railiance-forge/docs/forgejo-actions-runner-substrate.md

Forgejo Actions Runner Substrate

Last reviewed: 2026-07-03

Status: first supported runner on coulombcore (interim). Forgejo instance runs on railiance01; runner host is intentionally separate per Forgejo security guidance.

Purpose

Provide a forge-owned Actions runner for https://forgejo.coulomb.social so repos in the coulomb organization can build and publish without workstation involvement. Mirrors the Gitea runner contract in docs/gitea-actions-runner-substrate.md.

First Supported Runner

Field	Value
Runner name	railiance-coulombcore-build-01
Runner scope	coulomb organization
Host	coulombcore (92.205.130.254)
Instance	https://forgejo.coulomb.social/
Binary	forgejo-runner v6.3.1
Runtime	Host mode (Docker not installed on host yet)
Cluster deploy authority	Not included

Labels

self-hosted:host,linux:host,linux_amd64:host,container-build:host,registry-publish:host,railiance01:host

self-hosted preserves compatibility with existing Gitea workflow runs-on values during migration. Container image builds require Docker on the runner host — install before cutover of image-publishing workflows.

Service Layout

Path	Purpose
/usr/local/bin/forgejo-runner	Runner binary
/var/lib/forgejo-runner/config.yaml	Generated config
/var/lib/forgejo-runner/.runner	Registration state (secret)
/etc/systemd/system/forgejo-runner.service	systemd unit

Probe Evidence (2026-07-03)

• Org coulomb created on Forgejo.
• Runner registered and systemctl is-active forgejo-runner → active.
• Repo coulomb/forgejo-actions-probe workflow probe.yaml (runs-on: self-hosted) completed with status: success (API: /api/v1/repos/coulomb/forgejo-actions-probe/actions/tasks).

Operator Commands

# Runner health (from railiance-forge)
RUNNER_HOST=coulombcore make forgejo-runner-status

# Forgejo app smoke (from railiance-apps)
make -C ~/railiance-apps forgejo-smoke

# Generate a new org registration token (in cluster, no token in logs)
KUBECONFIG=~/.kube/config-hosteurope kubectl exec -n forgejo deploy/forgejo-gitea -- \
  forgejo actions generate-runner-token --scope coulomb

Secret Boundaries

Same as Gitea runner substrate: registration tokens and .runner files stay off Git. Use approved secret paths on the runner host only.

Follow-On

1. Install Docker on the approved runner host for container-build jobs.
2. Move runner to a non-legacy host before coulombcore decommission (T03 drain).
3. Add repo-scoped registry credentials in Forgejo org secrets for image push.