vince/dimensionlab-website
1
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

ci: use dedicated host deploy runner
All checks were successful
Dimension Lab website / ci (pull_request) Successful in 18s
Details
Dimension Lab website / deploy (pull_request) Has been skipped
Details

Browse source
This commit is contained in:
vince 2026-06-20 17:34:09 +02:00
parent da9a5a942d
commit d00a7b3b80
3 changed files with 34 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

19
README.md
View file

@ -168,15 +168,20 @@ Merges to `main` run `.forgejo/workflows/dimensionlab-website.yml`. Pull
requests run check, test, and build only; the deploy job is guarded to run only
for `push` events on `refs/heads/main`.
The Dimension Lab runner exposes the rootless Podman socket to job containers as
`/var/run/docker.sock`. Because this host uses SELinux labeling, the runner
configuration must set:
The workflow uses two runner classes. Pull request CI runs on the containerized
`docker` runner. Production deployment runs on a separate host runner with the
`deploy:host` label so the guarded deploy script can use the user's rootless
`podman` and `systemctl --user` commands directly. The deploy job uses a
shell-only `git fetch` checkout so the host runner does not need a Node runtime
for checkout actions.
```yaml
container:
options: --security-opt label=disable
runner:
labels:
- deploy:host
```
The deploy job also performs a socket preflight against the
The deploy job also performs a host preflight against the
`dimensionlab-website.service` Podman label before it builds or restarts the
production container.
production container. Do not give the general pull request runner deployment
socket access; keep deploy privileges on the dedicated `deploy` runner.