promigence 0.1.0-beta.12

package/dist/runners-github.js

@@ -0,0 +1,257 @@
+import { RUNNER_TIERS, isRunnerTier } from "./runners-spec.js";
+export const GITHUB_API_DEFAULT = "https://api.github.com";
+export const GITHUB_USER_AGENT = "ci-runner-pool/1";
+export const DEFAULT_RUNNER_LABELS = ["self-hosted", "linux", "x64"];
+export const DEFAULT_POOL_LABEL = "promigence";
+export const tierLabel = (t) => `${DEFAULT_POOL_LABEL}-${t}`;
+const TIER_BY_LABEL = new Map(RUNNER_TIERS.map((t) => [tierLabel(t), t]));
+export function redact(text, secrets) {
+    let out = text;
+    for (const s of secrets) {
+        if (!s || s.length < 6)
+            continue;
+        out = out.split(s).join("[redacted]");
+        const head = s.slice(0, 12);
+        if (head.length >= 8)
+            out = out.split(head).join("[redacted]");
+    }
+    return out;
+}
+export class GitHubError extends Error {
+    status;
+    retryAfterMs;
+    constructor(status, message, retryAfterMs) {
+        super(message);
+        this.status = status;
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+export class GitHubApi {
+    apiUrl;
+    #token;
+    #fetch;
+    #now;
+    #etags = new Map();
+    stats = { requests: 0, notModified: 0, rateLimited: 0 };
+    backoffUntil = 0;
+    remaining;
+    #secondaryBackoffMs = 0;
+    constructor(opts) {
+        this.apiUrl = (opts.apiUrl ?? GITHUB_API_DEFAULT).replace(/\/+$/, "");
+        this.#token = opts.token;
+        this.#fetch = opts.fetch ?? fetch;
+        this.#now = opts.now ?? Date.now;
+    }
+    get secret() {
+        return this.#token;
+    }
+    #headers(extra = {}) {
+        return {
+            accept: "application/vnd.github+json",
+            "x-github-api-version": "2022-11-28",
+            "user-agent": GITHUB_USER_AGENT,
+            authorization: `Bearer ${this.#token}`,
+            ...extra,
+        };
+    }
+    async #send(method, path, body) {
+        const now = this.#now();
+        if (now < this.backoffUntil) {
+            throw new GitHubError(429, `GitHub rate limit: waiting ${Math.ceil((this.backoffUntil - now) / 1000)} s`, this.backoffUntil - now);
+        }
+        const url = this.apiUrl + path;
+        const cached = method === "GET" ? this.#etags.get(url) : undefined;
+        this.stats.requests += 1;
+        let res;
+        try {
+            res = await this.#fetch(url, {
+                method,
+                headers: this.#headers({
+                    ...(cached ? { "if-none-match": cached.etag } : {}),
+                    ...(body === undefined ? {} : { "content-type": "application/json" }),
+                }),
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+        }
+        catch (e) {
+            throw new GitHubError(0, `GitHub API unreachable (${e.message})`);
+        }
+        const rem = res.headers.get("x-ratelimit-remaining");
+        if (rem !== null && rem !== "")
+            this.remaining = Number(rem);
+        if (res.status === 304 && cached) {
+            this.stats.notModified += 1;
+            this.#secondaryBackoffMs = 0;
+            return { status: 200, json: cached.body };
+        }
+        const text = await res.text();
+        let json = undefined;
+        try {
+            json = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            json = undefined;
+        }
+        if (res.status === 403 || res.status === 429) {
+            const msg = String(json?.message ?? "");
+            const retryAfter = res.headers.get("retry-after");
+            const reset = res.headers.get("x-ratelimit-reset");
