Skip to content

README.md

Latest commit

 

History

History
60 lines (43 loc) · 2.42 KB

README.md

File metadata and controls

60 lines (43 loc) · 2.42 KB
Raw

github-runner-images

Container images for self-hosted GitHub Actions runners used by Government of Alberta ADSP projects. Each image is the redhat-actions runner base plus the system dependencies for a specific end-to-end test framework.

They exist because CI e2e jobs must run against network-private dev/test environment URLs that GitHub-hosted runners can't reach. Deployed as self-hosted runners in OpenShift, they run inside the network.

Images

Image For
ghcr.io/govalta/github-runner-playwright Playwright e2e (Chromium) — @abgov/nx-adsp-generated app pipelines
ghcr.io/govalta/github-runner-cypress Cypress e2e — adsp-applications

Node and the test framework/browser are installed per job (via actions/setup-node + npm ci + npx playwright install / cypress-io/github-action). These images therefore only carry the browser system libraries — which Playwright's/Cypress's own dep-installers don't cover on RHEL/UBI — and stay version-agnostic.

Publishing

.github/workflows/publish.yml builds each variant and pushes to GHCR on:

  • push to main touching images/**,
  • a weekly schedule (base-image / OS security patches),
  • manual dispatch.

Packages are public: the images contain only public software and no credentials (runner registration is supplied at deploy time), and public means consumers need no pull secret. After the first publish, set each GHCR package's visibility to Public once in its package settings.

Consuming (self-hosted runner in OpenShift)

Run the image as a self-hosted runner Deployment, providing registration via env (GITHUB_OWNER, GITHUB_REPOSITORY, GITHUB_PAT, RUNNER_LABELS, …). The @abgov/nx-oc:pipeline generator emits this Deployment for generated repos.

Two guardrails:

  • Mount the internal CA at runtime (NODE_EXTRA_CA_CERTS → a mounted ConfigMap/Secret). Do not bake internal certificates into these public images.
  • Never register these runners against a public repo that accepts untrusted fork PRs — a self-hosted runner executes PR code inside your cluster. Use private repos or gated workflows.

Adding a variant

Add images/<variant>/Dockerfile (FROM quay.io/redhat-github-actions/runner + that framework's browser deps) and add <variant> to the matrix in publish.yml.

License

Apache-2.0 — see LICENSE.