Actions Runner rest api

[ChristopherHX]

Implements runner apis based on https://docs.github.com/en/rest/actions/self-hosted-runners?apiVersion=2022-11-28#list-self-hosted-runners-for-an-organization

• Add Post endpoints for registration-token, google/go-github revealed this as problem

  • We should deprecate Get Endpoints, leaving them for compatibility
  • Get endpoint of admin has api path /admin/runners/registration-token that feels wrong, /admin/actions/runners/registration-token seems more consistent with user/org/repo api

• Get Runner Api

• List Runner Api

• Delete Runner Api

• Tests admin / user / org / repo level endpoints

Related to #33750 (implements point 1 and 2)
Via needs discovered in #32461, this runner api is needed to allow cleanup of runners that are deallocated without user interaction.

[lunny]

I think most of them need permission checks. The web routers will invoke getRunnersCtx to get the context but not here.

[ChristopherHX]

The permission check that this runner is from the correct user/admin/org/repo is done by

if !runner.Editable(ownerID, repoID) {

Everything else is part of the api.go file.

Now I see the existing GetRegistrationToken can be called by read:organization the CreateRegistrationToken API needs write:organization .

Runner delete with read:organization scope fails, while listrunner + getrunner works

   api_org_runner_test.go:59: Response:  {"message":"token does not have at least one of required scope(s), required=[write:organization], token scope=read:organization","url":"http://localhost:3003/api/swagger"}

See here add permission org test, where I added some tests.

Both runner ownership and token scope is checked.