+            let waitMs;
+            if (retryAfter !== null && retryAfter !== "" && Number.isFinite(Number(retryAfter)))
+                waitMs = Number(retryAfter) * 1000;
+            else if (rem === "0" && reset !== null && Number.isFinite(Number(reset)))
+                waitMs = Math.max(1000, Number(reset) * 1000 - this.#now() + 1000);
+            else if (/secondary rate limit|abuse/i.test(msg)) {
+                this.#secondaryBackoffMs = Math.min(300_000, this.#secondaryBackoffMs ? this.#secondaryBackoffMs * 2 : 60_000);
+                waitMs = this.#secondaryBackoffMs;
+            }
+            if (waitMs !== undefined || res.status === 429) {
+                const wait = waitMs ?? 60_000;
+                this.stats.rateLimited += 1;
+                this.backoffUntil = this.#now() + wait;
+                throw new GitHubError(429, `GitHub rate limit: waiting ${Math.ceil(wait / 1000)} s`, wait);
+            }
+        }
+        if (res.status >= 400) {
+            const msg = redact(String(json?.message ?? res.statusText ?? ""), [this.#token]);
+            throw new GitHubError(res.status, msg);
+        }
+        this.#secondaryBackoffMs = 0;
+        if (method === "GET") {
+            const etag = res.headers.get("etag");
+            if (etag)
+                this.#etags.set(url, { etag, body: json });
+        }
+        return { status: res.status, json };
+    }
+    get(path) {
+        return this.#send("GET", path);
+    }
+    post(path, body) {
+        return this.#send("POST", path, body);
+    }
+    delete(path) {
+        return this.#send("DELETE", path);
+    }
+}
+const enc = encodeURIComponent;
+const repoPath = (repo) => {
+    const [o, r] = repo.split("/");
+    return `/repos/${enc(o)}/${enc(r)}`;
+};
+const scopePath = (s) => (s.kind === "repo" ? repoPath(s.name) : `/orgs/${enc(s.name)}`);
+export async function checkAccess(api, scope) {
+    await api.get(`${scopePath(scope)}/actions/runners?per_page=1`);
+    await api.post(`${scopePath(scope)}/actions/runners/registration-token`, {});
+    if (scope.kind === "repo")
+        await api.get(`${scopePath(scope)}/actions/runs?per_page=1`);
+}
+export async function runnerGroupId(api, org, name) {
+    if (name === undefined || name.toLowerCase() === "default")
+        return 1;
+    const r = await api.get(`/orgs/${enc(org)}/actions/runner-groups?per_page=100`);
+    const groups = (r.json?.runner_groups ?? []);
+    const g = groups.find((x) => x.name.toLowerCase() === name.toLowerCase());
+    if (!g)
+        throw new GitHubError(404, `no runner group named '${name}' in ${org} (it has: ${groups.map((x) => x.name).join(", ") || "none"})`);
+    return g.id;
+}
+export async function orgRepos(api, org, limit = 100) {
+    const r = await api.get(`/orgs/${enc(org)}/repos?sort=pushed&direction=desc&per_page=${Math.min(100, limit)}`);
+    const repos = r.json ?? [];
+    return { repos: repos.filter((x) => !x.archived && !x.disabled).map((x) => x.full_name).slice(0, limit), more: repos.length >= Math.min(100, limit) };
+}
+export async function queuedJobs(api, repos, onMissing) {
+    const out = [];
+    for (const repo of repos) {
+        const runIds = new Set();
+        try {
+            for (const status of ["queued", "in_progress"]) {
+                const r = await api.get(`${repoPath(repo)}/actions/runs?status=${status}&per_page=100`);
+                for (const run of (r.json?.workflow_runs ?? []))
+                    runIds.add(run.id);
+            }
+        }
