entrypoint.sh

#!/bin/bash
# Registers this container as a self-hosted runner for one repo, runs the
# listener, deregisters on shutdown.
#
# Deliberately toolchain-agnostic: nothing about Java, Android, or Gradle lives
# here (that's the Dockerfile's job), so this file is reusable as-is for a
# runner serving any other kind of repo.
set -euo pipefail

export RUNNER_ALLOW_RUNASROOT=1

: "${ACCESS_TOKEN:?ACCESS_TOKEN required (see .env.example)}"
: "${REPO_URL:?REPO_URL required (see .env.example)}"

RUNNER_NAME="${RUNNER_NAME:-android-runner-$(hostname)}"
# config.sh adds self-hosted/Linux/X64 on its own, so only custom labels here.
RUNNER_LABELS="${RUNNER_LABELS:-android}"
RUNNER_WORKDIR="${RUNNER_WORKDIR:-/_work}"

cd /actions-runner
mkdir -p "${RUNNER_WORKDIR}" "${GRADLE_USER_HOME:-/cache/gradle}"

_DEREGISTERED=false

deregister() {
  [[ ${_DEREGISTERED} == true ]] && return 0
  _DEREGISTERED=true

  echo "Deregistering ${RUNNER_NAME}"
  # The registration token is single-use and long spent by now, so mint a fresh
  # one. Skipping this leaves a permanently "offline" runner listed in GitHub.
  local token
  if token=$(ACCESS_TOKEN="${ACCESS_TOKEN}" REPO_URL="${REPO_URL}" /token.sh); then
    ./config.sh remove --token "${token}" ||
      echo "WARNING: config.sh remove failed — delete '${RUNNER_NAME}' manually in repo Settings > Actions > Runners"
  else
    echo "WARNING: could not mint a removal token — delete '${RUNNER_NAME}' manually"
  fi
  rm -f /actions-runner/.runner
}

shutdown() {
  echo "Caught $1 — asking the listener to finish its current job"
  kill -TERM "${RUNNER_PID}" 2>/dev/null || true
  wait "${RUNNER_PID}" 2>/dev/null || true
  deregister
  exit 0
}

# A .runner left by a previous container makes config.sh think it's already set
# up; --replace only handles the GitHub side of that, this handles the local side.
rm -f .runner

echo "Requesting registration token for ${REPO_URL}"
REG_TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" REPO_URL="${REPO_URL}" /token.sh)

echo "Configuring runner ${RUNNER_NAME}"
# --disableupdate: GitHub otherwise swaps the runner binary in place mid-flight,
# which a hand-rolled entrypoint is far more likely to choke on than the
# battle-tested wrappers. Pin the version in the Dockerfile and bump it there.
./config.sh \
  --url "${REPO_URL}" \
  --token "${REG_TOKEN}" \
  --name "${RUNNER_NAME}" \
  --work "${RUNNER_WORKDIR}" \
  --labels "${RUNNER_LABELS}" \
  --unattended \
  --replace \
  --disableupdate

# Backstop: if anything below dies under `set -e`, still deregister.
trap deregister EXIT

# Run the listener in the BACKGROUND and `wait` on it, rather than the obvious
# foreground call. bash defers signal handlers while a foreground child runs, so
# a foreground listener means SIGTERM from `docker compose down` sits pending
# until the child exits — the container gets SIGKILLed first and never
# deregisters. `wait` is interruptible, so the handler fires immediately.
"$@" &
RUNNER_PID=$!
trap 'shutdown SIGTERM' TERM
trap 'shutdown SIGINT' INT
trap 'shutdown SIGQUIT' QUIT

wait "${RUNNER_PID}" || true
deregister