CI runners

Public, versioned GitHub Actions runner images and capability contracts.

Build runner image

The build profile is published at:

ghcr.io/arawak/ci-runner-build

Consumers must use a release tag for discovery and an immutable digest for execution:

ghcr.io/arawak/ci-runner-build@sha256:<digest>

The image contains the GitHub Actions runner plus Bash, Git, curl, jq, tar, unzip, OpenSSH, Python 3, Docker CLI, Buildx, Compose, and required runtime libraries. It intentionally does not include application SDKs, cloud credentials, target repository defaults, or runner labels.

Runtime contract

Callers provide these values at runtime:

RUNNER_REPO_URL
RUNNER_NAME
RUNNER_LABELS

A new registration additionally requires RUNNER_TOKEN_FILE (preferred) or the temporary compatibility input RUNNER_TOKEN. Existing /runner registration volumes start without a token.

Example with documentation-only values:

docker run -d \
  --name example-runner \
  --restart unless-stopped \
  -e RUNNER_REPO_URL=https://example.invalid/example/repository \
  -e RUNNER_NAME=example-runner-01 \
  -e RUNNER_LABELS=example \
  -e RUNNER_TOKEN_FILE=/run/secrets/runner-token \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v example-runner-state:/runner \
  -v /run/example-runner-secrets:/run/secrets \
  ghcr.io/arawak/ci-runner-build@sha256:<digest>

The token file must be writable by the container so the entrypoint can remove it immediately after reading it. Never bake registration values into a derived image.

Capability verification action

Pin the action to a reviewed full commit:

- name: Verify Docker runner contract
  uses: arawak/ci-runners@0123456789abcdef0123456789abcdef01234567
  with:
    profile: docker

Supported profiles:

• base
• docker
• deploy
• local-ollama

local-ollama performs only a bounded /api/tags health request to the caller-provided OLLAMA_BASE_URL.

Releases and security

Releases are rebuilt from protected main, published without a latest tag, scanned, supplied with a BuildKit SBOM, and attested through GitHub. Consumer repositories remain responsible for reviewing and updating pinned digests.

Anonymous pull verification:

DOCKER_CONFIG="$(mktemp -d)" docker pull \
  ghcr.io/arawak/ci-runner-build@sha256:<digest>

Provenance verification:

gh attestation verify \
  oci://ghcr.io/arawak/ci-runner-build@sha256:<digest> \
  --owner arawak

See SECURITY.md for private vulnerability reporting.

Development

bash tests/test-verify-runner-capabilities.sh
bash tests/test-entrypoint.sh
bash tests/test-build-image.sh
bash tests/test-public-content.sh
bash tests/test-workflow-policy.sh
shellcheck images/build/entrypoint.sh scripts/*.sh tests/*.sh
actionlint

Tests build and remove only the local ci-runner-build:test tag. They never prune Docker.