+        catch (e) {
+            if (onMissing && e instanceof GitHubError && e.status === 404) {
+                onMissing(repo);
+                continue;
+            }
+            throw e;
+        }
+        for (const id of runIds) {
+            const r = await api.get(`${repoPath(repo)}/actions/runs/${id}/jobs?filter=latest&per_page=100`);
+            for (const j of (r.json?.jobs ?? [])) {
+                if (j.status === "queued")
+                    out.push({ ...j, repo });
+            }
+        }
+    }
+    return out;
+}
+export async function mintJitConfig(api, scope, opts) {
+    const r = await api.post(`${scopePath(scope)}/actions/runners/generate-jitconfig`, {
+        name: opts.name, runner_group_id: opts.groupId, labels: opts.labels, work_folder: "_work",
+    });
+    const j = r.json;
+    if (!j?.encoded_jit_config || typeof j.runner?.id !== "number") {
+        throw new GitHubError(r.status, "GitHub answered generate-jitconfig without a runner configuration");
+    }
+    return { runnerId: j.runner.id, name: j.runner.name ?? opts.name, encoded: j.encoded_jit_config };
+}
+export async function getRunner(api, scope, id) {
+    try {
+        return (await api.get(`${scopePath(scope)}/actions/runners/${id}`)).json;
+    }
+    catch (e) {
+        if (e instanceof GitHubError && e.status === 404)
+            return undefined;
+        throw e;
+    }
+}
+export async function findRunnerByName(api, scope, name) {
+    const r = await api.get(`${scopePath(scope)}/actions/runners?name=${encodeURIComponent(name)}&per_page=100`);
+    return (r.json?.runners ?? []).find((x) => x.name === name);
+}
+export async function deleteRunner(api, scope, id) {
+    try {
+        await api.delete(`${scopePath(scope)}/actions/runners/${id}`);
+        return "deleted";
+    }
+    catch (e) {
+        if (e instanceof GitHubError && e.status === 404)
+            return "gone";
+        throw e;
+    }
+}
+const norm = (l) => l.trim().toLowerCase();
+export function routeJob(labels, policy) {
+    const custom = [...new Set(labels.map(norm))].filter((l) => !DEFAULT_RUNNER_LABELS.includes(l));
+    if (custom.length === 0)
+        return undefined;
+    const tiers = custom.filter((l) => TIER_BY_LABEL.has(l));
+    if (tiers.length > 1)
+        return undefined;
+    if (!custom.every((l) => policy.pool.includes(l) || TIER_BY_LABEL.has(l)))
+        return undefined;
+    const tier = tiers.length ? TIER_BY_LABEL.get(tiers[0]) : policy.defaultTier;
+    const runnerLabels = [...new Set([...custom, tierLabel(tier)])].sort();
+    return { tier, labels: runnerLabels, key: runnerLabels.join(",") };
+}
+export function warmLabels(policy) {
+    return [...new Set([...policy.pool, tierLabel(policy.defaultTier)])].sort();
+}
+export function covers(runnerLabels, jobLabels) {
+    const have = new Set([...runnerLabels.map(norm), ...DEFAULT_RUNNER_LABELS]);
+    return jobLabels.map(norm).every((l) => have.has(l));
+}
+export function parsePoolLabels(spec) {
+    if (spec === undefined)
+        return [DEFAULT_POOL_LABEL];
+    const labels = spec.split(",").map(norm).filter(Boolean);
+    return [...new Set(labels)];
+}
+export function validLabel(l) {
+    return /^[a-z0-9][a-z0-9._-]{0,99}$/.test(l);
+}
+export { isRunnerTier };

package/dist/runners-gitlab.js

@@ -0,0 +1,125 @@
+import { GitHubError as HttpError, redact } from "./runners-github.js";
+export const GITLAB_URL_DEFAULT = "https://gitlab.com";
+export const GITLAB_EXECUTORS = ["docker", "shell"];
+export { GITLAB_DEFAULT_JOB_IMAGE as GITLAB_DEFAULT_IMAGE } from "./runners-spec.js";
