Repository navigation
fix(runner): configure JIT entrypoint and smoke images - #1
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ephemeral Imp guests can now configure an Actions runner from their one-time JIT payload before the runner process starts, including the explicit root opt-in required by the upstream runner. The payload is unset before
run.shis exec'd and the wrapper never traces or prints it.The publish workflow now proves the amd64 image path before it can publish: the smoke inspects the built runner layer, exercises the root wrapper with a synthetic value, and verifies CA trust, DNS, eth0, and Git HTTPS from the base image. Pull requests run this smoke without authenticating or publishing; immutable GHCR publication remains limited to the existing tag/manual workflow paths.
Test plan
RUNNER_VERSION=2.337.0 ./build.shdocker buildx build --platform linux/amd64 --load -t imp-runner-base:jit-smoke-local basedocker buildx build --platform linux/amd64 --load -t imp-runner-layer:jit-smoke-local runner-layerBASE_IMAGE=imp-runner-base:jit-smoke-local RUNNER_IMAGE=imp-runner-layer:jit-smoke-local ./smoke.shThe smoke deliberately does not claim a composite-rootfs or Firecracker boot; those require the Imp runtime/kernel path.