Commit `8ab6240513`

8ab62405132a89cc9b2c19486c47684d2f6b9fe9

parent: fb6e9dcfa4

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-29 00:07 UTC

deploy: runner comment and Admin procedure name the real attachments

cmc/ci-smoke no longer exists and ExecStart carries no -repos; the
scratch-repository check attaches the key and adds -repos for the run.

Closes #287

Layout: unified · split

.gitbay/wiki/Admin.org +10 −9

 containers and failed took CI down with it. Instead: create a throwaway
 repository the runner account can read (public, or granted read — a
 private one is "not found" to the runner and the build stays pending),
-give it one job that names the CI image, and deploy the runner with
+give it one job that names the CI image, attach the runner's key to it,
-=-repos= naming only that repository. The production unit, with its real
+and deploy the runner with =-repos= naming only that repository. The
-hardening, then claims nothing else; other repositories' builds queue
+production unit, with its real hardening, then claims nothing else;
-until =-repos= is switched back, which is a pause, not an outage.
+other repositories' builds queue until =-repos= is removed again, which
+is a pause, not an outage.
 #+begin_src sh
-gitbay repo create cmc/ci-smoke          # then push a .gitbay/ci.yml naming the image
+gitbay repo create cmc/runner-scratch   # then push a .gitbay/ci.yml naming the image
-sed -i 's#-repos krz/gitbay #-repos cmc/ci-smoke #' /etc/systemd/system/gitbay-runner.service.d/override.conf
+# on the host:
+gitbay repo runner add cmc/runner-scratch < /var/lib/gitbay-runner/.ssh/id_ed25519.pub
+sed -i 's#^ExecStart=/usr/local/bin/gitbay-runner #&-repos cmc/runner-scratch #' /etc/systemd/system/gitbay-runner.service.d/override.conf
 systemctl daemon-reload && systemctl restart gitbay-runner
-gitbay build log cmc/ci-smoke 1         # green: switch -repos back, redeploy
+gitbay build log cmc/runner-scratch 1   # green: remove -repos, redeploy, delete the scratch repository
 #+end_src
 *Do not deploy an isolating runner to a host that has not been
 make read-only. Those paths are prefixed =-= so they are ignored when
 absent: the drop-in installs on unprepared hosts too, and a unit that
 refused to start would stop every build.
-The nightly canary on =cmc/ci-smoke= only runs if the runner's =-repos=
-names that repository too; a scoped runner claims nothing else.
 =gitbay-runner-prune.timer= prunes unused images weekly, as the runner's
 user: rootless storage belongs to that user, and root's prune would not
 see it. An unpruned image store on a 40GB host is a slow outage.

deploy/gitbay-runner.override.conf +5 −3

 [Service]
 # The runner polls as a non-admin account with a runner-scoped key, and
 # claims only the repositories that key is attached to (`repo runner
-# add`): krz/gitbay and cmc/ci-smoke. The attachments are the boundary,
+# add`): krz/gitbay, krz/hutch, krz/keycask, krz/orgo, krz/skunky-art
-# so ExecStart names no -repos. cmc/ci-smoke is the nightly isolation
+# and cmc/cleberg.net. The attachments are the boundary, so ExecStart
-# canary; keep it attached or its scheduled build waits forever.
+# names no -repos. To validate a runner change, create a scratch
+# repository, attach this key to it, and run with -repos naming only
+# that repository until the change is proven (Admin wiki, CI runner).
 #
 # Two layers of resource caps. MemoryMax and CPUQuota bound the unit —
 # the runner and every build together — which is what keeps the forge

Commit 8ab6240513

Commit `8ab6240513`