+const tomlString = (s) => JSON.stringify(s);
+export function gitlabConfigToml(cfg) {
+    const lines = [
+        "concurrent = 1",
+        "check_interval = 3",
+        "shutdown_timeout = 30",
+        'log_format = "text"',
+        "",
+        "[[runners]]",
+        '  name = "ci"',
+        `  url = ${tomlString(cfg.url)}`,
+        `  token = ${tomlString(cfg.token)}`,
+        `  executor = ${tomlString(cfg.executor)}`,
+        '  builds_dir = "/builds"',
+        '  cache_dir = "/cache"',
+    ];
+    if (cfg.executor === "docker") {
+        lines.push("  [runners.docker]", `    image = ${tomlString(cfg.defaultImage)}`, "    privileged = true", '    pull_policy = ["if-not-present"]', '    volumes = ["/cache"]');
+    }
+    return lines.join("\n") + "\n";
+}
+export function systemId(seed, position) {
+    let h = 2166136261 >>> 0;
+    for (const ch of `${seed}:${position}`)
+        h = Math.imul(h ^ ch.charCodeAt(0), 16777619) >>> 0;
+    let out = "";
+    let x = h;
+    const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+    for (let i = 0; i < 12; i++) {
+        out += alphabet[x % alphabet.length];
+        x = Math.imul(x ^ (x >>> 13), 2654435761) >>> 0;
+    }
+    return `s_${out}`;
+}
+export class GitlabApi {
+    url;
+    #token;
+    #fetch;
+    stats = { requests: 0 };
+    backoffUntil = 0;
+    constructor(url, token, f = fetch) {
+        this.url = url;
+        this.#token = token;
+        this.#fetch = f;
+    }
+    get secret() {
+        return this.#token;
+    }
+    async #req(method, path, body) {
+        if (Date.now() < this.backoffUntil) {
+            throw new HttpError(429, `GitLab rate limit: waiting ${Math.ceil((this.backoffUntil - Date.now()) / 1000)} s`, this.backoffUntil - Date.now());
+        }
+        this.stats.requests += 1;
+        let res;
+        try {
+            res = await this.#fetch(`${this.url.replace(/\/+$/, "")}/api/v4${path}`, {
+                method,
+                headers: {
+                    "private-token": this.#token,
+                    "user-agent": "ci-runner-pool/1",
+                    ...(body === undefined ? {} : { "content-type": "application/json" }),
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+        }
+        catch (e) {
+            throw new HttpError(0, `GitLab API unreachable (${e.message})`);
+        }
+        const text = await res.text();
+        let json;
+        try {
+            json = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            json = undefined;
+        }
+        if (res.status === 429) {
+            const ra = Number(res.headers.get("retry-after") ?? "60");
+            const wait = (Number.isFinite(ra) && ra > 0 ? ra : 60) * 1000;
+            this.backoffUntil = Date.now() + wait;
+            throw new HttpError(429, `GitLab rate limit: waiting ${Math.ceil(wait / 1000)} s`, wait);
+        }
+        if (res.status >= 400) {
+            const m = json;
+            const msg = typeof m?.message === "string" ? m.message : typeof m?.error === "string" ? m.error : JSON.stringify(m?.message ?? res.statusText);
+            throw new HttpError(res.status, redact(String(msg), [this.#token]));
+        }
+        return json;
+    }
+    async runner(runnerToken) {
+        const v = await this.#req("POST", "/runners/verify", { token: runnerToken });
+        if (typeof v?.id !== "number")
+            throw new HttpError(404, "GitLab did not recognise the runner authentication token");
+        const r = await this.#req("GET", `/runners/${v.id}`);
