Repository navigation
ci: run jobs on gcrunner - #18
Merged
Merged
Conversation
GitHub-hosted runners don't start jobs for this repository while it's
private ("recent account payments have failed or your spending limit needs
to be increased"), so nothing has run since 2026-10-12. Lint, Workflow lint,
Install, Nightly end-to-end, Security scan, Renovate generate and Upstream
drift now run on Appwrite's gcrunner runners (an ephemeral Compute Engine VM
per job), as appwrite/appwrite does: c3d-standard-8 for the nightly,
c3d-standard-4 for everything else, so the install jobs get the 4 vCPUs and
16 GB of a public GitHub runner.
Pull requests from forks fall back to ubuntu-latest, as in appwrite's ci.yml,
so code from outside the repository never runs on Appwrite's machines.
Release and Scorecard stay on GitHub-hosted runners: Scorecard only publishes
results from them, and the release's provenance should name GitHub's
runners. Both only run once the repository is public.
levivannoort
added
the
skip-changelog
🟢 Tier S · Ready to mergeThe pull request moves selected CI workflows to Appwrite gcrunner VM runners while keeping Release and Scorecard on GitHub-hosted runners. It documents the runner setup and fork-approval caveat, runs Artifact Hub lint as the runner UID, and updates Renovate to track the lint image. The latest commit clarifies in CONTRIBUTING.md that the workflow runner expression is not a security boundary and describes the approval requirement before the repository becomes public. Latest changes: The latest commit updates CONTRIBUTING.md to explain that fork-controlled workflows can request gcrunner and to document the approval guard required before the repository is public.
📂 Walkthrough · 9
Reviewed the commits since |
![hansi-codes[bot]](https://avatars.githubusercontent.com/in/5046327?s=60&v=4){kind=small}
As a job container with --user 1001, ah couldn't write the runner's files on gcrunner, whose runner user has another uid (EACCES on _runner_file_commands). docker run with the runner's own uid works on any runner. Renovate keeps the image current through the Trivy image's custom manager, now matching AH_IMAGE too.
A pull request runs its own copy of the workflow, so a fork can rewrite runs-on and ask for gcrunner, which doesn't check where a job comes from. Say so, and name the guard for a public repository: maintainer approval of every fork pull request's workflow runs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
GitHub-hosted runners don't start jobs for this repository while it's private ("The job was not started because recent account payments have failed or your spending limit needs to be increased"), so CI hasn't run since 2026-10-12. This moves the CI workflows to Appwrite's gcrunner runners, as
appwrite/appwriteuses: an ephemeral Compute Engine VM per job.c3d-standard-4c3d-standard-4: the 4 vCPUs and 16 GB of a public GitHub runner, double what the private runners hadc3d-standard-8c3d-standard-4appwrite/appwrite'sci.yml:gcrunner=<run id>-<job>-<index>/machine=<type>, unique per job. The machine is set in the label, so no.github/gcrunner.ymlis needed; c3d is the family Appwrite's runners already use.ubuntu-latest(same expression asappwrite/appwrite). This is not a security boundary (hansi-codes, below): a fork PR runs its own copy of the workflow and can ask for gcrunner, and gcrunner provisions any queued job with a gcrunner label. No risk while the repository is private (GitHub doesn't run fork PR workflows there by default); before it goes public, see Before going public.CONTRIBUTING.mdexplains the runners.skip-changelog: CI only.Before going public
One of these has to be in place, or a fork PR can run arbitrary code on a VM in Appwrite's GCP project:
runs-on. The stopgap;CONTRIBUTING.mdsays this.appwrite/appwrite.Testing
actionlintandzizmor(1.30.1, the repository's config) are clean.lint.yaml,actions-lint.yamlandtest-install.yaml, so Lint and test, Workflow lint and Install all run on gcrunner. If they stay queued, the gcrunner GitHub App isn't installed on this repository yet (an org owner adds it).--user 1001(the gcrunner runner user has another uid), fixed by runningahwithdocker run -u "$(id -u):$(id -g)".After merging
#16 and #17 run their checks from their own branches, so rebase them on
mainto pick up the runners.