nixos/github-runner: init at v2.277.1 (#116775)

* github-runner: init at 2.277.1

* nixos/github-runner: initial version

* nixos/github-runner: add warning if tokenFile in Nix store

* github-runner: don't accept unexpected attrs

* github-runner: formatting nits

* github-runner: add pre and post hooks to checkPhase

* nixos/github-runner: update ExecStartPre= comment

* nixos/github-runner: adapt tokenFile option description

Also note that not only a change to the option value will trigger a
reconfiguration but also modifications to the file's content.

* nixos/github-runner: remove mkDefault for DynamicUser=

* nixos/github-runner: create a parent for systemd dirs

Adds a parent directory "github-runner/" to all of the systemd lifecycle
directories StateDirectory=, RuntimeDirectory= and LogDirectory=.

Doing this has two motivations:

1. Something like this would required if we want to support multiple
   runners configurations. Please note that this is already possible
   using NixOS containers.
2. Having an additional parent directory makes it easier to remap
   any of the directories. Without a parent, systemd is going to
   complain if, for example, the given StateDirectory= is a symlink.

* nixos/github-runner: use specifier to get abs runtime path

* nixos/github-runner: use hostname as default for option `name`

Until now, the runner registration did not set the `--name` argument if
the configuration option was `null`, the default for the option.
According to GitHub's documentation, this instructs the registration
script to use the machine's hostname.

This commit causes the registration to always pass the `--name` argument
to the runner configuration script. The option now defaults to
`networking.hostName` which should be always set on NixOS.

This change becomes necessary as the systemd service name includes the
name of the runner since fcfa809 and, hence, expects it to be set. Thus,
an unset `name` option leads to an error.

* nixos/github-runner: use types.str for `name` option

Forcing a `name` option to comply with a pattern which could also be
used as a hostname is probably not required by GitHub.

* nixos/github-runner: pass dir paths explicitly for ExecStartPre=

* nixos/github-runner: update variable and script naming

* nixos/github-runner: let systemd choose the user/group

User and group naming restrictions are a complex topic [1] that I don't
even want to touch. Let systemd figure out the username and group and
reference it in our scripts through the USER environment variable.

[1] https://systemd.io/USER_NAMES/

* Revert "nixos/github-runner: use types.str for `name` option"

The escaping applied to the subdirectory paths given to StateDirectory=,
RuntimeDirectory= and LogsDirectory= apparently doesn't use the same
strategy that is used to escape unit names (cf. systemd-escape(1)). This
makes it unreasonably hard to construct reliable paths which work for
StateDirectory=/RuntimeDirectory=/LogsDirectory= and ExecStartPre=.

Against this background, I decided to (re-)apply restrictions to the
name a user might give for the GitHub runner. The pattern for
`networking.hostName` seems like a reasonable choice, also as its value
is the default if the `name` option isn't set.

This reverts commit 193ac67ba337990c22126da24a775c497dbc7e7d.

* nixos/github-runner: use types.path for `tokenFile` option

* nixos/github-runner: escape options used as shell arguments

* nixos/github-runner: wait for network-online.target

* github-runner: ignore additional online tests

nixos/modules/module-list.nix

@@ -288,6 +288,7 @@
   ./services/continuous-integration/hail.nix
   ./services/continuous-integration/hercules-ci-agent/default.nix
   ./services/continuous-integration/hydra/default.nix
+  ./services/continuous-integration/github-runner.nix
   ./services/continuous-integration/gitlab-runner.nix
   ./services/continuous-integration/gocd-agent/default.nix
   ./services/continuous-integration/gocd-server/default.nix

