runner: reproducible nix-built job image + compose-based act_runner

runner/compose.yml

@@ -0,0 +1,20 @@
+# Runs the act_runner that listens to Gitea and spawns one job
+# container per workflow run. The job image (cargoxx-runner-job:latest)
+# is built reproducibly from runner/flake.nix — run `nix run .#load-image`
+# in this directory to load it into the host's Docker daemon before
+# starting the runner.
+version: "3.8"
+services:
+  runner:
+    image: docker.io/gitea/act_runner:nightly
+    restart: unless-stopped
+    environment:
+      CONFIG_FILE: /config.yaml
+      GITEA_INSTANCE_URL: "${GITEA_INSTANCE_URL}"
+      GITEA_RUNNER_REGISTRATION_TOKEN: "${GITEA_RUNNER_REGISTRATION_TOKEN}"
+      GITEA_RUNNER_NAME: "${GITEA_RUNNER_NAME:-cargoxx-pkgs-runner}"
+      GITEA_RUNNER_LABELS: "${GITEA_RUNNER_LABELS:-self-hosted}"
+    volumes:
+      - ./config.yaml:/config.yaml:ro
+      - ./data:/data
+      - /var/run/docker.sock:/var/run/docker.sock