+        return {
+            id: r.id,
+            tags: (r.tag_list ?? []).map((t) => t.toLowerCase()),
+            runUntagged: r.run_untagged !== false,
+            projects: (r.projects ?? []).map((p) => p.id),
+            groups: (r.groups ?? []).map((g) => g.id),
+            type: r.runner_type ?? "unknown",
+        };
+    }
+    async groupProjects(group, limit = 100) {
+        const r = await this.#req("GET", `/groups/${group}/projects?include_subgroups=true&archived=false&per_page=${Math.min(100, limit)}&order_by=last_activity_at`);
+        return (r ?? []).map((p) => p.id).slice(0, limit);
+    }
+    async pendingJobs(project) {
+        const r = await this.#req("GET", `/projects/${project}/jobs?scope[]=pending&per_page=100`);
+        return (r ?? []).map((j) => ({ id: j.id, name: j.name, tags: (j.tag_list ?? []).map((t) => t.toLowerCase()), project, ...(j.web_url ? { web_url: j.web_url } : {}) }));
+    }
+}
+export function runnerTakes(runner, job) {
+    if (job.tags.length === 0)
+        return runner.runUntagged;
+    return job.tags.every((t) => runner.tags.includes(t));
+}
+export function receivedJobId(line) {
+    const m = /received\b.*\bjob=(\d+)/.exec(line) ?? /Checking for jobs\.\.\. received.*job=(\d+)/.exec(line);
+    return m ? Number(m[1]) : undefined;
+}

package/dist/runners-spec.js

@@ -0,0 +1,137 @@
+export const RUNNER_BASE_IMAGE = "docker.io/library/ubuntu@sha256:a853f94d226358a79c740cfc7bce0c289748f3fe3488d921d038ccd752c61b60";
+export const ACTIONS_RUNNER_VERSION = "2.337.0";
+export const ACTIONS_RUNNER_SHA256 = "70920811a4f8ad4328818682bca5c6469c1c942fab52448868071d0063816613";
+export const GITLAB_RUNNER_VERSION = "19.4.1";
+export const GITLAB_RUNNER_SHA256 = "5a159b36c5ff54fda9248e00bb0cdfb62c1112ab3741f5282c04a41e94da1306";
+export const GITLAB_RUNNER_DEB_SHA256 = "47d2fd991e0b17af6f85af8fe3cc0cc429aae782d4f9982724c1f11a4de4a47c";
+export const RUNNER_NODE_VERSION = "v24.21.0";
+export const RUNNER_NODE_SHA256 = "fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6";
+export const GITLAB_HELPER_IMAGE = `registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-v${GITLAB_RUNNER_VERSION}`;
+export const GITLAB_DEFAULT_JOB_IMAGE = "ubuntu:24.04";
+export const RUNNER_SPEC_REV = { github: 5, gitlab: 4 };
+export const RUNNER_TIERS = ["small", "medium", "large"];
+export const GITHUB_CONFIG_PATH = "/root/.ci-runner-config";
+export const GITLAB_CONFIG_PATH = "/etc/gitlab-runner/config.toml";
+export const GITHUB_LAUNCHER = "/usr/local/bin/ci-runner-github";
+export const GITLAB_LAUNCHER = "/usr/local/bin/ci-runner-gitlab";
+export const GITHUB_RUNNER_ROOT = "/home/runner/actions-runner";
+export const USER_DOCKER_CLI = "/usr/local/libexec/ci-docker/docker";
+export const DOCKER_STARTING = "/run/ci-docker-starting";
+export function runnerAlias(kind, tier) {
+    const version = kind === "github" ? ACTIONS_RUNNER_VERSION : GITLAB_RUNNER_VERSION;
+    const rev = RUNNER_SPEC_REV[kind];
+    return `ci-${kind}-runner-${tier}-${version}${rev > 1 ? `-r${rev}` : ""}`;
+}
+const PACKAGES = [
+    "ca-certificates", "curl", "wget", "git", "git-lfs", "jq", "unzip", "zip", "xz-utils", "zstd", "bzip2", "tar", "gzip",
+    "build-essential", "pkg-config", "python3", "python3-pip", "python3-venv", "sudo", "lsb-release",
+    "gnupg", "openssh-client", "rsync", "tzdata", "locales",
+];
+const APT_STEP = "set -eu; export DEBIAN_FRONTEND=noninteractive; apt-get update -qq; " +
+    `apt-get install -y -qq --no-install-recommends ${PACKAGES.join(" ")}; ` +
