fix(ci): pin act_runner job image to catthehacker/ubuntu:act-22.04 #4

Merged

julien merged 1 commits from fix/ci-runner-image into main 2026-05-04 11:06:57 +02:00

Conversation 0 Commits 1 Files Changed 2

+22 -4

julien commented 2026-05-04 11:06:28 +02:00

Owner

Copy Link

Copy Source

Summary

• Pin act_runner's job container image to catthehacker/ubuntu:act-22.04 via the <label>:docker://<image> format on the runner registration labels.
• Update infra/ci-runners.compose.yml's GITEA_RUNNER_LABELS for all three runner services, with an inline comment explaining the format requirement.
• Amend ADR-0015 §"Runners" to specify the chosen image and explain the docker-suffix syntax trap.

Motivation

The first real PR test of the CI pipeline failed at the very first step:

Run actions/checkout@v4
0s
Cannot find: node in PATH
❌ Failure - Main actions/checkout@v4

Root cause: act_runner registers labels (self-hosted, on-prem) without a docker:// image suffix. Without that suffix, act spawns jobs in a minimal default container that has no Node. Every JavaScript action (actions/checkout, actions/setup-node, nrwl/nx-set-shas, the Trivy/gitleaks actions) crashes during the action's launch step. None of the five CI gates can run.

catthehacker/ubuntu:act-22.04 is the de facto image used by act upstream and the standard recommendation for self-hosted Gitea Actions runners. It bundles Node, Python, git, common build tools, and the Docker CLI — exactly the assumed environment for GitHub Actions-compatible workflows.

Implementation notes

• The fix lives in GITEA_RUNNER_LABELS because that's what act_runner reads at registration time. The label-to-image mapping is then persisted in the runner's data/runner-N/.runner credential.
• For runners already registered (i.e. the three currently-running apf-portal-runner-N), the persisted credential ignores the new env var. Their labels must be updated through Gitea's UI (Site Administration → Actions → Runners → each runner → edit Labels). This is documented in the commit message and is an operational follow-up to merging this PR.
• The compose-file change applies the next time a runner is re-registered (e.g. when data/runner-N/ is wiped or a new fourth runner is added).
• ADR-0015 amendment is in-place, status remains accepted. The runner-image choice is an implementation detail under the existing decision; no new ADR.

Verification

• pnpm ci:check — n/a, this PR only changes infra and ADR docs, no code paths.
• Manual: after merge + Gitea label updates, the next PR's actions/checkout@v4 step runs without Cannot find: node in PATH.

Related

• ADR-0015 — CI/CD pipeline. Amended in §"Runners".
• infra/README.md — operational doc for the runners; mentions the registration workflow but predates this format requirement. A subsequent docs touch could mirror the new label format there too; deferred to keep this PR scoped to the actual fix.

## Summary - Pin `act_runner`'s job container image to `catthehacker/ubuntu:act-22.04` via the `<label>:docker://<image>` format on the runner registration labels. - Update `infra/ci-runners.compose.yml`'s `GITEA_RUNNER_LABELS` for all three runner services, with an inline comment explaining the format requirement. - Amend ADR-0015 §"Runners" to specify the chosen image and explain the docker-suffix syntax trap. ## Motivation The first real PR test of the CI pipeline failed at the very first step: ``` Run actions/checkout@v4 0s Cannot find: node in PATH ❌ Failure - Main actions/checkout@v4 ``` Root cause: `act_runner` registers labels (`self-hosted`, `on-prem`) without a `docker://` image suffix. Without that suffix, act spawns jobs in a minimal default container that has no Node. Every JavaScript action (`actions/checkout`, `actions/setup-node`, `nrwl/nx-set-shas`, the Trivy/gitleaks actions) crashes during the action's launch step. None of the five CI gates can run. `catthehacker/ubuntu:act-22.04` is the de facto image used by `act` upstream and the standard recommendation for self-hosted Gitea Actions runners. It bundles Node, Python, git, common build tools, and the Docker CLI — exactly the assumed environment for GitHub Actions-compatible workflows. ## Implementation notes - The fix lives in `GITEA_RUNNER_LABELS` because that's what `act_runner` reads at registration time. The label-to-image mapping is then persisted in the runner's `data/runner-N/.runner` credential. - For runners **already registered** (i.e. the three currently-running `apf-portal-runner-N`), the persisted credential ignores the new env var. Their labels must be updated through Gitea's UI (Site Administration → Actions → Runners → each runner → edit `Labels`). This is documented in the commit message and is an operational follow-up to merging this PR. - The compose-file change applies the next time a runner is re-registered (e.g. when `data/runner-N/` is wiped or a new fourth runner is added). - ADR-0015 amendment is in-place, status remains `accepted`. The runner-image choice is an implementation detail under the existing decision; no new ADR. ## Verification - [ ] `pnpm ci:check` — n/a, this PR only changes infra and ADR docs, no code paths. - [ ] **Manual:** after merge + Gitea label updates, the next PR's `actions/checkout@v4` step runs without `Cannot find: node in PATH`. ## Related - [ADR-0015 — CI/CD pipeline](docs/decisions/0015-cicd-gitea-actions.md). Amended in §"Runners". - [`infra/README.md`](infra/README.md) — operational doc for the runners; mentions the registration workflow but predates this format requirement. A subsequent docs touch could mirror the new label format there too; deferred to keep this PR scoped to the actual fix.

julien added 1 commit 2026-05-04 11:06:28 +02:00

fix(ci): pin act_runner job image to catthehacker/ubuntu:act-22.04 ... f5f0cd6369

Without an image suffix on the runner labels, act_runner uses a
minimal default container image that has no Node. Every JavaScript
action (actions/checkout, actions/setup-node, nrwl/nx-set-shas, etc.)
crashes during the action's launch step with `Cannot find: node in
PATH`, blocking every CI gate before any project code runs.

The fix is in the runner registration labels: act_runner accepts the
format `<label>:docker://<image>`, which makes act spawn jobs in the
specified container. catthehacker/ubuntu:act-22.04 is the de facto
standard image for act-compatible runners; it bundles Node, Python,
git, common build tools, and the Docker CLI, matching what GitHub
Actions / Gitea Actions workflows generally assume.

infra/ci-runners.compose.yml: GITEA_RUNNER_LABELS updated for the
three runners, with an inline comment explaining the format trap.

docs/decisions/0015-cicd-gitea-actions.md (§Runners): amend the
runner-image baseline. Previous wording said "a Debian image"
without specifying which; now states catthehacker/ubuntu:act-22.04
explicitly and explains the docker:// suffix requirement. Status
remains 'accepted' - the runner-image choice is implementation detail
under the existing decision.

Already-running runners need their labels updated in the Gitea UI
(Site Administration -> Actions -> Runners -> edit each runner) to
the new format. Compose change applies on next re-registration.
Documented as the operational follow-up.

julien merged commit 02bdd43fa1 into main 2026-05-04 11:06:57 +02:00

julien deleted branch fix/ci-runner-image 2026-05-04 11:06:57 +02:00

julien referenced this pull request 2026-05-04 12:06:05 +02:00

fix(ci): declare packageManager for pnpm/action-setup #6

julien referenced this issue from a commit 2026-05-04 12:36:40 +02:00

fix(ci): declare packageManager for pnpm/action-setup (#6)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

adastra-bot (AdAstra Bot) julien (Julien Gautier)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: julien/apf_portal#4