feat: add disposable VM execution to Gitea Runner

.dockerignore

@@ -1,7 +1,13 @@
 .git
 .gitmodules
-node_modules
+node_modules/*
+!node_modules/forgejo-runner-startos
+node_modules/forgejo-runner-startos/*
+!node_modules/forgejo-runner-startos/runtime
 javascript
 ncc-cache
 docker-images
 *.s9pk
+**/.git
+**/__pycache__
+**/*.pyc

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "upstream"]
+	path = upstream
+	url = https://gitea.com/gitea/runner.git

AGENTS.md

@@ -1,41 +1,6 @@
-# AGENTS.md
+# Gitea Runner package development
 
-This is a StartOS service-package repository — it builds a `.s9pk` for StartOS.
-
-Develop it inside a StartOS packaging workspace created by `start-cli s9pk init-workspace`,
-which provides the packaging guide and agent context one level up. If you're reading this in a
-bare clone with no workspace, the full guide is at <https://docs.start9.com/packaging>.
-
-**Start every task at the recipe index** — `../start-technologies/projects/start-sdk/docs/src/recipes.md`
-(or <https://docs.start9.com/packaging/recipes.html>). It maps an intent ("prompt the user to create
-admin credentials", "expose a web UI") to the constructs, the reference pages, and a named production
-package to copy. Find the recipe before you read this package's neighbours: a package you reach by
-grepping may be non-conformant, and the recipe outranks it.
-
-Freshly scaffolded? Work the
-[New Package Checklist](../start-technologies/projects/start-sdk/docs/src/new-package-checklist.md)
-(or <https://docs.start9.com/packaging/new-package-checklist.html>) from top to bottom. It is a
-guide page, not a file in this repo — read it, don't copy it in.
-
-Keep `README.md` (technical reference for an AI support or administering agent) and
-`instructions.md` (end-user docs) in sync with your changes. This file restates neither:
-whoever changes the package has both, so it carries only what they don't — repo mechanics,
-a change that looks right and is not, where the next thing gets added, a naming trap, a
-build or test invocation particular to this repo.
-
-**Fix a defect you spot rather than reporting it** — you have the package open and the
-context to be sure. File **a GitHub issue on this repo** only when the call isn't yours to
-make: you can't pin the cause down, two defensible fixes exist, or it's too large to ride on
-the work in hand. An open issue is a report, not a queue — implement one when you're asked
-to or when it's labelled `Approved`, then close it with `Closes #<n>`.
-
-Don't record work in the repo instead: no `TODO.md`, no `NOTES.md`, no `PLAN.md`. What you
-verified, tried, and decided belongs in the commit message and the PR body.
-
-## This repo
-
-- **Don't port `forgejo-runner-startos`'s credential handling here.** The two share a shape, but Gitea registers with a single-use token plus a runner name and Forgejo with a persistent UUID and token pair.
-- **Keep `primary`'s check keyed off `runner/.runner` and observing the process.** The stored token is absent on a runner registered out of band, and a daemon's `ready.fn` overwrites the crash status the SDK sets, so a check on registration alone paints a crash loop green.
-- **Apply capacity with `config set`, not a sed.** `gitea-runner config init` writes no `capacity` key, so a sed over the generated config has nothing to match.
-- **`own-data` chowns only `runner/`, and `clean-runtime` requires it.** `store.json` shares the mount and keeps its own ownership; run concurrently, the `chown -R` walks the tree `clean-runtime` deletes and fails with ENOENT.
-- **Keep `git` in the image.** The runner fetches `uses:` actions with the git CLI, and without it every `uses:` step fails with an exec error that doesn't name the cause.
+- Start at `../start-technologies/projects/start-sdk/docs/src/recipes.md`; read upstream's `AGENTS.md` and `DEVELOPMENT.md` before changing carried Go patches.
+- Keep `node_modules/forgejo-runner-startos/runtime/**/*.ts` in `tsconfig.json` and the runtime sources in Make's JavaScript dependencies. A green standalone `tsc` does not establish NCC emitted dependency TypeScript.
+- Pin the shared dependency by immutable commit and update its lockfile. Generic runtime fixes belong in that owner; registration and native CLI changes belong here.
+- Apply source patches only in a build/test copy. Stage the clean upstream gitlink, not throwaway commits or patched submodule content.