+    "rm -rf /var/lib/apt/lists/*";
+export const GITHUB_LAUNCHER_SCRIPT = `#!/bin/sh
+set -eu
+CFG=${GITHUB_CONFIG_PATH}
+[ -s "$CFG" ] || { echo "ci: no runner configuration at $CFG" >&2; exit 64; }
+ACTIONS_RUNNER_INPUT_JITCONFIG=$(cat "$CFG")
+rm -f "$CFG"
+export ACTIONS_RUNNER_INPUT_JITCONFIG
+if [ -x ${USER_DOCKER_CLI} ]; then
+  : > ${DOCKER_STARTING}
+  ( docker info >/dev/null 2>&1 || echo "ci: the Docker daemon did not start; jobs that use containers or services will fail" >&2
+    rm -f ${DOCKER_STARTING} ) &
+fi
+cd ${GITHUB_RUNNER_ROOT}
+export HOME=/home/runner USER=runner LOGNAME=runner RUNNER_MANUALLY_TRAP_SIG=1 DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1
+echo "ci: runner starting"
+exec setpriv --reuid=runner --regid=runner --init-groups ./run.sh
+`;
+export const GITLAB_LAUNCHER_SCRIPT = `#!/bin/sh
+set -eu
+CFG=${GITLAB_CONFIG_PATH}
+[ -s "$CFG" ] || { echo "ci: no runner configuration at $CFG" >&2; exit 64; }
+chmod 0600 "$CFG"
+if grep -q '^[[:space:]]*executor[[:space:]]*=[[:space:]]*"docker"' "$CFG"; then
+  docker info >/dev/null 2>&1 || { echo "ci: the Docker daemon did not start; the docker executor cannot run jobs" >&2; exit 65; }
+fi
+mkdir -p /builds /cache
+if [ -n "\${CI_SYSTEM_ID:-}" ]; then printf '%s\\n' "$CI_SYSTEM_ID" > /etc/gitlab-runner/.runner_system_id; fi
+set -- run-single --config "$CFG" --runner ci --max-builds 1
+if [ -n "\${CI_WAIT_TIMEOUT:-}" ]; then set -- "$@" --wait-timeout "$CI_WAIT_TIMEOUT"; fi
+echo "ci: runner starting"
+exec gitlab-runner --log-format text "$@"
+`;
+export const DOCKER_WRAPPER_SCRIPT = `#!/bin/sh
+if [ "$(id -u)" = 0 ] && [ -x /.promigence/docker/docker ]; then exec /.promigence/docker/docker "$@"; fi
+if [ ! -S /var/run/docker.sock ] && [ -e ${DOCKER_STARTING} ]; then
+  i=0
+  while [ ! -S /var/run/docker.sock ] && [ -e ${DOCKER_STARTING} ] && [ "$i" -lt 600 ]; do sleep 0.1; i=$((i + 1)); done
+fi
+exec ${USER_DOCKER_CLI} "$@"
+`;
+export const GITHUB_RUNNER_ENV = "LANG=C.UTF-8\nImageOS=ubuntu24\n";
+const b64 = (s) => Buffer.from(s, "utf8").toString("base64");
+function writeStep(path, content, mode) {
+    return `printf '%s' '${b64(content)}' | base64 -d > ${path}; chmod ${mode} ${path}`;
+}
+export function runnerBuildSteps(s) {
+    return [...s.setup, ...s.platform_setup];
+}
+export function runnerImageSpec(kind, tier) {
+    if (kind === "github") {
+        const url = `https://github.com/actions/runner/releases/download/v${ACTIONS_RUNNER_VERSION}/actions-runner-linux-x64-${ACTIONS_RUNNER_VERSION}.tar.gz`;
+        const nodeUrl = `https://nodejs.org/dist/${RUNNER_NODE_VERSION}/node-${RUNNER_NODE_VERSION}-linux-x64.tar.xz`;
+        const setup = [
+            APT_STEP,
+            `set -eu; curl -fsSL --retry 3 -o /tmp/node.tar.xz ${nodeUrl}; sha256sum /tmp/node.tar.xz; ` +
+                `echo '${RUNNER_NODE_SHA256}  /tmp/node.tar.xz' | sha256sum -c -; ` +
+                "tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 --no-same-owner; rm -f /tmp/node.tar.xz",
+            "set -eu; id -u runner >/dev/null 2>&1 || useradd --create-home --shell /bin/bash --uid 1001 runner; " +
+                "groupadd -f docker; usermod -aG docker runner; " +
+                "printf 'runner ALL=(ALL) NOPASSWD:ALL\\nDefaults:runner !requiretty\\n' > /etc/sudoers.d/runner; " +
+                "chmod 0440 /etc/sudoers.d/runner; visudo -c -f /etc/sudoers.d/runner",
+            `set -eu; mkdir -p ${GITHUB_RUNNER_ROOT}; curl -fsSL --retry 3 -o /tmp/actions-runner.tar.gz ${url}; ` +
+                "sha256sum /tmp/actions-runner.tar.gz; " +