nixos/modules/services/continuous-integration/github-runner.nix

@@ -0,0 +1,299 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  cfg = config.services.github-runner;
+  svcName = "github-runner";
+  systemdDir = "${svcName}/${cfg.name}";
+  # %t: Runtime directory root (usually /run); see systemd.unit(5)
+  runtimeDir = "%t/${systemdDir}";
+  # %S: State directory root (usually /var/lib); see systemd.unit(5)
+  stateDir = "%S/${systemdDir}";
+  # %L: Log directory root (usually /var/log); see systemd.unit(5)
+  logsDir = "%L/${systemdDir}";
+in
+{
+  options.services.github-runner = {
+    enable = mkOption {
+      default = false;
+      example = true;
+      description = ''
+        Whether to enable GitHub Actions runner.
+
+        Note: GitHub recommends using self-hosted runners with private repositories only. Learn more here:
+        <link xlink:href="https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners"
+        >About self-hosted runners</link>.
+      '';
+      type = lib.types.bool;
+    };
+
+    url = mkOption {
+      type = types.str;
+      description = ''
+        Repository to add the runner to.
+
+        Changing this option triggers a new runner registration.
+      '';
+      example = "https://github.com/nixos/nixpkgs";
+    };
+
+    tokenFile = mkOption {
+      type = types.path;
+      description = ''
+        The full path to a file which contains the runner registration token.
+        The file should contain exactly one line with the token without any newline.
+        The token can be used to re-register a runner of the same name but is time-limited.
+
+        Changing this option or the file's content triggers a new runner registration.
+      '';
+      example = "/run/secrets/github-runner/nixos.token";
+    };
+
+    name = mkOption {
+      # Same pattern as for `networking.hostName`
+      type = types.strMatching "^$|^[[:alnum:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
+      description = ''
+        Name of the runner to configure. Defaults to the hostname.
+
+        Changing this option triggers a new runner registration.
+      '';
+      example = "nixos";
+      default = config.networking.hostName;
+    };
+
+    runnerGroup = mkOption {
+      type = types.nullOr types.str;
+      description = ''
+        Name of the runner group to add this runner to (defaults to the default runner group).
+
+        Changing this option triggers a new runner registration.
+      '';
+      default = null;
+    };
+
+    extraLabels = mkOption {
+      type = types.listOf types.str;
+      description = ''
+        Extra labels in addition to the default (<literal>["self-hosted", "Linux", "X64"]</literal>).
+
+        Changing this option triggers a new runner registration.
+      '';
+      example = literalExample ''[ "nixos" ]'';
+      default = [ ];
+    };
+
+    replace = mkOption {
+      type = types.bool;
+      description = ''
+        Replace any existing runner with the same name.
+
+        Without this flag, registering a new runner with the same name fails.
+      '';
+      default = false;
+    };
+
+    extraPackages = mkOption {
+      type = types.listOf types.package;
+      description = ''
+        Extra packages to add to <literal>PATH</literal> of the service to make them available to workflows.
+      '';
+      default = [ ];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    warnings = optionals (isStorePath cfg.tokenFile) [
+      ''
+        `services.github-runner.tokenFile` points to the Nix store and, therefore, is world-readable.
+        Consider using a path outside of the Nix store to keep the token private.
+      ''
+    ];
+
+    systemd.services.${svcName} = {
+      description = "GitHub Actions runner";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network.target" "network-online.target" ];
+
+      environment = {
+        HOME = runtimeDir;
+        RUNNER_ROOT = runtimeDir;
+      };
+
+      path = (with pkgs; [
+        bash
+        coreutils
+        git
+        gnutar
+        gzip
+      ]) ++ [
+        config.nix.package
+      ] ++ cfg.extraPackages;
+
+      serviceConfig = rec {
+        ExecStart = "${pkgs.github-runner}/bin/runsvc.sh";
+
+        # Does the following, sequentially:
+        # - Copy the current and the previous `tokenFile` to the $RUNTIME_DIRECTORY
+        #   and make it accessible to the service user to allow for a content
+        #   comparison.
+        # - If the module configuration or the token has changed, clear the state directory.
+        # - Configure the runner.
+        # - Copy the configured `tokenFile` to the $STATE_DIRECTORY and make it
+        #   inaccessible to the service user.
+        # - Set up the directory structure by creating the necessary symlinks.
+        ExecStartPre =
+          let
+            # Wrapper script which expects the full path of the state, runtime and logs
+            # directory as arguments. Overrides the respective systemd variables to provide
+            # unambiguous directory names. This becomes relevant, for example, if the
+            # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
+            # to contain more than one directory. This causes systemd to set the respective
+            # environment variables with the path of all of the given directories, separated
+            # by a colon.
+            writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" ''
+              set -euo pipefail
+
+              STATE_DIRECTORY="$1"
+              RUNTIME_DIRECTORY="$2"
