Implement Gitea Actions runner substrate

tools/gitea-runner-status.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+
+set -u
+
+GITEA_URL="${GITEA_URL:-https://gitea.coulomb.social}"
+RUNNER_HOST="${RUNNER_HOST:-haskelseed}"
+RUNNER_SSH_USER="${RUNNER_SSH_USER:-}"
+RUNNER_SSH_KEY="${RUNNER_SSH_KEY:-}"
+SSH_CONNECT_TIMEOUT="${SSH_CONNECT_TIMEOUT:-5}"
+INTER_HUB_IMAGE="${INTER_HUB_IMAGE:-92.205.130.254:32166/coulomb/inter-hub}"
+INTER_HUB_TAGS="${INTER_HUB_TAGS:-91037a4 ae9e497 fa96fb8 7cc3173 latest}"
+
+section() {
+  printf '\n## %s\n' "$1"
+}
+
+have() {
+  command -v "$1" >/dev/null 2>&1
+}
+
+tool_line() {
+  if have "$1"; then
+    printf 'ok: %s -> %s\n' "$1" "$(command -v "$1")"
+  else
+    printf 'missing: %s\n' "$1"
+  fi
+}
+
+http_code() {
+  curl -sS -m 8 -o /dev/null -w '%{http_code}' "$1" 2>/dev/null || printf 'error'
+}
+
+section "Tool availability"
+for tool in curl ssh docker skopeo act_runner; do
+  tool_line "$tool"
+done
+
+section "Public endpoint checks"
+if have curl; then
+  printf 'gitea root: %s\n' "$(http_code "${GITEA_URL}/")"
+  printf 'gitea api version: %s\n' "$(http_code "${GITEA_URL}/api/v1/version")"
+  printf 'gitea registry /v2: %s\n' "$(http_code "${GITEA_URL}/v2/")"
+  printf 'gitea pypi simple root: %s\n' "$(http_code "${GITEA_URL}/api/packages/coulomb/pypi/simple/")"
+  printf 'inter-hub api /api/v2/hubs: %s\n' "$(http_code "https://hub.coulomb.social/api/v2/hubs")"
+else
+  echo "curl missing; skipping endpoint checks"
+fi
+
+section "Runner host probe"
+if have ssh; then
+  ssh_target="${RUNNER_HOST}"
+  if [ -n "${RUNNER_SSH_USER}" ]; then
+    ssh_target="${RUNNER_SSH_USER}@${RUNNER_HOST}"
+  fi
+  ssh_args=(-o BatchMode=yes -o ConnectTimeout="${SSH_CONNECT_TIMEOUT}")
+  if [ -n "${RUNNER_SSH_KEY}" ]; then
+    ssh_args+=(-i "${RUNNER_SSH_KEY}")
+  fi
+  ssh "${ssh_args[@]}" "${ssh_target}" '
+    set -u
+    echo "host=$(hostname)"
+    if command -v act_runner >/dev/null 2>&1; then
+      act_runner --version || true
+    else
+      echo "missing: act_runner"
+    fi
+    if command -v systemctl >/dev/null 2>&1; then
+      systemctl is-active act_runner 2>/dev/null || true
+      systemctl is-active gitea-act-runner 2>/dev/null || true
+    fi
+    if command -v rc-service >/dev/null 2>&1; then
+      rc-service act_runner status 2>/dev/null || true
+      rc-service gitea-act-runner status 2>/dev/null || true
+      rc-status 2>/dev/null | grep -Ei "act|runner|docker|podman|nix" || true
+    fi
+    if command -v pgrep >/dev/null 2>&1; then
+      pgrep -a act_runner || true
+      pgrep -a runner || true
+    fi
+    if [ -f /root/.runner ]; then
+      echo "runner_registration=/root/.runner"
+      grep -nE "\"(uuid|name|address|labels|ephemeral)\"" /root/.runner || true
+      sed -n "8,20p" /root/.runner 2>/dev/null || true
+    fi
+  ' 2>&1 || echo "runner host probe failed for ${RUNNER_HOST}"
+else
+  echo "ssh missing; skipping runner host probe"
+fi
+
+section "Inter-hub registry tags"
+if have skopeo; then
+  for tag in ${INTER_HUB_TAGS}; do
+    if out="$(skopeo inspect --tls-verify=false --format '{{.Name}} {{.Digest}}' "docker://${INTER_HUB_IMAGE}:${tag}" 2>&1)"; then
+      printf 'ok: %s %s\n' "${tag}" "${out}"
+    else
+      printf 'missing-or-error: %s %s\n' "${tag}" "${out}"
+    fi
+  done
+else
+  echo "skopeo missing; skipping registry tag inspection"
+fi
+
+section "Evidence reminder"
+echo "Record non-secret results in docs/gitea-actions-runner-evidence.md and State Hub."

tools/haskelseed-runner-activate.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+RUNNER_HOST="${RUNNER_HOST:-192.168.178.135}"
+RUNNER_SSH_USER="${RUNNER_SSH_USER:-root}"
+RUNNER_SSH_KEY="${RUNNER_SSH_KEY:-/home/worsch/.ssh/id_ops}"
+RUNNER_SERVICE_SOURCE="${RUNNER_SERVICE_SOURCE:-runner/act-runner-haskelseed.openrc.example}"
+REMOTE_SERVICE_TMP="/tmp/act_runner.openrc.$$"
+
+ssh_args=(-o BatchMode=yes -o ConnectTimeout=8)
+if [ -n "${RUNNER_SSH_KEY}" ]; then
+	ssh_args+=(-i "${RUNNER_SSH_KEY}")
+fi
+target="${RUNNER_SSH_USER}@${RUNNER_HOST}"
+
+scp "${ssh_args[@]}" "${RUNNER_SERVICE_SOURCE}" "${target}:${REMOTE_SERVICE_TMP}"
+
+ssh "${ssh_args[@]}" "${target}" "REMOTE_SERVICE_TMP='${REMOTE_SERVICE_TMP}' sh -s" <<'REMOTE'
+set -eu
+
+if [ ! -f /root/.runner ]; then
+	echo "missing /root/.runner; register act_runner before activating service" >&2
+	exit 1
+fi
+
+backup="/root/.runner.bak-$(date +%Y%m%d%H%M%S)"
+cp /root/.runner "${backup}"
+
+awk '
+	/"labels": \[/ {
+		print "  \"labels\": ["
+		print "    \"self-hosted:host\","
+		print "    \"haskelseed:host\","
+		print "    \"linux:host\","
+		print "    \"linux_amd64:host\","
+		print "    \"x86_64:host\","
+		print "    \"container-build:host\","
+		print "    \"registry-publish:host\""
+		in_labels = 1
+		next
+	}
+	in_labels && /]/ {
+		print "  ],"
+		in_labels = 0
+		next
+	}
+	!in_labels { print }
+' /root/.runner > /root/.runner.tmp
+
+mv /root/.runner.tmp /root/.runner
+chmod 0644 /root/.runner
+
+install -m 0755 "${REMOTE_SERVICE_TMP}" /etc/init.d/act_runner
+rm -f "${REMOTE_SERVICE_TMP}"
+
+rc-update add act_runner default >/dev/null 2>&1 || true
+rc-service act_runner restart
+
+echo "runner_backup=${backup}"
+echo "runner_labels:"
+sed -n '8,24p' /root/.runner
+echo "service_status:"
+rc-service act_runner status || true
+echo "runner_process:"
+pgrep -a act_runner || true
+REMOTE