mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-31 12:44:44 +00:00
e6ed17b918
Add three options to `services.github-runners.<name>`: - `githubApp`: authenticate via a GitHub App installation instead of a `tokenFile`. The service derives a short-lived installation token from the App's private key on each start, registers the runner, and de-registers it on stop. The PEM key is a deployed secret, never copied into the store. - `count`: fan a single entry out into N identical runner services. `github-runner-<name>` is unchanged for `count == 1`, suffixed `-<n>` for `count > 1`. - `orgs`: serve several organisations (or repositories) from one entry, fanning out into `github-runner-<name>-<org>-<n>`. The entry-level auth is shared across orgs and only the App `login` changes per org; the per-org `count` defaults to the entry-level `count`. This brings the multi-org consumption shape of the soon-to-be-removed srvos runner role (nix-community/srvos#836, nix-community/srvos#837) into nixpkgs. An entry without `orgs` and with the default `count = 1` is unchanged, so existing runners do not re-register.
59 lines
1.9 KiB
Bash
59 lines
1.9 KiB
Bash
# shellcheck shell=bash
|
|
# Fetch a self-hosted runner registration token from the GitHub API.
|
|
#
|
|
# Adapted from https://github.com/myoung34/docker-github-actions-runner (MIT,
|
|
# Copyright (c) 2020 Marcus Young).
|
|
#
|
|
# Expects the following environment variables:
|
|
# * ACCESS_TOKEN a token authorized to manage self-hosted runners
|
|
# (a GitHub App installation token or a suitable PAT)
|
|
# * RUNNER_SCOPE one of `org`, `ent` or `repo`
|
|
# * ORG_NAME the org login (for `org` scope)
|
|
# * ENTERPRISE_NAME the enterprise slug (for `ent` scope)
|
|
# * REPO_URL the repository URL (for `repo` scope)
|
|
# * GITHUB_HOST optional, defaults to github.com (set for GHES)
|
|
#
|
|
# Prints `{"token": ..., "full_url": ...}` to stdout.
|
|
|
|
_GITHUB_HOST=${GITHUB_HOST:="github.com"}
|
|
|
|
# If the host is not github.com, use the GitHub Enterprise Server API endpoint.
|
|
if [[ ${_GITHUB_HOST} == "github.com" ]]; then
|
|
URI="https://api.${_GITHUB_HOST}"
|
|
else
|
|
URI="https://${_GITHUB_HOST}/api/v3"
|
|
fi
|
|
|
|
API_VERSION=v3
|
|
API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
|
|
AUTH_HEADER="Authorization: token ${ACCESS_TOKEN}"
|
|
CONTENT_LENGTH_HEADER="Content-Length: 0"
|
|
|
|
case ${RUNNER_SCOPE} in
|
|
org*)
|
|
_FULL_URL="${URI}/orgs/${ORG_NAME}/actions/runners/registration-token"
|
|
;;
|
|
|
|
ent*)
|
|
_FULL_URL="${URI}/enterprises/${ENTERPRISE_NAME}/actions/runners/registration-token"
|
|
;;
|
|
|
|
*)
|
|
_PROTO="https://"
|
|
_URL="${REPO_URL/${_PROTO}/}"
|
|
_PATH="$(echo "${_URL}" | grep / | cut -d/ -f2-)"
|
|
_ACCOUNT="$(echo "${_PATH}" | cut -d/ -f1)"
|
|
_REPO="$(echo "${_PATH}" | cut -d/ -f2)"
|
|
_FULL_URL="${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners/registration-token"
|
|
;;
|
|
esac
|
|
|
|
RUNNER_TOKEN="$(curl -fsSX POST \
|
|
-H "${CONTENT_LENGTH_HEADER}" \
|
|
-H "${AUTH_HEADER}" \
|
|
-H "${API_HEADER}" \
|
|
"${_FULL_URL}" |
|
|
jq -r '.token')"
|
|
|
|
echo "{\"token\": \"${RUNNER_TOKEN}\", \"full_url\": \"${_FULL_URL}\"}"
|