release: v0.21.1 [skip ci]

Co-authored-by: emil User <emil.simeonov@tutanota.com>

.gitea/workflows/ci.yml

@@ -295,6 +295,49 @@ jobs:
             --checklist-confirmed \
             --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
             --body "Auto-approved: all CI checks passed (validate, molecule-tests)."
+      - name: Wait for molecule tests to complete
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          # Poll commit status until all required checks pass or fail
+          MAX_WAIT=600  # 10 minutes
+          ELAPSED=0
+          while [ $ELAPSED -lt $MAX_WAIT ]; do
+            STATUS=$(curl -s -H "Authorization: token $CI_GITEA_API_TOKEN" \
+              "https://git.oblachno.oblachno.fyi/api/v1/repos/${{ github.repository }}/commits/$HEAD_SHA/status" \
+              | python3 -c "
+          import sys,json
+          d=json.load(sys.stdin)
+          statuses={s['context']:s['status'] for s in d.get('statuses',[])}
+          # Check if all molecule-tests contexts are terminal (success/failure)
+          mol_contexts=[k for k in statuses if 'molecule-tests' in k]
+          if not mol_contexts:
+              print('pending')
+          elif all(statuses[k] in ('success','failure') for k in mol_contexts):
+              if any(statuses[k]=='failure' for k in mol_contexts):
+                  print('failure')
+              else:
+                  print('success')
+          else:
+              print('pending')
+          ")
+            echo "Molecule tests status: $STATUS (elapsed: ${ELAPSED}s)"
+            if [ "$STATUS" = "success" ]; then
+              echo "All molecule tests passed."
+              break
+            elif [ "$STATUS" = "failure" ]; then
+              echo "ERROR: Molecule tests failed. Aborting auto-merge."
+              exit 1
+            fi
+            sleep 30
+            ELAPSED=$((ELAPSED + 30))
+          done
+          if [ $ELAPSED -ge $MAX_WAIT ]; then
+            echo "ERROR: Timed out waiting for molecule tests."
+            exit 1
+          fi
       - name: Squash merge with task ID
         env:
           CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.21.1] - 2026-08-24
+
+### Bug Fixes
+
+- Use runuser for systemctl --user tasks in gitea_runner role
+
 ## [0.21.0] - 2026-08-09
 
 ### Features

ansible/roles/gitea_runner/defaults/main.yml

@@ -90,22 +90,6 @@ gitea_runner_remove_user: true
 gitea_runner_log_level: "info"
 gitea_runner_container_label: "gitea-runner=true"
 gitea_runner_file: ".runner"
-# force_pull: when false (default), the runner reuses locally cached images
-# instead of pulling on every job. Pre-cached images (via the pre-cache timer
-# or pre_pull_images task) eliminate registry thundering-herd when all runners
-# start jobs simultaneously.
-gitea_runner_force_pull: false
-# Container options passed to `docker run` for CI job containers.
-# Mounts the host rootless Docker socket as /run/host-docker.sock so
-# start_docker.py inside the container can detect and use the host daemon
-# (full disk, no nested DinD) instead of starting an inner dockerd.
-gitea_runner_container_options: "-v /run/user/{{ gitea_runner_uid }}/docker.sock:/run/host-docker.sock"
-# Volumes allowed in CI job containers (validated by the runner against
-# container.options and job-level volumes). Must include the host Docker
-# socket mount target.
-gitea_runner_valid_volumes:
-  - "/run/host-docker.sock"
-  - "/run/user/{{ gitea_runner_uid }}/docker.sock"
 
 # Containerd version pinning — Docker 28.x vendors containerd v2.1.x internally.
 # containerd.io >= 2.3 ships a shim that returns a protobuf BootstrapResult which
@@ -151,11 +135,3 @@ gitea_runner_docker_ipv6_cidr: "fd00:dead:beef::/48"
 # disk-space prune only removes dangling images, so pre-pulled tagged images persist.
 # Set to [] to skip pre-pulling. Images are pulled as the runner user via rootless Docker.
 gitea_runner_pre_pull_images: []
-
-# Pre-cache timer: periodically pulls the runner container image so it stays
-# fresh in the local Docker cache. This prevents thundering-herd registry
-# timeouts when all runners start CI jobs simultaneously with empty caches.
-# Runs every 6 hours (aligned with prune schedule). Set to empty string to
-# disable the timer.
-gitea_runner_pre_cache_schedule: "*-*-* 00/6:30:00"
-gitea_runner_pre_cache_images: "{{ gitea_runner_pre_pull_images }}"

ansible/roles/gitea_runner/tasks/healthcheck.yml

@@ -40,24 +40,22 @@
     mode: "0644"
 
 - name: Reload systemd user daemon for healthcheck timer
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user daemon-reload
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
     - gitea_runner_docker_rootless_setup
 
