scruffydude/project-awry
Watch
1
0
Fork
You've already forked project-awry
 0
Code Issues Pull requests Projects Releases 22 Packages Wiki Activity Actions

CI runner docs: treat the registration token and .runner as secrets #75

Merged
Nimby merged 1 commit from task/74-runner-secrets into main 2026-10-05 18:47:53 -04:00
Conversation 0 Commits 1 Files changed 1 +20 -3
Nimby commented 2026-10-05 18:47:52 -04:00
Collaborator
Copy link

Closes #74

Docs-only change to the runner setup in tools/ci/README.md:

  • The registration token is reusable until reset, and any runner registered with it receives this repo's jobs, including secrets. So: paste it only into the command on optibcc, and reset it right after registering. The registered runner keeps working.
  • data/.runner is the runner's own credential. It's reused on every restart, so the token is never needed again. Lock it down with docker compose run --rm runner chmod 600 /data/.runner. The file is root-owned because the runner runs as root; the image's entrypoint is dumb-init, so arbitrary commands work through compose run, which I checked against the 13.2.0 image config.
  • If it leaks: delete the runner in Settings → Actions → Runners, then re-register.
  • RELEASE_TOKEN lives in Forgejo repository secrets, injected per job and masked in logs, never on disk.

🤖 Generated with Claude Code

Closes #74 Docs-only change to the runner setup in `tools/ci/README.md`: - The registration token is reusable until reset, and any runner registered with it receives this repo's jobs, including secrets. So: paste it only into the command on optibcc, and reset it right after registering. The registered runner keeps working. - `data/.runner` is the runner's own credential. It's reused on every restart, so the token is never needed again. Lock it down with `docker compose run --rm runner chmod 600 /data/.runner`. The file is root-owned because the runner runs as root; the image's entrypoint is `dumb-init`, so arbitrary commands work through `compose run`, which I checked against the 13.2.0 image config. - If it leaks: delete the runner in Settings → Actions → Runners, then re-register. - `RELEASE_TOKEN` lives in Forgejo repository secrets, injected per job and masked in logs, never on disk. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Forgejo runner registration tokens are reusable until reset, and any
runner registered with one receives the repo's jobs and their secrets.
Document keeping the token out of chats, locking down data/.runner (via
the container, since the root-run runner owns it), resetting the token
after registering, revoking a leaked runner, and where RELEASE_TOKEN
lives.

Closes #74

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nimby merged commit 0ae8a9ead2 into main 2026-10-05 18:47:53 -04:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
scruffydude/project-awry!75
No description provided.