feat: add Lerd GitHub Actions runner preset

README.md

@@ -109,6 +109,7 @@ All of it is data. None of it ships in the binary.
 | | Service | What it is |
 |:-:|---|---|
 | <img src=".github/logos/floci.svg" width="28" height="28" alt=""> | `floci` | Floci, the open-source AWS emulator, no auth token and coexists with LocalStack |
+| <img src=".github/logos/github-actions-runner.svg" width="28" height="28" alt=""> | `github-actions-runner` | Runner image for the shared organization-scoped Lerd Actions service |
 | <img src=".github/logos/gotenberg.svg" width="28" height="28" alt=""> | `gotenberg` | Gotenberg API for PDF and document conversion |
 | <img src=".github/logos/localstack.svg" width="28" height="28" alt=""> | `localstack` | LocalStack, the AWS APIs run locally (SQS, SES, DynamoDB, Secrets Manager) |
 | <img src=".github/logos/mailpit.svg" width="28" height="28" alt=""> | `mailpit` | Mailpit SMTP catcher with a web inbox · **built into Lerd** |
@@ -119,6 +120,20 @@ All of it is data. None of it ships in the binary.
 
 Don't see what you need? [Add it](#contributing) — that's what this repo is for.
 
+### GitHub Actions runner
+
+`github-actions-runner` is the runner image base. It deliberately has no ports and
+contains no organization credentials. Use the
+[`lerd-add-actions-runner` skill](https://github.com/illuma-law/lerd-actions-runner/tree/main/skill)
+to install one short-named `gh-runner` Lerd service per host, register it at
+organization scope, and add only selected trusted private repositories to its
+restricted runner group. A shared runner handles one job at a time, so concurrent
+jobs wait for it to become free. The current workflow supports Linux x64, rootless Podman,
+and systemd user services. Do not run untrusted pull requests, forks, or
+`pull_request_target` jobs on this persistent runner. The released image is pinned
+by manifest digest in both service indexes. Existing workflows opt in by targeting
+the organization label.
+
 ## Usage
 
 You rarely touch the store directly: everything routes through the usual service commands.

schema/2/services/index.json

@@ -56,6 +56,14 @@
         "elasticsearch"
       ]
     },
+    {
+      "name": "github-actions-runner",
+      "description": "Persistent self-hosted GitHub Actions runner for Lerd projects",
+      "image": "ghcr.io/illuma-law/lerd-actions-runner:0.1.4@sha256:0910d97d7cd90c51283325a2c9c51504bf052d9e4a4075c7320c4989ec88c1be",
+      "category": "testing",
+      "icon": "bolt",
+      "color": "#6e40c9"
+    },
     {
       "name": "gotenberg",
       "description": "Gotenberg API for PDF generation and document conversion",

services/github-actions-runner.yaml

@@ -0,0 +1,11 @@
+name: github-actions-runner
+description: Persistent self-hosted GitHub Actions runner for Lerd projects
+image: ghcr.io/illuma-law/lerd-actions-runner:0.1.4@sha256:0910d97d7cd90c51283325a2c9c51504bf052d9e4a4075c7320c4989ec88c1be
+data_dir: /runner-data
+chown_data: true
+userns: keep-id:uid=1001,gid=1001
+environment:
+  RUNNER_LABELS: lerd
+category: testing
+icon: bolt
+color: '#6e40c9'

services/index.json

@@ -55,6 +55,14 @@
         "elasticsearch"
       ]
     },
+    {
+      "name": "github-actions-runner",
+      "description": "Persistent self-hosted GitHub Actions runner for Lerd projects",
+      "image": "ghcr.io/illuma-law/lerd-actions-runner:0.1.4@sha256:0910d97d7cd90c51283325a2c9c51504bf052d9e4a4075c7320c4989ec88c1be",
+      "category": "testing",
+      "icon": "bolt",
+      "color": "#6e40c9"
+    },
     {
       "name": "gotenberg",
       "description": "Gotenberg API for PDF generation and document conversion",