 - name: Enable and start healthcheck user timer
-  ansible.builtin.command: systemctl --user enable --now runner-healthcheck.timer
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user enable --now runner-healthcheck.timer
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists

ansible/roles/gitea_runner/tasks/install_runner.yml

@@ -13,9 +13,9 @@
 - name: Include validation
   ansible.builtin.include_tasks: validate.yml
 
+- name: Include service setup
+  ansible.builtin.include_tasks: service.yml
+
 - name: Include registration
   ansible.builtin.include_tasks: register.yml
   when: not gitea_runner_skip_registration
-
-- name: Include service setup
-  ansible.builtin.include_tasks: service.yml

ansible/roles/gitea_runner/tasks/main.yml

@@ -20,9 +20,6 @@
 - name: Include pre-pull images
   ansible.builtin.include_tasks: pre_pull_images.yml
 
-- name: Include pre-cache timer
-  ansible.builtin.include_tasks: pre_cache.yml
-
 - name: Include integration test
   ansible.builtin.include_tasks: integration_test.yml
   when: not gitea_runner_skip_registration

ansible/roles/gitea_runner/tasks/pre_cache.yml

@@ -1,67 +0,0 @@
----
-# Periodic timer that pre-pulls CI runner images into the local Docker cache.
-# Prevents thundering-herd registry timeouts when all runners start jobs
-# simultaneously with empty/stale caches. Runs every 6 hours (configurable).
-# The prune timer removes dangling images but NOT tagged ones, so pre-pulled
-# images persist between runs.
-
-- name: Create docker-pull-images user service file
-  ansible.builtin.template:
-    src: docker-pull-images.service.j2
-    dest: "{{ gitea_runner_home }}/.config/systemd/user/docker-pull-images.service"
-    owner: "{{ gitea_runner_service_user }}"
-    group: "{{ gitea_runner_service_user }}"
-    mode: "0644"
-  register: gitea_runner_pre_cache_service
-
-- name: Create docker-pull-images user timer file
-  ansible.builtin.template:
-    src: docker-pull-images.timer.j2
-    dest: "{{ gitea_runner_home }}/.config/systemd/user/docker-pull-images.timer"
-    owner: "{{ gitea_runner_service_user }}"
-    group: "{{ gitea_runner_service_user }}"
-    mode: "0644"
-  register: gitea_runner_pre_cache_timer
-
-- name: Reload systemd user daemon for pre-cache timer
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
-  changed_when: true
-  when:
-    - gitea_runner_systemd_available.stat.exists
-    - gitea_runner_docker_rootless_setup
-    - gitea_runner_pre_cache_service is changed or gitea_runner_pre_cache_timer is changed
-    - gitea_runner_pre_cache_schedule | length > 0
-    - gitea_runner_pre_cache_images | length > 0
-
-- name: Enable and start docker-pull-images user timer
-  ansible.builtin.command: systemctl --user enable --now docker-pull-images.timer
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
-  changed_when: true
-  when:
-    - gitea_runner_systemd_available.stat.exists
-    - gitea_runner_docker_rootless_setup
-    - gitea_runner_pre_cache_schedule | length > 0
-    - gitea_runner_pre_cache_images | length > 0
-
-- name: Disable and stop docker-pull-images timer (no images or schedule)
-  ansible.builtin.command: systemctl --user disable --now docker-pull-images.timer
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
-  changed_when: true
-  failed_when: false
-  when:
-    - gitea_runner_systemd_available.stat.exists
-    - gitea_runner_docker_rootless_setup
-    - gitea_runner_pre_cache_schedule | length == 0 or gitea_runner_pre_cache_images | length == 0

ansible/roles/gitea_runner/tasks/prune.yml

@@ -18,12 +18,11 @@
   register: gitea_runner_prune_timer
 
 - name: Reload systemd user daemon for prune timer
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user daemon-reload
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -31,12 +30,11 @@
     - gitea_runner_prune_service is changed or gitea_runner_prune_timer is changed
 
 - name: Enable and start docker-prune user timer
-  ansible.builtin.command: systemctl --user enable --now docker-prune.timer
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user enable --now docker-prune.timer
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists

ansible/roles/gitea_runner/tasks/register.yml

@@ -44,13 +44,16 @@
     ('already exists' not in gitea_runner_register_output.stdout | default(''))
   timeout: 60
 
-- name: Ensure runner service is running after registration
-  ansible.builtin.command: systemctl --user start gitea-runner
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+# Note: service start is handled by service.yml (included after register.yml
+# in install_runner.yml). Starting here fails because the systemd unit file
+# has not been created yet.
+
+- name: Restart runner service after (re-)registration
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user restart gitea-runner
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists

ansible/roles/gitea_runner/tasks/rootless_docker.yml

@@ -143,6 +143,10 @@
       {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
       Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--ipv6"
       {% endif %}
+      Restart=always
+      RestartSec=5
+      StartLimitIntervalSec=300
+      StartLimitBurst=10
     mode: "0644"
     owner: "{{ gitea_runner_service_user }}"
     group: "{{ gitea_runner_service_user }}"
@@ -212,22 +216,20 @@
     - not gitea_runner_rootless_docker_check.stat.exists
 
