GitHub runner
- Canonical IS DevOps
Channel | Revision | Published | Runs on |
---|---|---|---|
latest/stable | 308 | 11 Dec 2024 | |
latest/stable | 302 | 02 Dec 2024 | |
latest/stable | 1 | 09 Feb 2022 | |
latest/beta | 317 | 11 Dec 2024 | |
latest/beta | 310 | 28 Nov 2024 | |
latest/edge | 322 | 20 Dec 2024 | |
latest/edge | 310 | 28 Nov 2024 | |
latest/edge | 4 | 26 Apr 2022 | |
local-lxd/stable | 306 | 17 Dec 2024 | |
local-lxd/edge | 306 | 27 Nov 2024 | |
1/stable | 177 | 05 Jun 2024 | |
1/edge | 177 | 05 Jun 2024 |
juju deploy github-runner
Deploy universal operators easily with Juju, the Universal Operator Lifecycle Manager.
Platform:
How to comply with security requirements
According to GitHub, running code inside the GitHub self-hosted runner poses a significant security risk of arbitrary code execution. The self-hosted runners managed by the charm are isolated in its own single-use virtual machine instance. In addition, the charm enforces some repository settings to ensure all code running on the self-hosted runners is reviewed by someone trusted.
The repository settings are enforced with the repo-policy-compliance Python library. The enforced rules differ depending on how the GitHub Actions workflow is triggered. The details can be found in the README.
In this guide, a recommended set of policies will be presented, but any set repository settings that passes the Python library checks will work with the self-hosted runners managed by this charm.
Recommended policy
- For outside collaborators the permission should be set to read. See here for instructions to change collaborator permissions. Outside collaborators will still be able to contribute with pull requests, but reviews will be needed. Details in a later section.
- Create the following branch protection rules, with the instructions here:
- branch name pattern
**
withRequire signed commits
enabled. - branch name pattern matching only the default branch of the repository, such as
main
, with the follow enabled:Dismiss stale pull request approvals when new commits are pushed
Required signed commits
Do not allow bypassing the above settings
- branch name pattern
With these settings, the common workflow of creating branches with pull requests and merging to the default branch is supported. Other GitHub Actions workflow triggers such as workflow_dispatch
, push
, and schedule
are supported as well.
Working with outside collaborators
Generally, outside collaborators are not completely trusted, but still would need to contribute in some manner. As such, this charm requires pull requests by outside collaborators to be reviewed by someone with write
permission or above. Once the review is completed, the reviewer should add a comment including the following string: /canonical/self-hosted-runners/run-workflows <commit SHA>
, where <commit SHA>
is the commit SHA of the approved commit. Once posted, the self-hosted runners will run the workflow for this commit.