| 1 | # Rebuilds the base image of g1t's sandboxes (services/runner/base/Dockerfile: |
| 2 | # the OS, toolchains and the Claude Code CLI), pushes it to Cloudflare's |
| 3 | # registry, and opens a pull request that records it in |
| 4 | # services/runner/base.json. Merging that pull request is what rolls it out: |
| 5 | # the next deploy builds the runner's image on it, in seconds. |
| 6 | # |
| 7 | # Weekly, for security updates and new stable toolchains; when the base's |
| 8 | # folder changes on main (a change that forgot to rebuild it); and by hand. |
| 9 | # |
| 10 | # It runs on a self-hosted runner with the `docker` label. g1t's own |
| 11 | # machines have Docker now, but this build's own downloads (Docker's apt |
| 12 | # repository over HTTPS) do not yet trust a guarded job's egress |
| 13 | # certificate, so it stays where the network is open. Until a runner is |
| 14 | # registered, run the same thing by hand on a machine with Docker: |
| 15 | # |
| 16 | # node scripts/deploy.mjs build-base |
| 17 | # |
| 18 | # and commit services/runner/base.json. docs/DEPLOYING.md explains both. |
| 19 | name: Runner base image |
| 20 | |
| 21 | on: |
| 22 | schedule: |
| 23 | - cron: "17 6 * * 1" |
| 24 | push: |
| 25 | branches: [main] |
| 26 | paths: |
| 27 | - services/runner/base/** |
| 28 | workflow_dispatch: |
| 29 | inputs: |
| 30 | no_cache: |
| 31 | description: "Build every layer again, ignoring the previous base" |
| 32 | type: boolean |
| 33 | default: false |
| 34 | |
| 35 | # Its token pushes the branch with base.json and opens the pull request. |
| 36 | # What a job's token does starts no workflows, so that pull request's |
| 37 | # checks start when someone pushes to it or runs CI by hand. |
| 38 | permissions: |
| 39 | contents: write |
| 40 | pull-requests: write |
| 41 | |
| 42 | concurrency: |
| 43 | group: runner-base |
| 44 | cancel-in-progress: false |
| 45 | |
| 46 | env: |
| 47 | CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} |
| 48 | WRANGLER_SEND_METRICS: "false" |
| 49 | |
| 50 | jobs: |
| 51 | build: |
| 52 | name: Build and push the base |
| 53 | runs-on: [self-hosted, docker] |
| 54 | environment: production |
| 55 | timeout-minutes: 60 |
| 56 | steps: |
| 57 | - uses: actions/checkout@v5 |
| 58 | - name: Install Wrangler |
| 59 | run: npm ci --workspaces=false --no-audit --no-fund |
| 60 | - name: Build and push |
| 61 | env: |
| 62 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 63 | CI: "true" |
| 64 | NO_CACHE: ${{ inputs.no_cache }} |
| 65 | run: | |
| 66 | args=() |
| 67 | if [ "$NO_CACHE" = "true" ]; then args+=(--no-cache); fi |
| 68 | node scripts/deploy.mjs build-base "${args[@]}" |
| 69 | # The runner's own image on the new base, so the deploy after the |
| 70 | # merge finds it in the registry instead of building it. |
| 71 | - name: Build and push the runner's image on it |
| 72 | env: |
| 73 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 74 | CI: "true" |
| 75 | run: node scripts/deploy.mjs image |
| 76 | - name: Open a pull request with base.json |
| 77 | env: |
| 78 | G1T_TOKEN: ${{ github.token }} |
| 79 | REPO: ${{ github.repository }} |
| 80 | run: | |
| 81 | if git diff --quiet -- services/runner/base.json; then |
| 82 | echo "The base is unchanged." |
| 83 | exit 0 |
| 84 | fi |
| 85 | branch="runner-base/$(date -u +%Y%m%d-%H%M)" |
| 86 | git config user.name "g1t" |
| 87 | git config user.email "g1t@users.noreply.g1t.sh" |
| 88 | git checkout -b "$branch" |
| 89 | git add services/runner/base.json |
| 90 | git commit -m "A new base image for g1t's sandboxes" |
| 91 | git push origin "$branch" |
| 92 | tag=$(node -e 'console.log(require("./services/runner/base.json").image.split(":").pop())') |
| 93 | body=$(node -e 'const b=require("./services/runner/base.json"); console.log("Built and pushed by the Runner base image workflow.\n\n| | |\n| --- | --- |\n" + Object.entries(b.versions).map(([k,v]) => `| ${k} | ${v} |`).join("\n") + `\n| size | ${(b.size_bytes/1e9).toFixed(2)} GB unpacked |`)') |
| 94 | curl -fsS -X POST "https://api.g1t.sh/repos/$REPO/pulls" \ |
| 95 | -H "Authorization: Bearer $G1T_TOKEN" -H "Content-Type: application/json" \ |
| 96 | -d "$(node -e 'console.log(JSON.stringify({ title: `Runner base image ${process.argv[1]}`, branch: process.argv[2], body: process.argv[3] }))' "$tag" "$branch" "$body")" |