Fix the gitea_runner role to use runuser for systemctl --user invocations instead of become: true, which was causing silent failures of systemd user timers.
Changes
Use runuser -u <user> -- env XDG_RUNTIME_DIR=... DBUS_SESSION_BUS_ADDRESS=... systemctl --user ... pattern in prune.yml, healthcheck.yml, service.yml, rootless_docker.yml, and register.yml
Fix service startup order — service start is handled by service.yml (included after register.yml)
Add Docker restart override for runner self-healing
Pin devx to v0.50.1 (v0.50.5 tag does not exist)
Remove non-existent wait_for_checks step from auto-merge workflow
Verification
All 6 molecule tests pass
CI validate passes
Closes GRM-163
## Summary
Fix the gitea_runner role to use `runuser` for `systemctl --user` invocations instead of `become: true`, which was causing silent failures of systemd user timers.
## Changes
- Use `runuser -u <user> -- env XDG_RUNTIME_DIR=... DBUS_SESSION_BUS_ADDRESS=... systemctl --user ...` pattern in prune.yml, healthcheck.yml, service.yml, rootless_docker.yml, and register.yml
- Fix service startup order — service start is handled by service.yml (included after register.yml)
- Add Docker restart override for runner self-healing
- Pin devx to v0.50.1 (v0.50.5 tag does not exist)
- Remove non-existent `wait_for_checks` step from auto-merge workflow
## Verification
- All 6 molecule tests pass
- CI validate passes
Closes GRM-163
Auto-merge: If all CI checks pass, this PR will be merged automatically.
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- i18n: OK
- Resource management: OK
- Documentation: OK
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Auto-merge:** If all CI checks pass, this PR will be merged automatically.
emo
approved these changes 2026-08-24 01:52:29 +00:00
Auto-merge: If all CI checks pass, this PR will be merged automatically.
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- i18n: OK
- Resource management: OK
- Documentation: OK
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Auto-merge:** If all CI checks pass, this PR will be merged automatically.
emo
approved these changes 2026-08-24 02:07:31 +00:00
Auto-merge: If all CI checks pass, this PR will be merged automatically.
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- i18n: OK
- Resource management: OK
- Documentation: OK
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Auto-merge:** If all CI checks pass, this PR will be merged automatically.
emo
approved these changes 2026-08-24 02:18:11 +00:00
Auto-merge: If all CI checks pass, this PR will be merged automatically.
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- i18n: OK
- Resource management: OK
- Documentation: OK
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Auto-merge:** If all CI checks pass, this PR will be merged automatically.
emo
approved these changes 2026-08-24 02:31:16 +00:00
The become_user pattern with sudo doesn't reliably connect to the
user's D-Bus session, causing systemd user timers (docker-prune,
runner-healthcheck) to silently fail to enable. This led to stale
Docker images accumulating and filling the disk on CI runners.
Switch all systemctl --user invocations to use runuser with explicit
XDG_RUNTIME_DIR and DBUS_SESSION_BUS_ADDRESS environment variables,
which correctly connects to the user's systemd session.
Affected tasks: prune timer, healthcheck timer, gitea-runner service,
rootless Docker daemon start/enable/restart, runner service restart.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Three fixes for runner reliability:
1. Fix service startup order (install_runner.yml)
- Move service.yml include BEFORE register.yml
- Previously, register.yml tried to start gitea-runner.service
before service.yml created the systemd unit file, causing
"Unit gitea-runner.service not found" on first install
- This only failed when registration actually happened (new runner);
on idempotent re-runs registration was skipped so the bug was masked
2. Restart runner after (re-)registration (register.yml)
- Add "Restart runner service after (re-)registration" task
- When a runner is re-registered (force-reregister or auto-recovery),
the service must be restarted to pick up the new .runner file
- The old premature start task was already removed; this adds it back
in the correct position (after service.yml has created the unit)
3. Docker daemon restart override (rootless_docker.yml)
- Add Restart=always, RestartSec=5, StartLimitIntervalSec=300,
StartLimitBurst=10 to both Docker service override blocks
- Upstream dockerd-rootless-setuptool.sh defaults to
StartLimitBurst=3 in 60s — too aggressive for OOM-prone hosts
- If Docker crashes 3 times in a minute, it stops restarting
permanently, taking the runner down with it
- New settings allow 10 restarts in 5 minutes, matching the
runner service's own restart policy
Note: Auto-recovery (--auto-recover-token) already exists in the CLI
and healthcheck script but defaults to disabled. Operators should pass
--auto-recover-token <token> during grm install to enable automatic
re-registration when runners become unregistered.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Documentation: WARNING — Ansible role changed but no docs updated
Tests: OK
Commit conventions: OK
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- i18n: OK
- Resource management: OK
- Documentation: WARNING — Ansible role changed but no docs updated
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Auto-merge:** If all CI checks pass, this PR will be merged automatically.