+                `echo '${ACTIONS_RUNNER_SHA256}  /tmp/actions-runner.tar.gz' | sha256sum -c -; ` +
+                `tar -xzf /tmp/actions-runner.tar.gz -C ${GITHUB_RUNNER_ROOT}; rm -f /tmp/actions-runner.tar.gz`,
+            `set -eu; export DEBIAN_FRONTEND=noninteractive; ${GITHUB_RUNNER_ROOT}/bin/installdependencies.sh; rm -rf /var/lib/apt/lists/*`,
+            `set -eu; ${writeStep(GITHUB_LAUNCHER, GITHUB_LAUNCHER_SCRIPT, "0755")}; ` +
+                `${writeStep(`${GITHUB_RUNNER_ROOT}/.env`, GITHUB_RUNNER_ENV, "0644")}; chown -R runner:runner /home/runner`,
+        ];
+        const verify = `set -eu; cd ${GITHUB_RUNNER_ROOT}; setpriv --reuid=runner --regid=runner --init-groups env HOME=/home/runner ./config.sh --version; ` +
+            "git --version; jq --version; python3 --version; lsb_release -rs; " +
+            `test "$(node --version)" = ${RUNNER_NODE_VERSION}; ` +
+            "setpriv --reuid=runner --regid=runner --init-groups env HOME=/home/runner sh -c 'node --version && npm --version && npx --version'; " +
+            "setpriv --reuid=runner --regid=runner --init-groups env HOME=/home/runner sh -c 'docker --version && docker compose version && docker buildx version'; " +
+            `sudo -n -u runner true; id runner; test -x ${GITHUB_LAUNCHER}`;
+        const platform_setup = [
+            "set -eu; D=/.promigence/docker; test -x \"$D/bin/docker\"; mkdir -p /usr/local/libexec/ci-docker /usr/local/lib/docker/cli-plugins; " +
+                `cp "$D/bin/docker" ${USER_DOCKER_CLI}; ` +
+                "for p in docker-buildx docker-compose; do rm -f /usr/local/lib/docker/cli-plugins/$p; cp \"$D/cli-plugins/$p\" /usr/local/lib/docker/cli-plugins/$p; done; " +
+                `chmod 0755 ${USER_DOCKER_CLI} /usr/local/lib/docker/cli-plugins/docker-buildx /usr/local/lib/docker/cli-plugins/docker-compose; ` +
+                `rm -f /usr/local/bin/docker; ${writeStep("/usr/local/bin/docker", DOCKER_WRAPPER_SCRIPT, "0755")}`,
+        ];
+        return { image: RUNNER_BASE_IMAGE, setup, platform_setup, verify, tier, alias: runnerAlias(kind, tier) };
+    }
+    const deb = `https://packages.gitlab.com/runner/gitlab-runner/ubuntu/pool/main/g/gitlab-runner/gitlab-runner_${GITLAB_RUNNER_VERSION}-1_amd64.deb`;
+    const setup = [
+        APT_STEP,
+        "set -eu; curl -fsSL --retry 3 -o /tmp/gitlab-runner.deb " + deb + "; " +
+            "sha256sum /tmp/gitlab-runner.deb; " +
+            `echo '${GITLAB_RUNNER_DEB_SHA256}  /tmp/gitlab-runner.deb' | sha256sum -c -; ` +
+            "dpkg-deb -x /tmp/gitlab-runner.deb /tmp/gitlab-runner-deb; " +
+            "mv /tmp/gitlab-runner-deb/usr/bin/gitlab-runner /usr/local/bin/gitlab-runner; rm -rf /tmp/gitlab-runner.deb /tmp/gitlab-runner-deb; " +
+            "sha256sum /usr/local/bin/gitlab-runner; " +
+            `echo '${GITLAB_RUNNER_SHA256}  /usr/local/bin/gitlab-runner' | sha256sum -c -; ` +
+            "chmod 0755 /usr/local/bin/gitlab-runner; mkdir -p /etc/gitlab-runner; chmod 0700 /etc/gitlab-runner",
+        `set -eu; ${writeStep(GITLAB_LAUNCHER, GITLAB_LAUNCHER_SCRIPT, "0755")}`,
+        `set -eu; docker pull -q ${GITLAB_HELPER_IMAGE}; docker pull -q ${GITLAB_DEFAULT_JOB_IMAGE}`,
+    ];
+    const platform_setup = ["set -eu; promigence-dockerd stop"];
+    const verify = `set -eu; gitlab-runner --version; git --version; test -x ${GITLAB_LAUNCHER}`;
+    return { image: RUNNER_BASE_IMAGE, setup, platform_setup, verify, tier, alias: runnerAlias(kind, tier) };
+}
+export function isRunnerTier(t) {
+    return RUNNER_TIERS.includes(t);
+}