Automated provisioning of Actions runners

[garymoon]

Feature Description

Currently Actions runner tokens are retrieved from the web UI and are one-time use. This makes it difficult to provision runners in an automated fashion for CI and such.

Woodpecker and Drone accept a symmetic secret via environment variables for both the application and the runners, making automated provisioning zero-touch. Could such a flow be considered for Gitea please?

P.S. Since it's Gitea issuing and validating the tokens it seemed more appropriate to open this issue here, but I'm happy to move or open a companion issue on act_runner instead 👍

Screenshots

No response

[delvh]

Isn't that already implemented by #23762?
An alternative to it would be offering an API route that would need to ensure that the caller is an admin for the respective scope.

[garymoon]

#23762 goes some way to making automation easier, but would still require executing the CLI in an automated fashion, extracting the token from the output, and applying it to the runner config, repeated for each runner. This would be particularly messy in an integration test.

Since runner tokens are just fixed-length random strings, would it be acceptable to have admin-supplied tokens/scopes retrieved from the ini with the ability to be reused?

[techknowlogick]

perhaps me completing this PR #23761 would be helpful

[garymoon]

#23761 still suffers similar shortcomings in this context. We would need to provision an admin user, create an API token, and hit the API with that token for each runner.

Perhaps fixtures are the answer, but that still leaves the issue of the tokens being one-time use, and would not alleviate the complexity of dynamically scaling runners outside of a test environment.

[benyanke]

Duplicate of #23703

[garymoon]

So it is, bugger it. Thanks @benyanke 💙