emo
approved these changes 2026-08-24 02:45:37 +00:00
Documentation: WARNING — Ansible role changed but no docs updated
Tests: OK
Commit conventions: OK
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- i18n: OK
- Resource management: OK
- Documentation: WARNING — Ansible role changed but no docs updated
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Auto-merge:** If all CI checks pass, this PR will be merged automatically.
emo
approved these changes 2026-08-24 02:57:38 +00:00
Documentation: WARNING — Ansible role changed but no docs updated
Tests: OK
Commit conventions: OK
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- i18n: OK
- Resource management: OK
- Documentation: WARNING — Ansible role changed but no docs updated
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Auto-merge:** If all CI checks pass, this PR will be merged automatically.
emo
approved these changes 2026-08-24 03:13:10 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
emo
Summary
Fix the gitea_runner role to use
runuserforsystemctl --userinvocations instead ofbecome: true, which was causing silent failures of systemd user timers.Changes
runuser -u <user> -- env XDG_RUNTIME_DIR=... DBUS_SESSION_BUS_ADDRESS=... systemctl --user ...pattern in prune.yml, healthcheck.yml, service.yml, rootless_docker.yml, and register.ymlwait_for_checksstep from auto-merge workflowVerification
Closes GRM-163
Automated PR Review
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
Auto-approved: all CI checks passed (validate, molecule-tests).
Automated PR Review
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
Auto-approved: all CI checks passed (validate, molecule-tests).
Automated PR Review
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
Auto-approved: all CI checks passed (validate, molecule-tests).
477d425745to56f53cb32eAutomated PR Review
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
Auto-approved: all CI checks passed (validate, molecule-tests).
Three fixes for runner reliability: 1. Fix service startup order (install_runner.yml) - Move service.yml include BEFORE register.yml - Previously, register.yml tried to start gitea-runner.service before service.yml created the systemd unit file, causing "Unit gitea-runner.service not found" on first install - This only failed when registration actually happened (new runner); on idempotent re-runs registration was skipped so the bug was masked 2. Restart runner after (re-)registration (register.yml) - Add "Restart runner service after (re-)registration" task - When a runner is re-registered (force-reregister or auto-recovery), the service must be restarted to pick up the new .runner file - The old premature start task was already removed; this adds it back in the correct position (after service.yml has created the unit) 3. Docker daemon restart override (rootless_docker.yml) - Add Restart=always, RestartSec=5, StartLimitIntervalSec=300, StartLimitBurst=10 to both Docker service override blocks - Upstream dockerd-rootless-setuptool.sh defaults to StartLimitBurst=3 in 60s — too aggressive for OOM-prone hosts - If Docker crashes 3 times in a minute, it stops restarting permanently, taking the runner down with it - New settings allow 10 restarts in 5 minutes, matching the runner service's own restart policy Note: Auto-recovery (--auto-recover-token) already exists in the CLI and healthcheck script but defaults to disabled. Operators should pass --auto-recover-token <token> during grm install to enable automatic re-registration when runners become unregistered. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>56f53cb32eto150d3267d1New commits pushed, approval review dismissed automatically according to repository settings
Automated PR Review
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
Auto-approved: all CI checks passed (validate, molecule-tests).
Automated PR Review
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
Auto-approved: all CI checks passed (validate, molecule-tests).
New commits pushed, approval review dismissed automatically according to repository settings
Automated PR Review
No issues found by automated checks.
Auto-merge: If all CI checks pass, this PR will be merged automatically.
Auto-approved: all CI checks passed (validate, molecule-tests).