}/helm.gpg" | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null
RUN echo "deb [signed-by=/usr/share/keyrings/helm.gpg] https://packages.buildkite.com/helm-linux/helm-debian/any/ any main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
RUN apt-get update
RUN apt-get install helm

# Install Opentofu
RUN curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh
RUN chmod +x install-opentofu.sh
RUN ./install-opentofu.sh --install-method deb
RUN rm install-opentofu.sh

# Install Hugo (ick)
RUN curl --proto '=https' --tlsv1.2 -fsSL https://github.com/gohugoio/hugo/releases/download/v0.165.0/hugo_0.165.0_linux-amd64.deb -o hugo.deb
RUN dpkg -i hugo.deb
RUN rm hugo.deb

# Install PDM (python)
RUN curl -sSL https://pdm-project.org/install.sh | bash

# Clean
RUN apt-get clean