ansible/roles/openshift-apps/forgejo/runners

Forgejo runner definitions

Each runner has one YAML file under production/ or staging/. These files are public (this repo) and contain everything except the registration secret.

File format

---
name: releng-1
scope: releng
labels:
  - releng-1
image: code.forgejo.org/forgejo/runner:11

• name — Unique runner name (must match the filename stem).
• scope — Forgejo org scope for forgejo-cli actions register --scope (omit or use global for instance-wide runners).
• labels — Workflow runs-on labels. Quote values that contain colons.
• image — Runner container image on the runner host.
• capacity — Optional concurrent job limit (passed through to runner host config).

Secrets (private ansible repo)

Registration secrets stay in ansible-private/vars.yml as a dict keyed by runner name:

forgejo_runner_secrets:
  releng-1: "01c729e8f65dea42ddaf335dbfcf3841c71e58c8"
  infra-1: "c4ebefbdc76b023bd7c7ef06a483fae045bb2f3d"
  # ...

forgejo_stg_runner_secrets:
  # staging runners, same shape

Generate a new secret with: openssl rand -hex 20

tasks/load-forgejo-runners.yaml merges each definition file with its secret before templating and CLI registration.

Capacity

Based on our experience running multiple runners on a single system, try to keep the total number of runners below 30 per system, with the total capacity across all runners at 100 or below.

The following one-liner will retrieve the total capacity across all the runners:

git grep capacity | python -c 'import sys; print(sum(int(line.rsplit(":", 1)[-1].strip()) for line in sys.stdin))'

When the runnervm hosts are nearing capacity consider provisioning a new one.