.github/packer/scripts/github-runner.sh - main - githubmirror/nbs

.github/packer/scripts/github-runner.sh
239 строк9 KB
Nikita Menkovich
feat: replace shell key fetching with python script in packer build, add retries to key fetching (#6355)
01 июл 2026, 17:59
01 июл 2026, 17:592a10cd6
#!/usr/bin/env bash
set -x
set -e
set -o pipefail

# shellcheck disable=SC2317,SC2329
function on_exit() {
    local exit_code=$?
    echo "Caught signal $exit_code, exiting..."
    df -h || true
    mount || true
    # TODO: sleep for more if it will be build like in ycloud
    [ "$exit_code" -eq 1 ] && sleep 1
    # shellcheck disable=SC2009
    ps auxf | grep -vE "]$" || true
    ls -lsha "/home/${USER_TO_CREATE}/" || true
    ls -lsha "/home/${USER_TO_CREATE}/.ssh/" || true
    if ls -lsha "/home/${USER_TO_CREATE}/.ya"; then
        du -h -d 1 "/home/${USER_TO_CREATE}/.ya"
    fi
    rm -f "/home/${USER_TO_CREATE}/${FILENAME}" || true
    rm -rf "/home/${USER_TO_CREATE}/.aws" /root/.aws/ || true
    rm -rf /var/lib/apt/lists/* || true
    cloud-init clean --logs || true
    sync
    exit "$exit_code"
}
trap on_exit EXIT

DEBUG_USER=${DEBUG_USER:-debug}

function create_password_user() {
    local user_name=$1

    adduser --gecos "" --disabled-password --shell /bin/bash "$user_name"
    set +x
    usermod --password "${PASSWORD_HASH//$/\\$}" "$user_name"
    set -x
}

function install_authorized_keys() {
    local user_name=$1
    local user_home
    user_home=$(getent passwd "$user_name" | cut -d: -f6)

    mkdir -p "${user_home}/.ssh"
    chown -R "${user_name}:${user_name}" "${user_home}/.ssh"
    chmod 0700 "${user_home}/.ssh"
    cp "${KEYS_FILE}" "${user_home}/.ssh/authorized_keys"
    chown "${user_name}:${user_name}" "${user_home}/.ssh/authorized_keys"
    chmod 0600 "${user_home}/.ssh/authorized_keys"
}

# Download github runner
mkdir -p /actions-runner && cd /actions-runner || exit
curl -fsSL -o runner.tar.gz -L "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz"
if [ -n "${RUNNER_SHA256_X64:-}" ]; then
    echo "${RUNNER_SHA256_X64}  runner.tar.gz" | sha256sum -c -
else
    echo "RUNNER_SHA256_X64 is empty, skipping runner checksum verification"
fi
tar xzf ./runner.tar.gz
install -m 0755 /tmp/packer/actions-runner-job-completed-cleanup.sh /usr/local/bin/actions-runner-job-completed-cleanup.sh
install -m 0755 /tmp/packer/actions-runner-collect-system-logs.sh /usr/local/bin/actions-runner-collect-system-logs.sh
touch /actions-runner/.env
grep -q '^ACTIONS_RUNNER_HOOK_JOB_COMPLETED=' /actions-runner/.env || {
    echo "ACTIONS_RUNNER_HOOK_JOB_COMPLETED=/usr/local/bin/actions-runner-job-completed-cleanup.sh" >> /actions-runner/.env
}

install -m 0755 -d /etc/apt/keyrings
# we do not have v6 connectivity on vms
echo 'Acquire::ForceIPv4 "true";' | tee /etc/apt/apt.conf.d/99force-ipv4
# set the default timeout to 10 minutes
echo "Dpkg::Lock::Timeout=600;" | tee /etc/apt/apt.conf.d/99dpkg-lock-timeout
# noninteractive mode
# we need to retry it because sometimes apt-get can be locked by cloud-init or unattended-upgrades, and we want to avoid race conditions in that case
for i in {1..6}; do
    if echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections; then
        break
    else
        echo "Failed to set debconf frontend, retrying... ($i/6)"
        sleep 10
    fi
done

# docker
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc
echo 'deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu jammy stable' | tee /etc/apt/sources.list.d/docker.list > /dev/null

# github cli
wget -nv -O/etc/apt/keyrings/githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg
chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null

# nebius cli
# nosemgrep: bash.curl.security.curl-pipe-bash.curl-pipe-bash
curl -sSL https://storage.eu-north1.nebius.cloud/cli/install.sh | NEBIUS_INSTALL_FOLDER=/usr/local/bin bash
nebius version || nebius --version

apt-get update
apt-get -y upgrade

# linux-image-6.2.0-39-generic is important because default kernel doesn't allow
# `nvme --id-ctrl` without CAP_SYS_ADMIN or root privilege
LINUX_VER=6.2.0-39-generic

LINUX_PKGS="linux-image-${LINUX_VER} \
    linux-modules-${LINUX_VER} \
    linux-modules-extra-${LINUX_VER} \
    linux-tools-${LINUX_VER} \
    linux-tools-common"

apt-get install -y --no-install-recommends \
    ${LINUX_PKGS} \
    git wget gnupg lsb-release curl tzdata \
    libidn11-dev libaio1 libaio-dev \
    file qemu-kvm qemu-utils \
    python3-dev python3-pip \
    dpkg-dev docker-ce docker-ce-cli containerd.io \
    docker-buildx-plugin docker-compose-plugin \
    jq tree tmux atop iftop htop unzip \
    pixz pigz pbzip2 xz-utils gdb zram-tools \
    nvme-cli gh