 - name: Start rootless Docker daemon (systemd user service)
-  ansible.builtin.command: systemctl --user start docker
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user start docker
   changed_when: true
   when: gitea_runner_docker_rootless_setup
 
 - name: Enable rootless Docker daemon (systemd user service)
-  ansible.builtin.command: systemctl --user enable docker
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user enable docker
   changed_when: true
   when: gitea_runner_docker_rootless_setup
 
@@ -250,6 +252,10 @@
       {% if gitea_runner_docker_rootless_net_driver == 'pasta' %}
       Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--ipv6"
       {% endif %}
+      Restart=always
+      RestartSec=5
+      StartLimitIntervalSec=300
+      StartLimitBurst=10
     mode: "0644"
     owner: "{{ gitea_runner_service_user }}"
     group: "{{ gitea_runner_service_user }}"
@@ -257,12 +263,11 @@
   when: gitea_runner_docker_rootless_setup
 
 - name: Reload systemd user daemon if network config changed
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user daemon-reload
   changed_when: true
   when:
     - gitea_runner_docker_rootless_setup
@@ -300,12 +305,11 @@
   when: gitea_runner_docker_rootless_setup
 
 - name: Restart rootless Docker if config changed
-  ansible.builtin.command: systemctl --user restart docker
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user restart docker
   changed_when: true
   when:
     - gitea_runner_docker_rootless_setup

ansible/roles/gitea_runner/tasks/service.yml

@@ -9,12 +9,11 @@
   register: gitea_runner_service_file
 
 - name: Reload systemd user daemon
-  ansible.builtin.command: systemctl --user daemon-reload
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user daemon-reload
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -22,12 +21,11 @@
     - gitea_runner_service_file is changed
 
 - name: Restart gitea-runner if service file changed
-  ansible.builtin.command: systemctl --user restart gitea-runner
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user restart gitea-runner
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists
@@ -35,12 +33,11 @@
     - gitea_runner_service_file is changed
 
 - name: Enable and start gitea-runner user service
-  ansible.builtin.command: systemctl --user enable --now gitea-runner
-  become: true
-  become_user: "{{ gitea_runner_service_user }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus"
+  ansible.builtin.command: >
+    runuser -u {{ gitea_runner_service_user }} --
+    env XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
+    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{{ gitea_runner_uid | default(0) }}/bus
+    systemctl --user enable --now gitea-runner
   changed_when: true
   when:
     - gitea_runner_systemd_available.stat.exists

ansible/roles/gitea_runner/templates/docker-pull-images.service.j2

@@ -1,14 +0,0 @@
-[Unit]
-Description=Pre-pull Docker images for CI runner cache
-After=docker.service
-Wants=docker.service
-
-[Service]
-Type=oneshot
-Environment=DOCKER_HOST=unix:///run/user/{{ gitea_runner_uid }}/docker.sock
-Environment=XDG_RUNTIME_DIR=/run/user/{{ gitea_runner_uid }}
-# Pull each image quietly. docker pull exits 0 if image is already up-to-date,
-# so this is idempotent. Errors are non-fatal (image may already be cached).
-{% for image in gitea_runner_pre_cache_images %}
-ExecStart=/usr/bin/docker pull -q {{ image }}
-{% endfor %}

ansible/roles/gitea_runner/templates/docker-pull-images.timer.j2

@@ -1,10 +0,0 @@
-[Unit]
-Description=Periodic Docker image pre-cache for CI runner
-
-[Timer]
-OnCalendar={{ gitea_runner_pre_cache_schedule }}
-Persistent=true
-RandomizedDelaySec=300
-
-[Install]
-WantedBy=timers.target

ansible/roles/gitea_runner/templates/gitea-runner-config.yaml.j2

@@ -9,13 +9,3 @@ runner:
 container:
   label: "{{ gitea_runner_container_label }}"
   docker_host: "unix:///run/user/{{ gitea_runner_uid }}/docker.sock"
-  force_pull: {{ gitea_runner_force_pull | lower }}
-{% if gitea_runner_container_options | length > 0 %}
-  options: "{{ gitea_runner_container_options }}"
-{% endif %}
-{% if gitea_runner_valid_volumes | length > 0 %}
-  valid_volumes:
-{% for volume in gitea_runner_valid_volumes %}
-    - "{{ volume }}"
-{% endfor %}
-{% endif %}

src/grm/__init__.py

@@ -1,3 +1,3 @@
 """Gitea Runner Manager — lean CLI for managing Gitea Actions runners."""
 
-__version__ = "0.21.0"
+__version__ = "0.21.1"