Dockerfile

@@ -1,35 +1,29 @@
-# gitea-runner binary, pulled from the official multi-arch image (pinned).
-# Bump the tag here and the version in startos/versions/current.ts together.
-FROM gitea/runner:5.1.0 AS runner
+ARG BINFMT_IMAGE
+FROM --platform=$BUILDPLATFORM golang:1.27.3-trixie AS runner
+WORKDIR /src
+COPY upstream/ ./
+COPY patches/ /patches/
+RUN for file in /patches/*.patch; do git apply "$file"; done
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 go test -short -run '^Test(RemoteMetadataAndFallbackBoundary|RemoteDockerBuildBoundary|ActionBundleReadWriteBoundary|StepActionLocalTest|StepActionRemote|PatchBundle|PatchActionsAtTheContainerCopy|ExecAsDockerHoldsCloneLockForRemoteUncached|TrustedRootCA|SerialJobs|DefaultParallelJobs|DockerImagePlatform)' ./act/runner \
+ && CGO_ENABLED=0 go test -short ./act/container ./internal/app/run ./internal/app/cmd ./internal/pkg/config ./internal/pkg/labels ./internal/app/poll
+ARG TARGETOS
+ARG TARGETARCH
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath -tags netgo,osusergo \
+      -ldflags '-s -w -X gitea.com/gitea/runner/internal/pkg/ver.version=v5.1.0' \
+      -o /bin/gitea-runner .
+FROM $BINFMT_IMAGE AS binfmt
 
 FROM debian:trixie-slim
-
-# Rootless Podman + its prerequisites (fuse-overlayfs storage, pasta/slirp4netns
-# networking, nftables for netavark). See start-docs recipe-nested-oci-runtime.
-# Also git: the runner fetches `uses:` actions with the git CLI — without it every
-# `uses:` step fails at the action fetch (exec: "git": executable file not found in $PATH).
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-      podman fuse-overlayfs uidmap iproute2 iptables nftables aardvark-dns \
-      passt slirp4netns ca-certificates git openssh-client \
- && apt-get clean \
- && rm -rf /var/lib/apt/lists/*
-
-COPY --from=runner /usr/local/bin/gitea-runner /usr/local/bin/gitea-runner
-
-RUN mkdir -p /etc/containers \
- && printf 'unqualified-search-registries = ["docker.io"]\n' \
-        > /etc/containers/registries.conf
-
-# Non-root user + subordinate UID/GID ranges for nested user namespaces. The
-# range must live inside the subcontainer's userns (0..65535) and must not
-# overlap the user's own UID (1000) — so start at 1001.
-RUN useradd --create-home --uid 1000 --shell /bin/bash app \
- && echo 'app:1001:64535' > /etc/subuid \
- && echo 'app:1001:64535' > /etc/subgid
-
-COPY assets/entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod +x /usr/local/bin/entrypoint.sh
-
+ARG BINFMT_IMAGE
+COPY node_modules/forgejo-runner-startos/runtime/assets/install-runtime.sh /usr/local/share/ci-runner/install-runtime.sh
+RUN sh /usr/local/share/ci-runner/install-runtime.sh
+RUN apt-get update && apt-get install -y --no-install-recommends openssh-client && rm -rf /var/lib/apt/lists/*
+COPY node_modules/forgejo-runner-startos/runtime/assets/ /usr/local/share/ci-runner/
+COPY --from=runner /bin/gitea-runner /usr/local/bin/gitea-runner
+COPY --from=binfmt /usr/bin/ /usr/bin/
+RUN printf '%s\n' "$BINFMT_IMAGE" > /usr/local/share/binfmt-image
+COPY --chmod=755 assets/entrypoint.sh /usr/local/bin/entrypoint.sh
 USER app
 WORKDIR /home/app

LICENSE

@@ -0,0 +1 @@
+upstream/LICENSE

Makefile

@@ -1,6 +1,6 @@
 # overrides to s9pk.mk must precede the include statement
-# The gitea-runner binary ships only x86_64 + aarch64 (no riscv64), so skip
-# riscv. (Foreign-arch *jobs* are still built via the host's qemu binfmt; this
-# is only about which arches the runner package itself runs on.)
+# The shared guest images support these package architectures.
 ARCHES := x86 arm
 include node_modules/@start9labs/start-sdk/s9pk.mk
+
+javascript/index.js: $(shell find node_modules/forgejo-runner-startos/runtime -name '*.ts' 2>/dev/null)