Documentation
¶
Overview ¶
Package runnerapp is what creating a runner App leaves behind: the App a self-hosted runner scale set in one tier registers with in one organisation.
One Secret holds every runner App. An installed App is three keys named as the gha-runner-scale-set githubConfigSecret names them, prefixed by the tier and the organisation, so a deployment can copy one App anywhere — into a secret manager with an External Secrets PushSecret, for one — by naming three keys, without reshaping a document. A fourth key is the App's record, which the console shows and a restore of the Secret alone brings back.
An App created and not yet installed keeps its key under another name, so the three keys never exist without an installation: a copy made in between would hand runners an App they cannot register with, replacing one they could.
Nothing in the service acts with the key. It is kept for a deployment to hand to its runners, and read here for one thing: uninstalling the App on Disconnect.
Index ¶
- Constants
- Variables
- func Encode(r Record, privateKey string) (map[string][]byte, error)
- func Key(tier, org, property string) string
- func Keys(tier, org string) []string
- func OfRecordKey(key string) (tier, org string, ok bool)
- func PrivateKeyOf(data map[string][]byte, tier, org string) (string, bool)
- func RecordKey(tier, org string) string
- func SecretName(release string) string
- func ValidTier(tier string) bool
- type Record
- type Store
Constants ¶
const ( AppIDProperty = "github_app_id" InstallationIDProperty = "github_app_installation_id" PrivateKeyProperty = "github_app_private_key" )
The property names of one App, as gha-runner-scale-set's githubConfigSecret spells them.
const Version = 1
Version is the record version this build writes and reads.
Variables ¶
var ErrVersion = errors.New("runnerapp: unsupported record version")
ErrVersion is a record of a version this build does not read.
Functions ¶
func Encode ¶
Encode writes one App: its record, and its three properties once it is installed, or its pending key until then. Keys lists every key an App can have, so a writer removes those first.
func OfRecordKey ¶
OfRecordKey reads the tier and the organisation back out of a record key.
func PrivateKeyOf ¶
PrivateKeyOf reads one App's key from the Secret's data, installed or pending.
func SecretName ¶
SecretName is the object holding every runner App.
Types ¶
type Record ¶
type Record struct {
Version int `json:"version"`
Tier string `json:"tier"`
Org string `json:"org"`
AppID int64 `json:"app_id"`
AppSlug string `json:"app_slug"`
// Purpose is always `runner`: Encode sets it. A record written before it
// existed has none and is read as a runner App's all the same.
Purpose appid.Purpose `json:"purpose,omitempty"`
// Labels are the App's own, for a reader that selects Apps by them.
Labels map[string]string `json:"labels,omitempty"`
// InstallationID is zero between Create and Install.
InstallationID int64 `json:"installation_id,omitempty"`
HTMLURL string `json:"html_url,omitempty"`
ConnectedAt time.Time `json:"connected_at"`
ConnectedBy string `json:"connected_by"`
}
Record is one runner App, as the console shows it.
type Store ¶ added in v1.76.0
type Store interface {
Put(ctx context.Context, record Record, privateKey string) error
List(ctx context.Context) ([]Record, error)
PrivateKey(ctx context.Context, tier, org string) (string, bool, error)
Delete(ctx context.Context, tier, org string) error
}
Store is where runner Apps are kept: every App's record and key, which the deployment hands to its runners.
Source Files