Pin the general Forgejo runner label mapping in tracked config #661

New issue

Open

opened 2026-07-28 07:22:25 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-28 07:22:25 +00:00

Owner

Problem

deploy/forgejo-runner.yml registers the general runners non-interactively without an explicit label mapping, and runner-config.yml also omits labels. The live runners advertise docker because the persisted /data/.runner registration retains an implicit/default mapping.

A registration rotation or Forgejo Runner upgrade can therefore change the executor type or default job image outside tracked configuration. The docker-build and deploy pools already declare their label contracts explicitly.

Done condition

One tracked value explicitly defines the general docker label, executor type, and default bootstrap job image.
Registration and daemon configuration consume that same value without duplicating the contract.
Workflow-level container overrides to agentic-os:release continue to work.
The migration safely reconciles persisted registrations without exposing registration credentials.
Repository validation and runner documentation cover the explicit mapping.
Read-only live verification shows the runner advertising docker and a representative job using the intended default image.

Boundary

This is configuration hardening. The missing Python runtime affecting Telegram failure alerts is the more urgent defect and should remain independently fixable.

## Problem deploy/forgejo-runner.yml registers the general runners non-interactively without an explicit label mapping, and runner-config.yml also omits labels. The live runners advertise docker because the persisted /data/.runner registration retains an implicit/default mapping. A registration rotation or Forgejo Runner upgrade can therefore change the executor type or default job image outside tracked configuration. The docker-build and deploy pools already declare their label contracts explicitly. ## Done condition * One tracked value explicitly defines the general docker label, executor type, and default bootstrap job image. * Registration and daemon configuration consume that same value without duplicating the contract. * Workflow-level container overrides to agentic-os:release continue to work. * The migration safely reconciles persisted registrations without exposing registration credentials. * Repository validation and runner documentation cover the explicit mapping. * Read-only live verification shows the runner advertising docker and a representative job using the intended default image. ## Boundary This is configuration hardening. The missing Python runtime affecting Telegram failure alerts is the more urgent defect and should remain independently fixable.

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 03:46:33 +00:00

coilyco-ops added the

role/sysadmin

label

2026-08-25 08:02:23 +00:00

coilyco-ops added this to the Forgejo runners milestone

2026-08-29 05:41:05 +00:00