+              LOGS_DIRECTORY="$3"
+
+              ${lines}
+            '';
+            currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
+            runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" ] cfg;
+            newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
+            currentConfigTokenFilename = ".current-token";
+            newConfigTokenFilename = ".new-token";
+            runnerCredFiles = [
+              ".credentials"
+              ".credentials_rsaparams"
+              ".runner"
+            ];
+            ownConfigTokens = writeScript "own-config-tokens" ''
+              # Copy current and new token file to runtime dir and make it accessible to the service user
+              cp ${escapeShellArg cfg.tokenFile} "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
+              chmod 600 "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
+              chown "$USER" "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
+
+              if [[ -e "$STATE_DIRECTORY/${currentConfigTokenFilename}" ]]; then
+                cp "$STATE_DIRECTORY/${currentConfigTokenFilename}" "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
+                chmod 600 "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
+                chown "$USER" "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
+              fi
+            '';
+            disownConfigTokens = writeScript "disown-config-tokens" ''
+              # Make the token inaccessible to the runner service user
+              chmod 600 "$STATE_DIRECTORY/${currentConfigTokenFilename}"
+              chown root:root "$STATE_DIRECTORY/${currentConfigTokenFilename}"
+            '';
+            unconfigureRunner = writeScript "unconfigure" ''
+              differs=
+              # Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
+              ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
+              # Also trigger a registration if the token content changed
+              ${pkgs.diffutils}/bin/diff -q \
+                "$RUNTIME_DIRECTORY"/{${currentConfigTokenFilename},${newConfigTokenFilename}} \
+                >/dev/null 2>&1 || differs=1
+
+              if [[ -n "$differs" ]]; then
+                echo "Config has changed, removing old runner state."
+                echo "The old runner will still appear in the GitHub Actions UI." \
+                  "You have to remove it manually."
+                find "$STATE_DIRECTORY/" -mindepth 1 -delete
+              fi
+            '';
+            configureRunner = writeScript "configure" ''
+              empty=$(ls -A "$STATE_DIRECTORY")
+              if [[ -z "$empty" ]]; then
+                echo "Configuring GitHub Actions Runner"
+                token=$(< "$RUNTIME_DIRECTORY"/${newConfigTokenFilename})
+                RUNNER_ROOT="$STATE_DIRECTORY" ${pkgs.github-runner}/bin/config.sh \
+                  --unattended \
+                  --work "$RUNTIME_DIRECTORY" \
+                  --url ${escapeShellArg cfg.url} \
+                  --token "$token" \
+                  --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} \
+                  --name ${escapeShellArg cfg.name} \
+                  ${optionalString cfg.replace "--replace"} \
+                  ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
+
+                # Move the automatically created _diag dir to the logs dir
+                mkdir -p  "$STATE_DIRECTORY/_diag"
+                cp    -r  "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
+                rm    -rf "$STATE_DIRECTORY/_diag/"
+
+                # Cleanup token from config
+                rm -f "$RUNTIME_DIRECTORY"/${currentConfigTokenFilename}
+                mv    "$RUNTIME_DIRECTORY"/${newConfigTokenFilename} "$STATE_DIRECTORY/${currentConfigTokenFilename}"
+
+                # Symlink to new config
+                ln -s '${newConfigPath}' "${currentConfigPath}"
+              fi
+            '';
+            setupRuntimeDir = writeScript "setup-runtime-dirs" ''
+              # Link _diag dir
+              ln -s "$LOGS_DIRECTORY" "$RUNTIME_DIRECTORY/_diag"
+
+              # Link the runner credentials to the runtime dir
+              ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$RUNTIME_DIRECTORY/"
+            '';
+          in
+          map (x: "${x} ${escapeShellArgs [ stateDir runtimeDir logsDir ]}") [
+            "+${ownConfigTokens}" # runs as root
+            unconfigureRunner
+            configureRunner
+            "+${disownConfigTokens}" # runs as root
+            setupRuntimeDir
+          ];
+
+        # Contains _diag
+        LogsDirectory = [ systemdDir ];
+        # Default RUNNER_ROOT which contains ephemeral Runner data
+        RuntimeDirectory = [ systemdDir ];
+        # Home of persistent runner data, e.g., credentials
+        StateDirectory = [ systemdDir ];
+        StateDirectoryMode = "0700";
+        WorkingDirectory = runtimeDir;
+
+        # By default, use a dynamically allocated user
+        DynamicUser = true;
+
+        KillMode = "process";
+        KillSignal = "SIGTERM";
+
+        # Hardening (may overlap with DynamicUser=)
+        # The following options are only for optimizing:
+        # systemd-analyze security github-runner
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0066";
+
+        # Needs network access
+        PrivateNetwork = false;
+        # Cannot be true due to Node
+        MemoryDenyWriteExecute = false;
+      };
+    };
+  };
+}

