6 files changed, 24 insertions, 66 deletions
diff --git a/internal/workflows/Containerfile b/internal/workflows/Containerfile
new file mode 100644
index 00000000..3b1baeda
--- /dev/null
+++ b/internal/workflows/Containerfile
@@ -0,0 +1,14 @@
+FROM docker.gitea.com/runner-images:ubuntu-latest
+
+RUN rm /var/run && ln -sf ../run /var && mkdir /var/empty
+RUN add-apt-repository -y ppa:savoury1/pipewire && \
+	apt-get update && apt-get install -y \
+		msft-golang \
+		libmount-dev \
+		sway \
+		xwayland \
+		xdg-dbus-proxy \
+		pipewire \
+		fuse3 \
+		fsmark && \
+	apt-get clean && rm -rf /var/lib/apt/lists/*
diff --git a/internal/workflows/build.sh b/internal/workflows/build.sh
new file mode 100755
index 00000000..f7b266a0
--- /dev/null
+++ b/internal/workflows/build.sh
@@ -0,0 +1,5 @@
+#!/bin/sh -e
+
+TAG="git.gensokyo.uk/rosa/runner:latest"
+podman build -t "$TAG" --format docker .
+podman push "$TAG"
diff --git a/internal/workflows/doc.go b/internal/workflows/doc.go
index 2227e50f..123bf7c1 100644
--- a/internal/workflows/doc.go
+++ b/internal/workflows/doc.go
@@ -53,7 +53,6 @@ The container can be specified via docker-compose:
 	    environment:
 	      CONFIG_FILE: /config.yaml
 	      GITEA_INSTANCE_URL: "https://git.gensokyo.uk"
-	      GITEA_RUNNER_LABELS: "rosa:docker://docker.gitea.com/runner-images:ubuntu-latest"
 
 	      GITEA_RUNNER_REGISTRATION_TOKEN: "${REGISTRATION_TOKEN}"
 	      GITEA_RUNNER_NAME: "${RUNNER_NAME}"
@@ -80,6 +79,10 @@ Before starting the container, configure act_runner via config.yaml:
 	  valid_volumes:
 	  - /var/lib/rosa
 
+	runner:
+	  labels:
+	    - 'rosa:docker://git.gensokyo.uk/rosa/runner:latest'
+
 where /var/lib/rosa is the absolute pathname of the cache directory in the init
 namespace. Setting MBF_POISON_OPEN enables cmd/mbf to run as root. It is also
 a good idea here to set runner.capacity to reflect the capacity of the guest, so
diff --git a/internal/workflows/release.go b/internal/workflows/release.go
index f220c0f7..a2f4c687 100644
--- a/internal/workflows/release.go
+++ b/internal/workflows/release.go
@@ -12,8 +12,6 @@ var _ = (&Workflow{
 			On:   "rosa",
 
 			Steps: []Step{
-				fixup,
-
 				{
 					Name: "Checkout",
 					Uses: "actions/checkout@v4",
diff --git a/internal/workflows/step.go b/internal/workflows/step.go
index d4e9c2d8..b53671b6 100644
--- a/internal/workflows/step.go
+++ b/internal/workflows/step.go
@@ -2,28 +2,9 @@
 
 package main
 
-import "strings"
-
-// fixup is a step to work around a Podman regression introduced by a bad
-// container escape mitigation.
-var fixup = Step{
-	Name: "Fix container filesystem",
-	Run:  "rm /var/run && ln -sf ../run /var",
-}
-
 // checkout is the standard actions/checkout step.
 var checkout = Step{Name: "Checkout", Uses: "actions/checkout@v4"}
 
-// toolchain is a step for setting up the Go toolchain.
-var toolchain = Step{
-	Name: "Set up Go toolchain",
-	Uses: "actions/setup-go@v6",
-
-	With: []KV[any]{
-		{"go-version-file", "go.mod"},
-	},
-}
-
 // newUploadArtifact returns an actions/upload-artifact step uploading
 // everything in the result directory as the specified name.
 func newUploadArtifact(display, name string) Step {
@@ -85,8 +66,7 @@ var install = Step{
 		"-xf /tmp/dist/hakurei-$HAKUREI_VERSION*-amd64.tar.gz && " +
 		"/tmp/dist/hakurei-$HAKUREI_VERSION*-amd64/install.sh && " +
 		"rm -rf /tmp/dist && " +
-		"sudo -u ubuntu hakurei version && " +
-		"mkdir /var/empty",
+		"sudo -u ubuntu hakurei version",
 }
 
 // newTestsuite returns a step for running an integration test suite.
@@ -97,21 +77,6 @@ func newTestsuite(name, prefix string) Step {
 	}
 }
 
-// newPackages returns a job for installing the specified packages with
-// best-effort caching. Package names must not contain spaces.
-func newPackages(rev int, repos []string, packages ...string) Step {
-	return Step{
-		Name: "Install packages",
-		Uses: "awalsh128/cache-apt-pkgs-action@v1",
-		With: []KV[any]{
-			{"add-repository", strings.Join(repos, " ")},
-			{"packages", strings.Join(packages, " ")},
-			{"version", rev},
-			{"execute_install_scripts", true},
-		},
-	}
-}
-
 // newNixOSTest returns a step for running the named NixOS test.
 func newNixOSTest(name string) Step {
 	return Step{
diff --git a/internal/workflows/test.go b/internal/workflows/test.go
index 80fb01e5..6cea7842 100644
--- a/internal/workflows/test.go
+++ b/internal/workflows/test.go
@@ -35,17 +35,7 @@ var _ = (&Workflow{
 
 			Needs: []string{"dist"},
 			Steps: []Step{
-				fixup,
 				checkout,
-				toolchain,
-				newPackages(0, []string{"ppa:savoury1/pipewire"},
-					"libmount-dev",
-					"sway",
-					"xwayland",
-					"xdg-dbus-proxy",
-					"pipewire",
-				),
-
 				download,
 				install,
 				newTestsuite("hakurei/testsuite/sandbox", "unshare -n "),
@@ -58,18 +48,7 @@ var _ = (&Workflow{
 
 			Needs: []string{"dist-race"},
 			Steps: []Step{
-				fixup,
 				checkout,
-				toolchain,
-
-				newPackages(0, []string{"ppa:savoury1/pipewire"},
-					"libmount-dev",
-					"sway",
-					"xwayland",
-					"xdg-dbus-proxy",
-					"pipewire",
-				),
-
 				_download,
 				install,
 				newTestsuite("hakurei/testsuite/sandbox", "unshare -n "),
@@ -82,11 +61,7 @@ var _ = (&Workflow{
 
 			Needs: []string{"dist"},
 			Steps: []Step{
-				fixup,
 				checkout,
-				toolchain,
-				newPackages(0, nil, "fuse3", "fsmark"),
-
 				download,
 				install,
 
@@ -118,7 +93,6 @@ var _ = (&Workflow{
 			},
 
 			Steps: []Step{
-				fixup,
 				checkout,
 				newCIRequest("distribution", "dist -o result", "dist"),
 				newUploadArtifact(
@@ -137,7 +111,6 @@ var _ = (&Workflow{
 			},
 
 			Steps: []Step{
-				fixup,
 				checkout,
 				newCIRequest("distribution", "race -o result", "dist"),
 				newUploadArtifact(