chengcheng
745811cc6d
新增独立仓库级 Gitea Runner，main 和 PR 执行完整质量门禁与不可变 SHA 镜像构建；只有来自 main 历史的语义版本 Tag 才调用受限生产发布助手。专属 Buildx builder 将缓存限制为 2 GB。\n\n验证：流水线结构测试、ShellCheck、Go vet/test、govulncheck、前端 lint/test/build、Compose 渲染及高危依赖审计通过。
32 lines
1.2 KiB
Desktop File
32 lines
1.2 KiB
Desktop File
[Unit]
|
|
Description=EasyAI AI Gateway Gitea Actions runner
|
|
After=network-online.target docker.service
|
|
Wants=network-online.target docker.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=easyai-gateway-runner
|
|
Group=easyai-gateway-runner
|
|
WorkingDirectory=/var/lib/easyai-gateway-runner
|
|
Environment=HOME=/var/lib/easyai-gateway-runner
|
|
Environment=PATH=/opt/easyai-gateway-ci/bin:/opt/easyai-gateway-ci/toolchains/go/bin:/opt/easyai-gateway-ci/toolchains/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
# Gitea 1.22 can leave a long-running poll stale after a completed host job.
|
|
# Process exactly one job, then let Restart=always create a fresh poller.
|
|
ExecStart=/opt/easyai-gateway-ci/bin/gitea-runner --config /etc/easyai-gateway-runner/config.yaml daemon --once
|
|
Restart=always
|
|
RestartSec=5s
|
|
TimeoutStopSec=330s
|
|
# Tag jobs invoke one SHA-validating root helper. Docker access already gives
|
|
# this dedicated repository runner an equivalent host-root trust boundary.
|
|
NoNewPrivileges=false
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
ReadWritePaths=/var/lib/easyai-gateway-runner
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|