pkgs/development/tools/continuous-integration/github-runner/default.nix

@@ -0,0 +1,265 @@
+{ autoPatchelfHook
+, coreutils
+, curl
+, dotnetCorePackages
+, dotnetPackages
+, fetchFromGitHub
+, fetchurl
+, git
+, glibc
+, icu
+, kerberos
+, lib
+, linkFarm
+, lttng-ust
+, makeWrapper
+, nodejs-12_x
+, openssl
+, stdenv
+, zlib
+}:
+let
+  pname = "github-actions-runner";
+  version = "2.277.1";
+
+  deps = (import ./deps.nix { inherit fetchurl; });
+  nugetPackages = map
+    (x: {
+      name = "${x.name}.nupkg";
+      path = "${x}";
+    })
+    deps;
+  nugetSource = linkFarm "${pname}-${version}-packages" nugetPackages;
+
+  dotnetSdk = dotnetCorePackages.sdk_3_1;
+  runtimeId = "linux-x64";
+
+  disabledTest = [
+    # Self-updating is patched out, hence this test will fail
+    "FullyQualifiedName!=GitHub.Runner.Common.Tests.Listener.RunnerL0.TestRunOnceHandleUpdateMessage"
+  ] ++ map
+    # Online tests
+    (x: "FullyQualifiedName!=GitHub.Runner.Common.Tests.Worker.ActionManagerL0.PrepareActions_${x}")
+    [
+      "DownloadActionFromGraph"
+      "DownloadActionFromGraph_Legacy"
+      "NotPullOrBuildImagesMultipleTimes"
+      "NotPullOrBuildImagesMultipleTimes_Legacy"
+      "RepositoryActionWithActionYamlFile_DockerHubImage"
+      "RepositoryActionWithActionYamlFile_DockerHubImage_Legacy"
+      "RepositoryActionWithActionfileAndDockerfile"
+      "RepositoryActionWithActionfileAndDockerfile_Legacy"
+      "RepositoryActionWithActionfile_DockerHubImage"
+      "RepositoryActionWithActionfile_DockerHubImage_Legacy"
+      "RepositoryActionWithActionfile_Dockerfile"
+      "RepositoryActionWithActionfile_Dockerfile_Legacy"
+      "RepositoryActionWithActionfile_DockerfileRelativePath"
+      "RepositoryActionWithActionfile_DockerfileRelativePath_Legacy"
+      "RepositoryActionWithActionfile_Node"
+      "RepositoryActionWithActionfile_Node_Legacy"
+      "RepositoryActionWithDockerfile"
+      "RepositoryActionWithDockerfile_Legacy"
+      "RepositoryActionWithDockerfileInRelativePath"
+      "RepositoryActionWithDockerfileInRelativePath_Legacy"
+      "RepositoryActionWithDockerfilePrepareActions_Repository"
+      "RepositoryActionWithInvalidWrapperActionfile_Node"
+      "RepositoryActionWithInvalidWrapperActionfile_Node_Legacy"
+      "RepositoryActionWithWrapperActionfile_PreSteps"
+      "RepositoryActionWithWrapperActionfile_PreSteps_Legacy"
+    ] ++ map
+    (x: "FullyQualifiedName!=GitHub.Runner.Common.Tests.DotnetsdkDownloadScriptL0.${x}")
+    [
+      "EnsureDotnetsdkBashDownloadScriptUpToDate"
+      "EnsureDotnetsdkPowershellDownloadScriptUpToDate"
+    ];
+  testFilterXml = lib.concatStringsSep "&" disabledTest;
+in
+stdenv.mkDerivation rec {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "actions";
+    repo = "runner";
+    rev = "183a3dd9a0d4d51feddc5fe9fa6c3b5f8b08343d"; # v${version}
+    sha256 = "sha256-fQH4QwdR8E76ckUjMCaKOsDjNoVBIWAw2YcFRrVucX8=";
+  };
+
+  nativeBuildInputs = [
+    dotnetSdk
+    dotnetPackages.Nuget
+    makeWrapper
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    curl # libcurl.so.4
+    kerberos # libgssapi_krb5.so.2
+    lttng-ust # liblttng-ust.so.0
+    stdenv.cc.cc.lib # libstdc++.so.6
+    zlib # libz.so.1
+    icu
+  ];
+
+  patches = [
+    # Don't run Git, no restore on build/test
+    ./patches/dir-proj.patch
+    # Replace some paths that originally point to Nix's read-only store
+    ./patches/host-context-dirs.patch
+    # Use GetDirectory() to obtain "diag" dir
+    ./patches/use-get-directory-for-diag.patch
+    # Don't try to install systemd service
+    ./patches/dont-install-systemd-service.patch
+    # Don't try to self-update runner (cannot be disabled, see https://github.com/actions/runner/issues/485)
+    ./patches/ignore-self-update.patch
+  ];
+
+  postPatch = ''
+    # Relax the version requirement
+    substituteInPlace src/global.json \
+      --replace '3.1.302' '${dotnetSdk.version}'
+
+    # Disable specific tests
+    substituteInPlace src/dir.proj \
