Merge pull request 'ci: use dedicated host deploy runner' (#56) from codex/use-host-deploy-runner into main

.forgejo/workflows/dimensionlab-website.yml

@@ -48,17 +48,20 @@ jobs:
   deploy:
     needs: ci
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: docker
-    container:
-      image: ghcr.io/catthehacker/ubuntu:act-latest
-      options: --security-opt label=disable
+    runs-on: deploy
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: https://data.forgejo.org/actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: false
+        run: |
+          if [ -d .git ]; then
+            git remote set-url origin git@git.dimensionlab.net:vince/dimensionlab-website.git
+          else
+            git init
+            git remote add origin git@git.dimensionlab.net:vince/dimensionlab-website.git
+          fi
+          git fetch --force --prune --depth=1 origin "$GITHUB_SHA"
+          git checkout --force --detach "$GITHUB_SHA"
+          git clean -ffdx
 
       - name: Initialize submodules
         run: |
@@ -67,13 +70,14 @@ jobs:
 
       - name: Verify Podman deployment socket
         run: |
-          timeout 15s docker version
-          unit="$(timeout 15s docker inspect dimensionlab-website --format '{{ index .Config.Labels "PODMAN_SYSTEMD_UNIT" }}')"
+          command -v podman
+          command -v systemctl
+          unit="$(timeout 15s podman inspect dimensionlab-website --format '{{ index .Config.Labels "PODMAN_SYSTEMD_UNIT" }}')"
           test "$unit" = "dimensionlab-website.service"
 
       - name: Deploy production website
         env:
-          DEPLOY_CONTAINER_CLI: docker
+          DEPLOY_CONTAINER_CLI: podman
           DEPLOY_EVENT_NAME: ${{ github.event_name }}
           DEPLOY_REF: ${{ github.ref }}
           DEPLOY_RESTART_STRATEGY: quadlet-container

README.md

@@ -168,15 +168,20 @@ Merges to `main` run `.forgejo/workflows/dimensionlab-website.yml`. Pull
 requests run check, test, and build only; the deploy job is guarded to run only
 for `push` events on `refs/heads/main`.
 
-The Dimension Lab runner exposes the rootless Podman socket to job containers as
-`/var/run/docker.sock`. Because this host uses SELinux labeling, the runner
-configuration must set:
+The workflow uses two runner classes. Pull request CI runs on the containerized
+`docker` runner. Production deployment runs on a separate host runner with the
+`deploy:host` label so the guarded deploy script can use the user's rootless
+`podman` and `systemctl --user` commands directly. The deploy job uses a
+shell-only `git fetch` checkout so the host runner does not need a Node runtime
+for checkout actions.
 
 ```yaml
-container:
-  options: --security-opt label=disable
+runner:
+  labels:
+    - deploy:host
 ```
 
-The deploy job also performs a socket preflight against the
+The deploy job also performs a host preflight against the
 `dimensionlab-website.service` Podman label before it builds or restarts the
-production container.
+production container. Do not give the general pull request runner deployment
+socket access; keep deploy privileges on the dedicated `deploy` runner.

apps/web/src/lib/workspace-boundary.test.ts

@@ -275,10 +275,15 @@ describe("workspace boundaries", () => {
     expect(workflow).toContain("bun run test");
     expect(workflow).toContain("bun run build");
     expect(workflow).toContain("needs: ci");
-    expect(workflow).toContain("options: --security-opt label=disable");
+    expect(workflow).toContain("runs-on: deploy");
     expect(workflow).toContain("github.event_name == 'push'");
     expect(workflow).toContain("github.ref == 'refs/heads/main'");
-    expect(workflow).toContain("docker inspect dimensionlab-website");
+    expect(workflow).toContain(
+      "git remote add origin git@git.dimensionlab.net:vince/dimensionlab-website.git",
+    );
+    expect(workflow).toContain('git fetch --force --prune --depth=1 origin "$GITHUB_SHA"');
+    expect(workflow).toContain("podman inspect dimensionlab-website");
+    expect(workflow).toContain("DEPLOY_CONTAINER_CLI: podman");
     expect(workflow).toContain("PODMAN_SYSTEMD_UNIT");
     expect(workflow).toContain("scripts/deploy-dimensionlab-website.sh");
   });