Without an image suffix on the runner labels, act_runner uses a
minimal default container image that has no Node. Every JavaScript
action (actions/checkout, actions/setup-node, nrwl/nx-set-shas, etc.)
crashes during the action's launch step with `Cannot find: node in
PATH`, blocking every CI gate before any project code runs.
The fix is in the runner registration labels: act_runner accepts the
format `<label>:docker://<image>`, which makes act spawn jobs in the
specified container. catthehacker/ubuntu:act-22.04 is the de facto
standard image for act-compatible runners; it bundles Node, Python,
git, common build tools, and the Docker CLI, matching what GitHub
Actions / Gitea Actions workflows generally assume.
infra/ci-runners.compose.yml: GITEA_RUNNER_LABELS updated for the
three runners, with an inline comment explaining the format trap.
docs/decisions/0015-cicd-gitea-actions.md (§Runners): amend the
runner-image baseline. Previous wording said "a Debian image"
without specifying which; now states catthehacker/ubuntu:act-22.04
explicitly and explains the docker:// suffix requirement. Status
remains 'accepted' - the runner-image choice is implementation detail
under the existing decision.
Already-running runners need their labels updated in the Gitea UI
(Site Administration -> Actions -> Runners -> edit each runner) to
the new format. Compose change applies on next re-registration.
Documented as the operational follow-up.
Set up the infrastructure-as-code recipe to bring up the three
self-hosted Gitea Actions runners required by ADR-0015. The compose
file launches three act_runner instances pinned to 0.2.13, registered
with the project's Gitea organisation, labelled self-hosted + on-prem
to match the runs-on selector in every job under .gitea/workflows/*.
Layout:
- infra/ new top-level folder for IaC
- infra/README.md explains the folder, registration
flow, security implications, future
placeholders (local/, prod/, runbooks/)
- infra/ci-runners.compose.yml three act_runner services, networked
together, persisting credentials to
./data/runner-N
- infra/.env.example GITEA_INSTANCE_URL +
GITEA_RUNNER_REGISTRATION_TOKEN; .env
itself stays git-ignored (root rule)
- infra/data/.gitignore tracks the dir, ignores runtime state
Security posture (documented in infra/README.md): mounting
/var/run/docker.sock gives the runner root-equivalent access to the
host Docker daemon. Mitigations rely on (a) repo-scope of the runner
in Gitea, (b) running the runner host outside the production trust
boundary, (c) no extra host filesystem mounts. Future hardening
(rootless Docker, DinD sidecar) is flagged as deferred.
The compose pins the runner image (0.2.13). Bumps go through a
dedicated chore(deps) PR per the convention; image upgrades roll one
runner at a time so CI is never starved (procedure documented in the
README).
Doc indexing (docs/README.md) deliberately not touched here to avoid
a conflict with the pending docs/architecture-diagrams branch which
also modifies that file. A small follow-up PR will add an index entry
once that branch is merged.
Julien Gautier