runner: reproducible nix-built job image + compose-based act_runner

runner/config.yaml

@@ -0,0 +1,28 @@
+# act_runner config. The `runner.labels` mapping says: when a workflow
+# requests `runs-on: self-hosted`, spawn the cargoxx-runner-job:latest
+# image (built from runner/flake.nix). Other labels can be added by
+# building additional images and listing them here.
+log:
+  level: info
+
+runner:
+  file: .runner
+  capacity: 1
+  envs: {}
+  labels:
+    - "self-hosted:docker://cargoxx-runner-job:latest"
+
+cache:
+  enabled: false
+
+container:
+  network: bridge
+  privileged: false
+  options: ""
+  workdir_parent: /workspace
+  valid_volumes: []
+  docker_host: "unix:///var/run/docker.sock"
+  force_pull: false
+
+host:
+  workdir_parent: ""