feat(actions-runner): add a mise-managed CLI toolchain - #5
Merged
Conversation
gh and yq are standard workflow tooling that GitHub's hosted images ship and Ubuntu does not usefully package: there is no gh in the archive at all, and its `yq` is the unrelated Python jq-wrapper with different syntax. Without them, every workflow that opens a PR or patches a manifest curls its own copy into RUNNER_TEMP — exactly the per-repo drift this image exists to absorb. hadolint and shellcheck join them so lint jobs stop reaching for third-party setup actions. The list lives in mise.toml, one line per tool, so growing it costs no Dockerfile change. Renovate's native mise manager matches that filename by default, which is why the entries carry no `# renovate:` annotation; mise itself is a pinned release binary rather than the unpinned mise.run installer. Only static, version-insensitive binaries belong there — anything a workflow pins against stays with the setup-* actions and their RUNNER_TOOL_CACHE. The data dir stays root-owned and read-only to the runner user, with only the cache pointed somewhere writable. metadata.yaml's test is generic over mise.toml: it asserts the installed count matches the manifest and that every tool resolves through the shims and runs as the runner user, so adding a tool needs no edit there either. Signed-off-by: swibrow <15628653+swibrow@users.noreply.github.com>
Merged
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gh,yq,hadolintandshellcheckto theactions-runnerimage via a newmise.toml, one line per tool.ghandyqare standard workflow tooling GitHub's hosted images ship and Ubuntu does not usefully package — there is noghin the archive at all, and itsyqis the unrelated Python jq-wrapper with different syntax. Without them, every workflow that opens a PR or patches a manifest curls its own copy intoRUNNER_TEMP; swibrow/garrison was about to do exactly that in itsdeploy-pitowerjob.mise.tomlso growing it costs no Dockerfile change. Renovate's native mise manager matches that filename by default, hence no# renovate:annotations on the entries; mise itself is a pinned release binary, not the unpinnedmise.runinstaller.runneruser; only the cache points somewhere writable.version→2.336.0-3.Test plan
linux/amd64andlinux/arm64metadata.yamltest passes — it is generic overmise.toml, asserting the installed tool count matches the manifest and that every tool resolves through/opt/mise/shimsand runs as therunneruser, so adding a tool needs no edit there2.336.0-3(chore(arc): garrison runner image 2.336.0-3 and a bigger, warm runner pool swibrow/home-ops#1896)