runner-reaper.yml

name: Runner reaper

# Runs the ARC role's runner reaper in a kind cluster (tests/runner_reaper/run.sh): ARC's EphemeralRunner CRD, the role's rendered CronJob, RBAC and ConfigMap, the pull Secret renewal's image built from this checkout, and a stand-in for GitHub's API. Shows a runner whose job ran past the bound and one whose run was cancelled being deleted, and an idle runner and a busy one being left alone. Only on changes that can affect the reaper.
#
# GitHub-hosted ubuntu-latest has Docker, kind, kubectl, helm and jq already.

on:
  pull_request:
    paths:
      - roles/github_runner_arc/**
      - pull-secret-renewer/**
      - tests/runner_reaper/**
      - .github/workflows/runner-reaper.yml
  workflow_dispatch:

concurrency:
  group: runner-reaper-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  reaper:
    name: Reaper in kind
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7

      - name: Install Ansible
        run: |
          set -euo pipefail
          if ! python3 -m venv "${RUNNER_TEMP}/venv" 2>/dev/null; then
            sudo apt-get update -qq
            sudo apt-get install -y -qq python3-venv
            python3 -m venv "${RUNNER_TEMP}/venv"
          fi
          "${RUNNER_TEMP}/venv/bin/pip" install --quiet --prefer-binary ansible-core
          echo "${RUNNER_TEMP}/venv/bin" >> "$GITHUB_PATH"

      - name: Run the reaper test
        run: tests/runner_reaper/run.sh