add wolfi dockerfile and helm charts for deployment

.github/workflows/arc2-javascript-test.yml

@@ -0,0 +1,24 @@
+name: 🐿️ ARC-2 javascript test
+
+on:
+  workflow_dispatch:
+    inputs:
+      target-scale-set:
+        description: "Which scale set to test?"
+        type: string
+        required: true
+
+jobs:
+  javascript-test:
+    runs-on: ${{ github.event.inputs.target-scale-set }}
+    steps:
+      - name: "Test a pre-made Javascript Action"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: "Run Javascript inline"
+        run: |
+          node -v
+          echo "console.log('Hello, world!');" > hello.js
+          node hello.js

cluster-configs/runner-role.yml

@@ -0,0 +1,22 @@
+# this is the role needed for container hooks
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: default
+  name: runner-role
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "create", "delete"]
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["get", "create"]
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get", "list", "watch",]
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "create", "delete"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "create", "delete"]

deployments/helm-wolfi-test.yml

@@ -27,10 +27,43 @@ minRunners: 1
 
 # runnerGroup: "default"
 
+# template:
+#   spec:
+#     containers:
+#     - name: runner
+#       image: ghcr.io/some-natalie/kubernoodles/wolfi-runner:test
+#       imagePullPolicy: Always
+#       command: ["/actions-runner/run.sh"]
+
 template:
   spec:
     containers:
-    - name: runner
-      image: ghcr.io/some-natalie/kubernoodles/wolfi-runner:test
-      imagePullPolicy: Always
-      command: ["/actions-runner/run.sh"]
+      - name: runner
+        image: ghcr.io/some-natalie/kubernoodles/wolfi-runner:test
+        command: ["/actions-runner/run.sh"]
+        securityContext:
+          runAsUser: 100
+          runAsGroup: 100
+        env:
+          - name: ACTIONS_RUNNER_CONTAINER_HOOKS
+            value: /actions-runner/k8s/index.js
+          - name: ACTIONS_RUNNER_POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
+          - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
+            value: "false"  # allow non-container steps
+        volumeMounts:
+          - name: work
+            mountPath: /actions-runner/_work
+
+containerMode:
+  type: "kubernetes" 
+  kubernetesModeWorkVolumeClaim:
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: "local-path"
+    resources:
+      requests:
+        storage: 1Gi
+      limits:
+        storage: 5Gi

deployments/helm-wolfi.yml

@@ -27,9 +27,42 @@ minRunners: 1
 
 # runnerGroup: "default"
 
+# template:
+#   spec:
+#     containers:
+#     - name: runner
+#       image: ghcr.io/some-natalie/kubernoodles/wolfi-runner:latest
+#       command: ["/actions-runner/run.sh"]
+
 template:
   spec:
     containers:
-    - name: runner
-      image: ghcr.io/some-natalie/kubernoodles/wolfi-runner:latest
-      command: ["/actions-runner/run.sh"]
+      - name: runner
+        image: ghcr.io/some-natalie/kubernoodles/wolfi-runner:test
+        command: ["/actions-runner/run.sh"]
+        securityContext:
+          runAsUser: 100
+          runAsGroup: 100
+        env:
+          - name: ACTIONS_RUNNER_CONTAINER_HOOKS
+            value: /actions-runner/k8s/index.js
+          - name: ACTIONS_RUNNER_POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
+          - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
+            value: "false"  # allow non-container steps
+        volumeMounts:
+          - name: work
+            mountPath: /actions-runner/_work
+
+containerMode:
+  type: "kubernetes" 
+  kubernetesModeWorkVolumeClaim:
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: "local-path"
+    resources:
+      requests:
+        storage: 1Gi
+      limits:
+        storage: 5Gi

images/wolfi.Dockerfile

@@ -25,6 +25,7 @@ RUN apk update \
     build-base \
     ca-certificates \
     curl \
+    docker-cli \
     git \
     gh \
     icu \