# remove it for now, after migration we will return it back
#apt-get remove -y unattended-upgrades
#apt-get purge -y unattended-upgrades

# CVE-2026-31431
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
# CVE-2026-43284
echo "install esp4 /bin/false" > /etc/modprobe.d/disable-esp4.conf
echo "install esp6 /bin/false" > /etc/modprobe.d/disable-esp6.conf
# CVE-2026-43500
echo "install rxrpc /bin/false" > /etc/modprobe.d/disable-rxrpc.conf

pip3 install -r /tmp/packer/requirements.txt
pip3 install -r /tmp/packer/requirements_dev.txt

INSTALL_DIR=/usr/local/bin bash /tmp/packer/install-github-release-tools.sh action-validator shellcheck shfmt yq

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
./aws/install
rm -rf awscliv2.zip

# mime types for ya make logs and other outputs
MIME_TYPES_PLAINTEXT_LINE="text/plain out err log stderr stdout trace jsonl backtrace args"
MIME_TYPES_FILE='/etc/mime.types'
grep -qF -- "$MIME_TYPES_PLAINTEXT_LINE" "$MIME_TYPES_FILE" || echo "$MIME_TYPES_PLAINTEXT_LINE" | tee -a "$MIME_TYPES_FILE" || true

create_password_user "${USER_TO_CREATE}"
create_password_user "${DEBUG_USER}"
sed -i -e 's/\\\$/$/g' /etc/shadow
usermod -a -G kvm "${USER_TO_CREATE}"
usermod -a -G docker "${USER_TO_CREATE}"
usermod -a -G kvm "${DEBUG_USER}"
usermod -a -G docker "${DEBUG_USER}"
cat > "/etc/sudoers.d/99-${USER_TO_CREATE}" << EOF
Cmnd_Alias GITHUB_RUNNER_LOGS = /usr/local/bin/actions-runner-collect-system-logs.sh
${USER_TO_CREATE} ALL=(root) NOPASSWD: GITHUB_RUNNER_LOGS
EOF
chmod 0440 "/etc/sudoers.d/99-${USER_TO_CREATE}"
echo "${DEBUG_USER} ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/99-${DEBUG_USER}"
chmod 0440 "/etc/sudoers.d/99-${DEBUG_USER}"
chown -R "${USER_TO_CREATE}:${USER_TO_CREATE}" /actions-runner

# allow coredumps
tee -a /etc/security/limits.conf << EOF
* soft core unlimited
* hard core unlimited
* soft memlock unlimited
* hard memlock unlimited
EOF

echo "Defaults rlimit_core=default" | tee /etc/sudoers.d/98-rlimit
chmod 0440 /etc/sudoers.d/98-rlimit
mkdir -p /coredumps
chmod 1777 /coredumps

# increase the total number of aio requests to run more tests in parallel, default is 65536
{
    echo "fs.aio-max-nr=1048576"
    echo "vm.swappiness=1"
    echo "kernel.core_pattern=/coredumps/%e.%p.%s"
    echo "kernel.core_uses_pid=1"
    echo "fs.suid_dumpable=0"
} >> /etc/sysctl.conf
echo "SIZE=102400" | tee -a /etc/default/zramswap
echo "PRIORITY=2" | tee -a /etc/default/zramswap
echo "ALGO=lz4" | tee -a /etc/default/zramswap

# Set atop logging interval to 30 seconds
if grep -q '^LOGINTERVAL=' /etc/default/atop; then
    # Update existing LOGINTERVAL line
    sed -i 's/^LOGINTERVAL=.*/LOGINTERVAL=30/' /etc/default/atop
else
    # Add LOGINTERVAL line if not present
    echo "LOGINTERVAL=30" >> /etc/default/atop
fi

# remove auto-logout timeout
[ -f /etc/profile.d/tmout.sh ] && rm /etc/profile.d/tmout.sh

if [ -n "$GITHUB_TOKEN" ] && [ -n "$ORG" ] && [ -n "$TEAM" ]; then
    export KEYS_FILE
    KEYS_FILE=$(mktemp)

    python3 /tmp/packer/github_team_public_keys.py \
        --github-token "$GITHUB_TOKEN" \
        --github-org "$ORG" \
        --github-team-slug "$TEAM" | tee -a "$KEYS_FILE"
fi

if [ -f "$KEYS_FILE" ]; then
    install_authorized_keys "${USER_TO_CREATE}"
    install_authorized_keys "${DEBUG_USER}"
    cat "/home/${USER_TO_CREATE}/.ssh/authorized_keys"
fi

sync

# some healthchecks
healthchecks_exit_code=0
test -s "/home/${USER_TO_CREATE}/.ssh/authorized_keys" || {
    echo "Authorized keys is empty"
    ls -lsha "/home/${USER_TO_CREATE}/.ssh/authorized_keys"
    healthchecks_exit_code=1
}
grep "${USER_TO_CREATE}:\\$" /etc/shadow > /dev/null 2> /dev/null || {
    echo "User ${USER_TO_CREATE} either does not exist or has wrong hash"
    healthchecks_exit_code=1
}
grep "${DEBUG_USER}:" /etc/shadow > /dev/null 2> /dev/null || {
    echo "User ${DEBUG_USER} does not exist"
    healthchecks_exit_code=1
}
exit $healthchecks_exit_code