6 Commits

Include renames

Author	SHA1	Message	Date
claude-bot	dd758e6806	feat(runner): install zstd so the actions cache is not gzipped single-threaded ... actions/cache -- and actions/setup-go, which builds on it -- packs its archive with zstdmt when zstd is present and falls back to single-threaded gzip when it is not. The archive name says which happened: cache.tzst against cache.tgz. Measured in l.kirchner/patchmgr, CI run 1957. The cache is GOMODCACHE plus GOCACHE and runs to 2-5 GB. runner-gpu has zstd and writes cache.tzst; runner-01, -02 and -03 write cache.tgz, and go test -race (stable) spent 605 seconds packing it for a job with 41 seconds of work. Across all eight jobs of that run, 2312 of 3146 seconds went into this step. This does not settle whether the cache is wanted at all -- in host mode with a persistent home both directories survive between jobs anyway, and patchmgr is switching it off for that reason. But as long as any repository on the instance uses it, it should not be compressed on one core. zstd is a package for the post step, not for jobs, so it sits with the others rather than in a workflow: this runner installs nothing at job time, by design.	2026-09-03 01:04:02 +02:00
claude-bot	3c77d34b7e	docs(runner): name the protoc coupling and fix a mechanism claim ... Both from the cross-review, both fair. "Go setzt CGO_ENABLED=0" is right about the effect and wrong about the mechanism: Go does not set the variable, cgo simply stays off when no C compiler is found, and go env then reports 0. Reworded. And protoc on an instance-wide runner ties every repository to the distribution's version -- 3.21.x on Debian 12. Unlike make and gcc that is a code generator, so a distro upgrade changes generated code for all users at once. The comment says so now, and says where a project that needs its own version should pin it instead of raising it here for everybody.	2026-08-18 23:01:34 +02:00
claude-bot	8c83fb372b	feat(runner): install the build toolchain compiled languages need ... The runner is host-mode, so there is no image bringing tools along: what is not on this LXC, no job has. Measured on l.kirchner/patchmgr, a Go project, where all six CI jobs were assigned and every one of them died in the first seconds: make all make: command not found go test -race go: -race requires cgo; enable cgo by setting CGO_ENABLED=1 make proto sudo: command not found Four packages, each for a reason: make the gate commands are make targets gcc Go turns CGO_ENABLED off when it finds no C compiler, and the race detector cannot be built without cgo protobuf-compiler protoc itself libprotobuf-dev the well-known .proto includes under /usr/include/google/protobuf; without them protoc fails even though the binary is there sudo stays absent on purpose. A workflow must not be able to install anything on this runner -- what is needed is declared here, in the script, and not in somebody's pipeline. That also keeps the security note at the top of this file honest: the LXC owns nothing, and it gains nothing at a workflow's request. Go is not in the list. Projects fetch it through actions/setup-go, because CI matrices run more than one version. Applied to the running LXC (301 on pve-gamer) while the runner was idle, then verified: make 4.3, gcc 12.2.0, libprotoc 3.21.12, 11 .proto includes present. The service PATH already contains /usr/bin, so no restart was needed.	2026-08-18 22:54:54 +02:00
l.kirchner	63a735e697	fix(runner): Re-Review-Finding 85 — run_user wechselt via env -C ins RUNNER_DIR (.runner landet sonst in /)	2026-06-12 15:26:53 +02:00
l.kirchner	f06e873118	fix(runner): Review-Findings 90/88/82/80 (+70) — Re-Run ohne deploy.env, Sicherheitsmodell dokumentiert, Requires=docker, strikte Input-Validierung, argv statt Shell-Interpolation, Unit-Härtung	2026-06-12 15:04:57 +02:00
l.kirchner	ad04edec5b	feat(runner): Installer — act_runner instanzweit als unprivilegierter User, Docker, ohne sudoers	2026-06-12 13:25:42 +02:00