+      --replace 'dotnet test Test/Test.csproj' \
+                "dotnet test Test/Test.csproj --filter '${testFilterXml}'"
+
+    # Fix FHS path
+    substituteInPlace src/Test/L0/Util/IOUtilL0.cs \
+      --replace '/bin/ln' '${coreutils}/bin/ln'
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+
+    # Set up Nuget dependencies
+    export HOME=$(mktemp -d)
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    export DOTNET_NOLOGO=1
+
+    # Never use nuget.org
+    nuget sources Disable -Name "nuget.org"
+
+    # Restore the dependencies
+    dotnet restore src/ActionsRunner.sln \
+      --runtime "${runtimeId}" \
+      --source "${nugetSource}"
+
+    runHook postConfigure
+  '';
+
+  postConfigure = ''
+    # `crossgen` dependency is called during build
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}" \
+      $HOME/.nuget/packages/microsoft.netcore.app.runtime.${runtimeId}/*/tools/crossgen
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    dotnet msbuild \
+      -t:Build \
+      -p:PackageRuntime="${runtimeId}" \
+      -p:BUILDCONFIG="Release" \
+      -p:RunnerVersion="${version}" \
+      -p:GitInfoCommitHash="${src.rev}" \
+      src/dir.proj
+
+    runHook postBuild
+  '';
+
+  doCheck = true;
+
+  checkInputs = [ git ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    mkdir -p _layout/externals
+    ln -s ${nodejs-12_x} _layout/externals/node12
+
+    # BUILDCONFIG needs to be "Debug"
+    dotnet msbuild \
+      -t:test \
+      -p:PackageRuntime="${runtimeId}" \
+      -p:BUILDCONFIG="Debug" \
+      -p:RunnerVersion="${version}" \
+      -p:GitInfoCommitHash="${src.rev}" \
+      src/dir.proj
+
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Copy the built binaries to lib/ instead of bin/ as they
+    # have to be wrapped in the fixup phase to work
+    mkdir -p $out/lib
+    cp -r _layout/bin/. $out/lib/
+
+    # Delete debugging files
+    find "$out/lib" -type f -name '*.pdb' -delete
+
+    # Install the helper scripts to bin/ to resemble the upstream package
+    mkdir -p $out/bin
+    install -m755 src/Misc/layoutbin/runsvc.sh        $out/bin/
+    install -m755 src/Misc/layoutbin/RunnerService.js $out/lib/
+    install -m755 src/Misc/layoutroot/run.sh          $out/lib/
+    install -m755 src/Misc/layoutroot/config.sh       $out/lib/
+    install -m755 src/Misc/layoutroot/env.sh          $out/lib/
+
+    # Rewrite reference in helper scripts from bin/ to lib/
+    substituteInPlace $out/lib/run.sh    --replace '"$DIR"/bin' "$out/lib"
+    substituteInPlace $out/lib/config.sh --replace './bin' "$out/lib"
+
+    # Make paths absolute
+    substituteInPlace $out/bin/runsvc.sh \
+      --replace './externals' "$out/externals" \
+      --replace './bin' "$out/lib"
+
+    # The upstream package includes Node 12 and expects it at the path
+    # externals/node12. As opposed to the official releases, we don't
+    # link the Alpine Node flavor.
+    mkdir -p $out/externals
+    ln -s ${nodejs-12_x} $out/externals/node12
+
+    runHook postInstall
+  '';
+
+  # Stripping breaks the binaries
+  dontStrip = true;
+
+  postFixup = ''
+    fix_rpath() {
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/lib/$1
+    }
+
+    wrap() {
+      makeWrapper $out/lib/$1 $out/bin/$1 \
+        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath (buildInputs ++ [ openssl ])} \
+        ''${@:2}
+    }
+
+    fix_rpath Runner.Listener
+    fix_rpath Runner.PluginHost
+    fix_rpath Runner.Worker
+
+    wrap Runner.Listener
+    wrap Runner.PluginHost
+    wrap Runner.Worker
+    wrap run.sh
+    wrap env.sh
+
+    wrap config.sh --prefix PATH : ${lib.makeBinPath [ glibc.bin ]}
+  '';
+
+  meta = with lib; {
+    description = "Self-hosted runner for GitHub Actions";
+    homepage = "https://github.com/actions/runner";
+    license = licenses.mit;
+    maintainers = with maintainers; [ veehaitch ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/development/tools/continuous-integration/github-runner/patches/dir-proj.patch

