From 0eff56d611235e739b82498abc595205c2e2830a Mon Sep 17 00:00:00 2001
From: Mark Garratt <github@0g7.uk>
Date: Sat, 27 Jun 2026 13:13:43 +0100
Subject: [PATCH] feat(gha-runner): custom ARC runner image with build tools

The minimal actions/actions-runner image lacks tools my home cluster's
self-hosted workflows need (make/build-essential for Makefile targets + Python
C-extensions, libatomic1 for pnpm, the docker compose plugin for compose smoke
tests), so lint/test jobs fail on the runners.

Add an arm64-only gha-runner image (FROM actions/actions-runner + those packages),
built and published by the standard matrix (publish.yml) like every other image.
arm64-only because the ARC runners are aarch64.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 images/gha-runner/Dockerfile | 37 ++++++++++++++++++++++++++++++++++++
 images/gha-runner/README.md  | 15 +++++++++++++++
 images/gha-runner/image.toml |  6 ++++++
 3 files changed, 58 insertions(+)
 create mode 100644 images/gha-runner/Dockerfile
 create mode 100644 images/gha-runner/README.md
 create mode 100644 images/gha-runner/image.toml

diff --git a/images/gha-runner/Dockerfile b/images/gha-runner/Dockerfile
new file mode 100644
index 0000000..1118a8d
--- /dev/null
+++ b/images/gha-runner/Dockerfile
@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1
+# Custom GitHub Actions runner image for my home cluster's ARC scale set.
+#
+# The upstream actions/actions-runner image is intentionally minimal and lacks
+# tools that ubuntu-latest ships and our workflows assume:
+#   make + build-essential -> Makefile targets and Python C-extension builds
+#   libatomic1             -> pnpm's prebuilt binary needs libatomic.so.1
+#   docker compose plugin  -> the `docker compose` subcommand (compose smoke tests)
+#
+# arm64-only: the cluster nodes (and therefore the runners) are aarch64.
+ARG RUNNER_VERSION=2.335.1
+FROM ghcr.io/actions/actions-runner:${RUNNER_VERSION}
+
+ARG COMPOSE_VERSION=v2.32.4
+
+USER root
+
+# hadolint ignore=DL3008
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      build-essential \
+      ca-certificates \
+      curl \
+      git \
+      jq \
+      libatomic1 \
+      make \
+ && rm -rf /var/lib/apt/lists/*
+
+# Docker Compose v2 as a CLI plugin (not packaged in the runner image). aarch64
+# binary into a standard cli-plugins search path so `docker compose` resolves.
+RUN mkdir -p /usr/local/lib/docker/cli-plugins \
+ && curl -fsSL "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-aarch64" \
+      -o /usr/local/lib/docker/cli-plugins/docker-compose \
+ && chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+
+USER runner
diff --git a/images/gha-runner/README.md b/images/gha-runner/README.md
new file mode 100644
index 0000000..92cace5
--- /dev/null
+++ b/images/gha-runner/README.md
@@ -0,0 +1,15 @@
+# gha-runner
+
+Custom GitHub Actions runner image for my **home cluster's ARC scale set** — the
+upstream `actions/actions-runner` plus the tools `ubuntu-latest` ships that the
+minimal image doesn't, so self-hosted lint/test jobs work:
+
+- `make` + `build-essential` — Makefile targets and Python C-extension builds
+- `libatomic1` — pnpm's prebuilt binary needs `libatomic.so.1`
+- the `docker compose` CLI plugin — compose-based smoke tests
+
+`arm64`-only (the runners are aarch64). Built and published by the standard
+matrix (`publish.yml`) like every other image, to
+`ghcr.io/mgarratt/docker-images/gha-runner`. This repo is public, so the package
+is public too and the ARC scale set pulls it without a secret; the
+`arc-runner-set` HelmRelease in the home cluster points its runner `image:` here.
diff --git a/images/gha-runner/image.toml b/images/gha-runner/image.toml
new file mode 100644
index 0000000..1d38a2a
--- /dev/null
+++ b/images/gha-runner/image.toml
@@ -0,0 +1,6 @@
+image = "gha-runner"
+# arm64-only: the ARC scale-set runners are aarch64, so there is no amd64 runner
+# to schedule an amd64 variant on. The matrix passes these per-image platforms to
+# buildx.
+platforms = ["linux/arm64"]
+build_args = { RUNNER_VERSION = "2.335.1", COMPOSE_VERSION = "v2.32.4" }