feat(ibmcloud): add GitHub Actions runner support for IBM Power and IBM Z #831
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| name: s390x Runner Smoke Test | ||
| on: workflow_dispatch | ||
| jobs: | ||
| smoke-test: | ||
| runs-on: [self-hosted, S390X] | ||
| steps: | ||
| - name: Check architecture | ||
| run: | | ||
| echo "Architecture: $(uname -m)" | ||
| cat /etc/os-release | grep PRETTY_NAME | ||
| echo "Runner is alive on $(arch)" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| package github | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "fmt" | ||
| "io" | ||
| "net/http" | ||
| "strings" | ||
| "time" | ||
| ) | ||
|
|
||
| type registrationTokenResponse struct { | ||
| Token string `json:"token"` | ||
| ExpiresAt string `json:"expires_at"` | ||
| } | ||
|
|
||
| // GenerateRegistrationToken calls the GitHub API to create a short-lived | ||
| // runner registration token for the given repository. | ||
| // pat is a Personal Access Token with repo admin scope. | ||
| // repoURL is in the form "owner/repo" or "https://github.com/owner/repo". | ||
| func GenerateRegistrationToken(pat, repoURL string) (string, error) { | ||
| ownerRepo := repoURL | ||
| ownerRepo = strings.TrimPrefix(ownerRepo, "https://github.com/") | ||
| ownerRepo = strings.TrimPrefix(ownerRepo, "http://github.com/") | ||
| ownerRepo = strings.TrimSuffix(ownerRepo, "/") | ||
|
|
||
| parts := strings.Split(ownerRepo, "/") | ||
| if len(parts) != 2 || parts[0] == "" || parts[1] == "" { | ||
| return "", fmt.Errorf("invalid repo format %q, expected owner/repo", repoURL) | ||
| } | ||
|
|
||
| url := fmt.Sprintf("https://api.github.com/repos/%s/%s/actions/runners/registration-token", parts[0], parts[1]) | ||
|
deekay2310 marked this conversation as resolved.
|
||
|
|
||
| req, err := http.NewRequest(http.MethodPost, url, nil) | ||
| if err != nil { | ||
| return "", fmt.Errorf("creating request: %w", err) | ||
| } | ||
| req.Header.Set("Authorization", "token "+pat) | ||
| req.Header.Set("Accept", "application/vnd.github+json") | ||
| req.Header.Set("X-GitHub-Api-Version", "2022-11-28") | ||
|
|
||
| client := &http.Client{Timeout: 30 * time.Second} | ||
| resp, err := client.Do(req) | ||
| if err != nil { | ||
| return "", fmt.Errorf("calling GitHub API: %w", err) | ||
| } | ||
| defer func() { _ = resp.Body.Close() }() | ||
|
|
||
| body, err := io.ReadAll(resp.Body) | ||
| if err != nil { | ||
| return "", fmt.Errorf("reading response: %w", err) | ||
| } | ||
|
|
||
| if resp.StatusCode != http.StatusCreated { | ||
| return "", fmt.Errorf("GitHub API returned %d: %s (ensure GITHUB_TOKEN has admin scope on the repo)", resp.StatusCode, string(body)) | ||
| } | ||
|
|
||
| var tokenResp registrationTokenResponse | ||
| if err := json.Unmarshal(body, &tokenResp); err != nil { | ||
| return "", fmt.Errorf("parsing response: %w", err) | ||
| } | ||
|
|
||
| if tokenResp.Token == "" { | ||
| return "", fmt.Errorf("empty token in GitHub API response") | ||
| } | ||
|
|
||
| return tokenResp.Token, nil | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| dnf install -y git-core | ||
|
|
||
| git clone --branch "{{ .RunnerImageRepoVersion }}" --depth=1 "{{ .RunnerImageRepo }}" /opt/action-runner-image-pz | ||
|
|
||
| cd /opt/action-runner-image-pz | ||
| bash -c '. scripts/vm.sh rhel 9 minimal --skip-snap-lxd' || true | ||
|
|
||
| # The upstream configure-system.sh runs chmod -R 777 /usr/share which breaks | ||
| # sshd privilege separation (/usr/share/empty.sshd must be root-owned, not | ||
| # world-writable). Also fix PAM duplicates from configure-limits.sh. | ||
| chmod 755 /usr/share/empty.sshd 2>/dev/null || true | ||
| chown root:root /usr/share/empty.sshd 2>/dev/null || true | ||
| for f in /etc/pam.d/system-auth /etc/pam.d/password-auth; do | ||
| if [ -f "$f" ]; then | ||
| awk '!seen[$0]++' "$f" > "${f}.tmp" && mv "${f}.tmp" "$f" | ||
| fi | ||
| done | ||
| systemctl restart sshd 2>/dev/null || true | ||
|
|
||
| if [ ! -f /opt/runner-cache/config.sh ]; then | ||
| echo "Runner binary not found after build" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| id -u runner &>/dev/null || useradd -m -s /bin/bash runner | ||
| chown -R runner:runner /opt/runner-cache | ||
|
|
||
| sudo -u runner bash -c ' | ||
| cd /opt/runner-cache | ||
|
|
||
| ./config.sh \ | ||
|
Collaborator
There was a problem hiding this comment. Can we explore options in config to only install the cli and set it up to join as runner?
Contributor
Author
There was a problem hiding this comment. Once the fork is moved into |
||
| --unattended \ | ||
| --disableupdate \ | ||
| --ephemeral \ | ||
| --name "{{ .Name }}" \ | ||
| --labels "{{ .Labels }}" \ | ||
| --url "{{ .RepoURL }}" \ | ||
| --token "{{ .Token }}" | ||
|
|
||
| nohup ./run.sh > /tmp/gh-runner.log 2>&1 & | ||
| ' | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
what is this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If the user doesn't provide
--ghactions-runner-token, the code uses GITHUB_TOKEN from their environment to auto-generate a runner registration token via the GitHub API (GenerateRegistrationToken). This way users don't have to manually create a short-lived registration token before each run.