@@ -0,0 +1,53 @@
+From 4267ee7fa5169b4fd5ce732118769e559806a390 Mon Sep 17 00:00:00 2001
+From: Vincent Haupert <mail@vincent-haupert.de>
+Date: Sat, 13 Mar 2021 21:52:03 +0100
+Subject: [PATCH] Patch dir.proj
+
+Don't execute Git for GitInfoCommitHash property
+Don't restore for build target
+Don't restore for test target
+---
+ src/dir.proj | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/src/dir.proj b/src/dir.proj
+index 1c91e0c..8b27d3f 100644
+--- a/src/dir.proj
++++ b/src/dir.proj
+@@ -2,9 +2,6 @@
+ <Project ToolsVersion="14.0" DefaultTargets="Build" 
+     xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+     <Target Name="GenerateConstant">
+-        <Exec Command="git rev-parse HEAD" ConsoleToMSBuild="true">
+-            <Output TaskParameter="ConsoleOutput" PropertyName="GitInfoCommitHash" />
+-        </Exec>
+         <Message Text="Building $(Product): $(GitInfoCommitHash) --- $(PackageRuntime)" Importance="high"/>
+ 
+         <ItemGroup>
+@@ -39,14 +36,13 @@
+     </ItemGroup>
+ 
+     <Target Name="Build" DependsOnTargets="GenerateConstant">
+-        <MSBuild Targets="Restore" Projects="@(ProjectFiles)" StopOnFirstFailure="true" />
+         <MSBuild Targets="Publish" Projects="@(ProjectFiles)" BuildInParallel="false" StopOnFirstFailure="true" Properties="Configuration=$(BUILDCONFIG);PackageRuntime=$(PackageRuntime);Version=$(RunnerVersion);RuntimeIdentifier=$(PackageRuntime);PublishDir=$(MSBuildProjectDirectory)/../_layout/bin" />
+         <Exec Command="%22$(DesktopMSBuild)%22 Runner.Service/Windows/RunnerService.csproj /p:Configuration=$(BUILDCONFIG) /p:OutputPath=%22$(MSBuildProjectDirectory)/../_layout/bin%22" ConsoleToMSBuild="true" Condition="'$(PackageRuntime)' == 'win-x64' Or '$(PackageRuntime)' == 'win-x86'" />
+     </Target>
+ 
+     <Target Name="Test" DependsOnTargets="GenerateConstant">
+-        <Exec Command="dotnet build Test/Test.csproj -c $(BUILDCONFIG) /p:PackageRuntime=$(PackageRuntime)" ConsoleToMSBuild="true" />
+-        <Exec Command="dotnet test Test/Test.csproj --no-build --logger:trx" ConsoleToMSBuild="true" />
++        <Exec Command="dotnet build Test/Test.csproj --no-restore -c $(BUILDCONFIG) /p:PackageRuntime=$(PackageRuntime)" ConsoleToMSBuild="true" />
++        <Exec Command="dotnet test Test/Test.csproj --no-restore --no-build --logger:trx" ConsoleToMSBuild="true" />
+     </Target>
+ 
+     <Target Name="Layout" DependsOnTargets="Clean;Build">
+@@ -84,4 +80,4 @@
+         <RemoveDir Directories="Test/bin" />
+         <RemoveDir Directories="Test/obj" />
+     </Target>
+-</Project>
+\ No newline at end of file
++</Project>
+-- 
+2.30.1
+

