GitHub Actions Runner: register several self-hosted runners per repository

[Baker]

✍️ Description

Adds a Debian 13 container for the GitHub Actions runner. One LXC registers several runner processes per repository, because a personal account cannot share one registration across repos and each process takes a single job.

The shared helper creates the container. This script asks for the owner, the repository list, a token, and how many runners to register, then installs the upstream tarball with fetch_and_deploy_gh_release. Docker is installed with setup_docker so workflow jobs can start containers. The runner binaries stay on the system, same arrangement as gitea-runner.

The token is used to mint a short-lived registration token and is not written to disk. Before the container is created, the host asks GitHub for a registration token for each repository and discards the body, so a bad token does not leave an LXC behind. Updates replace /opt/actions-runner and copy the new binaries onto the existing registrations. They do not ask for the token again.

config.sh refuses to run as root unless RUNNER_ALLOW_RUNASROOT=1. The scripts do not add a system user, so the service runs as root with that variable set. Workflow code from the registered repositories has root inside the container. Credentials are mode 600 under a mode 700 directory. (Happy to fix this if y'all want, not sure what the standard process is.)

Defaults are 4 cores, 12 GB RAM, and 40 GB disk. A job such as govulncheck can use several gigabytes, and the runners share one network namespace, so two jobs that publish the same host port will collide.

This port has not been executed on a Proxmox host. The behavior was taken from a host installer that is already running in a homelab. That installer also created the LXC itself. This version leaves creation to build_container, so it does not reconfigure an existing CTID.

🔗 Related PR / Issue

Link: #

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected.
• No breaking changes – Existing functionality remains intact.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

---

🏗️ arm64 Support (X in brackets)

• arm64 supported - Tested and supported on arm64.
• arm64 not tested - Assumed to work on arm64, but testing has not been done.
• arm64 not supported - Confirmed upstream dependencies or binaries do not support arm64.

---

🖥️ Tested on (X in brackets)

• Proxmox VE – Created on a Proxmox VE host and the app works.
• Incus – Created on an Incus host and the app works.

Application containers run on both; tick what you actually tested. VMs and host tools are Proxmox only.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to website-related JSON files or metadata.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

---

🔍 Code & Security Review (X in brackets)

• Follows CODE-AUDIT.md & CONTRIBUTING.md guidelines
• Uses correct script structure (AppName.sh, AppName-install.sh, AppName.json)
• No hardcoded credentials
• No Docker / Docker Compose – The application is installed bare-metal; Docker is not used.
• No git pull – Updates use fetch_and_deploy_gh_release, fetch_and_deploy_codeberg_release, fetch_and_deploy_gl_release, or fetch_and_deploy_from_url instead of git pull.

Docker is installed for workflow containers, the same reason gitea-runner calls setup_docker. The runner is not run from a Docker image.

---

🤖 AI Assistance (X in brackets)

If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you must confirm compliance below.
Select exactly one option.

• No AI used – Scripts were written without AI assistance.
• AI was used – I confirm the scripts were built using AGENTS.md and .github/agents/pve-script-creator.agent.md as guidance, and the output has been reviewed and corrected to match those guidelines.

Please describe to which degree, if any, an LLM was used in creating this pull request. Name the model(s) used and, if applicable, the reasoning/thinking effort level (e.g. "Claude Sonnet 4.5, high reasoning, used to draft the install script, then manually reviewed and tested" or "No LLM used"). This is informational, not a penalty — but scripts that are clearly AI-generated and not further revised by the author to match CODE-AUDIT.md / CONTRIBUTING.md may be closed without review.

Grok 4.7 drafted the three files from AGENTS.md, gitea-runner, and an existing homelab installer, then aligned them to fetch_and_deploy_gh_release, setup_docker, prompt_password, prompt_input_required, and arch_resolve. The draft was reviewed against those helpers before commit.

---

📋 Additional Information (optional)

Upstream release checked while writing this: actions/runner v2.338.0 publishes actions-runner-linux-x64-2.338.0.tar.gz and actions-runner-linux-arm64-2.338.0.tar.gz.

Unattended install:

var_gh_owner=OWNER var_gh_repos=repo-one,repo-two var_gh_token=TOKEN bash -c "$(curl -fsSL https://raw.githubusercontent.com/Baker/DevScripts/github-actions-runner/ct/github-actions-runner.sh)"

var_runner_count defaults to 2. var_runner_name defaults to github-runner.

I have been running a similar version that I decided to use and convert to this to Community Script. (Link)

---

📦 Application Requirements (for new scripts)

⚠️ Do not remove this section.
It is used by automated PR validation checks.
If this PR is not a new script submission, leave the checkboxes unchecked.

Required for 🆕 New script submissions.
Pull requests that do not meet these requirements may be closed without review.

• The application is at least 6 months old
• The application is actively maintained
• The application has 600+ GitHub stars
• Official release tarballs are published
• I understand that not all scripts will be accepted due to various reasons and criteria by the community-scripts ORG

actions/runner was created 2019-04-30, last pushed 2026-10-12, and has 6323 stars. Releases ship official linux tarballs.

🌐 Source

https://github.com/actions/runner
https://docs.github.com/en/actions/hosting-your-own-runners

[github-actions]

Try this script

ct/github-actions-runner.sh, run in the Proxmox VE shell or on an Incus host:

COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/Baker/DevScripts/github-actions-runner \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/Baker/DevScripts/github-actions-runner/ct/github-actions-runner.sh)"

COMMUNITY_SCRIPTS_URL is not optional for ct/. Fetching the ct/ script from a
branch does not tell the engine where that branch is — with bash -c "$(curl …)"
there is no file on disk for the scripts root to be derived from, so it would fall
back to upstream main and look for the install script there.

Against a core branch as well

Add COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/OWNER/core/BRANCH
to test an engine change at the same time. The two resolve independently.

Useful flags while testing

dev_mode=net logs every fetch with status and duration, so you can confirm the
branch is really being used. dev_mode=keep stops a failed build from deleting
the container along with the evidence.

[github-actions]

⚠️ Not ready for review yet

@Baker, this pull request is missing the following:

• No Docker / Docker Compose must be confirmed – the application must run bare-metal

Edit the PR description to fix it — no new PR needed. This check runs again on every edit and clears itself once everything is in place.

Until then the PR is marked stale and will be closed in 7 days.

---

@community-scripts/contributor please take a look: close it, comment, or set keep-open to keep it.