2 ms·
Self-hosted runners are also useful when debugging weird behaviour in a GitHub Action. I do it by spinning up a VM on my local pc, then running the GitHub Acti
by justinclift 3y ago
Self-hosted runners are also useful when debugging weird behaviour in a GitHub Action.
I do it by spinning up a VM on my local pc, then running the GitHub Actions software in the VM.
This gives a fully working GitHub Actions runner which I can ssh into directly and muck around with to investigate and get things working.
It's also easy to ensure only the right jobs end up on my runner.
The installer for the GitHub Actions runner asks for optional tag names to use, so I add "jc" (my initials) to the tags.
Then I add a matching "jc" to the "runs-on" clause in the workflow in my fork or PR:
runs-on: [self-hosted, linux, x64, jc]
With that, the GitHub Actions for that workflow only run on my local VM.
Works pretty well. :)
---
Official docs for the labelling bit: https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/using-self-hosted-runners-in-a-workflow#using-custom-labels-to-route-jobs https://docs.github.com/en/actions/hosting-your-own-runners/...
- leonheld 3y agoDo you do this for public repos? GitHub Actions is strongly not recommended for non-private. Struggling to have good security policies in place for a deployment I'm doing...
- bmitc 3y ago> GitHub Actions is strongly not recommended for non-private. By who? Why?
- akerl_ 3y agoWhere are you seeing that GitHub actions isn’t recommended for public repos?
- theodorton 3y agoI believe they're referring to this section: https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#self-hosted-runner-security https://docs.github.com/en/actions/hosting-your-own-runners/...
- Belphemur 3y agoSounds like outdated advice from the time before they implemented approval for running action from PR of untrusted people. In the past, people could modify the GitHub action workflow and run crypto miners on the agents. But since GitHub changed the default for PR where the actions aren't run anymore that killed that attack vector.
- everfrustrated 3y agoBecause the self-hosted runners save state between runs, as well as publicly-opened PRs/branches giving the public access to your runner environment variables/secrets.
- justinclift 3y agoThanks, I'd not seen that recommendation. Looks like I'd better do some research. :)
- Etheryte 3y agoAn easier way to debug Github Actions is to use tmate [0]. In short, you can set up an action that allows you to tmate into the worker on failure and then figure out what's wrong. In addition to the default setup, it's recommended to limit access with an SSH key [1]. [0] https://github.com/mxschmitt/action-tmate https://github.com/mxschmitt/action-tmate [1] https://github.com/mxschmitt/action-tmate?tab=readme-ov-file#use-registered-public-ssh-keys https://github.com/mxschmitt/action-tmate?tab=readme-ov-file...
- justinclift 3y agoThanks, that sounds like it's worth checking out. :)