pkgs/development/tools/continuous-integration/github-runner/patches/dont-install-systemd-service.patch

@@ -0,0 +1,15 @@
+diff --git a/src/Runner.Listener/Configuration/ConfigurationManager.cs b/src/Runner.Listener/Configuration/ConfigurationManager.cs
+index 8d08b06..bdfa3a2 100644
+--- a/src/Runner.Listener/Configuration/ConfigurationManager.cs
++++ b/src/Runner.Listener/Configuration/ConfigurationManager.cs
+@@ -320,10 +320,6 @@ namespace GitHub.Runner.Listener.Configuration
+                 serviceControlManager.ConfigureService(runnerSettings, command);
+             }
+ 
+-#elif OS_LINUX || OS_OSX
+-            // generate service config script for OSX and Linux, GenerateScripts() will no-opt on windows.
+-            var serviceControlManager = HostContext.GetService<ILinuxServiceControlManager>();
+-            serviceControlManager.GenerateScripts(runnerSettings);
+ #endif
+         }
+ 

pkgs/development/tools/continuous-integration/github-runner/patches/host-context-dirs.patch

@@ -0,0 +1,20 @@
+diff --git a/src/Runner.Common/HostContext.cs b/src/Runner.Common/HostContext.cs
+index d4ea48c..2ec8455 100644
+--- a/src/Runner.Common/HostContext.cs
++++ b/src/Runner.Common/HostContext.cs
+@@ -220,12 +220,13 @@ namespace GitHub.Runner.Common
+ 
+                 case WellKnownDirectory.Externals:
+                     path = Path.Combine(
+-                        GetDirectory(WellKnownDirectory.Root),
++                        new DirectoryInfo(GetDirectory(WellKnownDirectory.Bin)).Parent.FullName,
+                         Constants.Path.ExternalsDirectory);
+                     break;
+ 
+                 case WellKnownDirectory.Root:
+-                    path = new DirectoryInfo(GetDirectory(WellKnownDirectory.Bin)).Parent.FullName;
++                    path = Environment.GetEnvironmentVariable("RUNNER_ROOT")
++                                ?? new DirectoryInfo(GetDirectory(WellKnownDirectory.Bin)).Parent.FullName;
+                     break;
+ 
+                 case WellKnownDirectory.Temp:

pkgs/development/tools/continuous-integration/github-runner/patches/ignore-self-update.patch

@@ -0,0 +1,24 @@
+diff --git a/src/Runner.Listener/Runner.cs b/src/Runner.Listener/Runner.cs
+index 68b0b4e..5da21fe 100644
+--- a/src/Runner.Listener/Runner.cs
++++ b/src/Runner.Listener/Runner.cs
+@@ -391,18 +391,7 @@ namespace GitHub.Runner.Listener
+                             HostContext.WritePerfCounter($"MessageReceived_{message.MessageType}");
+                             if (string.Equals(message.MessageType, AgentRefreshMessage.MessageType, StringComparison.OrdinalIgnoreCase))
+                             {
+-                                if (autoUpdateInProgress == false)
+-                                {
+-                                    autoUpdateInProgress = true;
+-                                    var runnerUpdateMessage = JsonUtility.FromString<AgentRefreshMessage>(message.Body);
+-                                    var selfUpdater = HostContext.GetService<ISelfUpdater>();
+-                                    selfUpdateTask = selfUpdater.SelfUpdate(runnerUpdateMessage, jobDispatcher, !runOnce && HostContext.StartupType != StartupType.Service, HostContext.RunnerShutdownToken);
+-                                    Trace.Info("Refresh message received, kick-off selfupdate background process.");
+-                                }
+-                                else
+-                                {
+-                                    Trace.Info("Refresh message received, skip autoupdate since a previous autoupdate is already running.");
+-                                }
++                                Trace.Info("Ignoring received refresh message (would trigger self-update).");
+                             }
+                             else if (string.Equals(message.MessageType, JobRequestMessageTypes.PipelineAgentJobRequest, StringComparison.OrdinalIgnoreCase))
+                             {

pkgs/development/tools/continuous-integration/github-runner/patches/use-get-directory-for-diag.patch

@@ -0,0 +1,25 @@
+diff --git a/src/Runner.Common/HostContext.cs b/src/Runner.Common/HostContext.cs
+index d4ea48c..15c1800 100644
+--- a/src/Runner.Common/HostContext.cs
++++ b/src/Runner.Common/HostContext.cs
+@@ -109,7 +109,7 @@ namespace GitHub.Runner.Common
+                 }
+ 
+                 // this should give us _diag folder under runner root directory
+-                string diagLogDirectory = Path.Combine(new DirectoryInfo(Path.GetDirectoryName(Assembly.GetEntryAssembly().Location)).Parent.FullName, Constants.Path.DiagDirectory);
++                string diagLogDirectory = GetDirectory(WellKnownDirectory.Diag);
+                 _traceManager = new TraceManager(new HostTraceListener(diagLogDirectory, hostType, logPageSize, logRetentionDays), this.SecretMasker);
+             }
+             else
+@@ -272,7 +272,10 @@ namespace GitHub.Runner.Common
+                     throw new NotSupportedException($"Unexpected well known directory: '{directory}'");
+             }
+ 
+-            _trace.Info($"Well known directory '{directory}': '{path}'");
++            if (_trace != null)
++            {
++                _trace.Info($"Well known directory '{directory}': '{path}'");
++            }
+             return path;
+         }
+ 

pkgs/top-level/all-packages.nix

@@ -4888,6 +4888,8 @@ in
 
   github-backup = callPackage ../tools/misc/github-backup { };
 
+  github-runner = callPackage ../development/tools/continuous-integration/github-runner { };
+
   gitin = callPackage ../applications/version-management/git-and-tools/gitin { };
 
   gitinspector = callPackage ../applications/version-management/gitinspector { };