mirror of https://github.com/magnus919/agent-skills.git synced 2026-09-14 21:16:36 +03:00

Files

T

Magnus Hedemark e151580319 Add github-runner skill: deploy, manage, and troubleshoot self-hosted GitHub Actions runners

- SKILL.md with trigger table, quick reference, deployment spectrum, and pitfalls
- references/ for architecture, deployment (systemd/Docker/ARC/Scale Set Client),
  security, autoscaling, management, custom images, and network
- templates/ for docker-compose.yml and custom-runner.Dockerfile
- AGENTS.md updated with trigger row in alphabetical order

2026-06-23 00:13:55 -04:00

3.3 KiB

Raw Blame History

Network & Connectivity

Communication Model

Self-hosted runners connect to GitHub via outbound HTTPS (port 443) only — no inbound ports needed.

They poll for jobs via HTTPS long-poll connections to *.actions.githubusercontent.com.

Minimum bandwidth: 70 kbps upload and download.

Required Domains

Essential Operations

github.com
api.github.com
*.actions.githubusercontent.com

Downloading Actions

codeload.github.com

Uploading/Downloading Artifacts, Logs, Caches, Summaries

results-receiver.actions.githubusercontent.com
*.blob.core.windows.net

Runner Version Updates

objects.githubusercontent.com
objects-origin.githubusercontent.com
github-releases.githubusercontent.com
github-registry-files.githubusercontent.com

OIDC Token Retrieval

*.actions.githubusercontent.com

GitHub Packages (Container Registry, etc.)

*.pkg.github.com
pkg-containers.githubusercontent.com
ghcr.io

Git LFS

github-cloud.githubusercontent.com
github-cloud.s3.amazonaws.com

Dependabot Update Jobs

dependabot-actions.githubapp.com

Release Assets

release-assets.githubusercontent.com

TLS Verification

Enabled by default — the runner verifies GitHub's TLS certificate
Disable for testing only: Set GITHUB_ACTIONS_RUNNER_TLS_NO_VERIFY=1
Better approach: Install GitHub's certificate in the OS trust store

Firewall Configuration

For strict egress rules:

Allow outbound HTTPS (443) to all domains listed above
Some domains use CNAME records — firewalls may need recursive CNAME resolution
Note: CNAME records may change; the listed domains are stable

IP Allow Lists

If your GitHub organization or enterprise uses IP allow lists, you must add your self-hosted runner's IP address to the allow list. Without this, the runner cannot communicate with GitHub APIs.

Proxy Configuration

Self-hosted runners support standard HTTP proxy environment variables:

HTTP_PROXY
HTTPS_PROXY
NO_PROXY

Set these in the service environment or Docker container environment.

Connectivity Diagram

┌──────────────────┐     Outbound HTTPS (443)     ┌──────────────────────┐
│  Self-Hosted     │ ────────────────────────────> │  GitHub Actions      │
│  Runner          │ <──────────────────────────── │  Service             │
│  (Docker/VM)     │   Long-poll for jobs          │  *.actions.github.   │
│                  │   Upload logs & artifacts     │  com / api.github.   │
│                  │   Download action code         │  com / blob.core.    │
└──────────────────┘                               │  windows.net / CDN   │
        │                                          └──────────────────────┘
        │ Mounted Docker socket (if using DinD)
        ▼
┌──────────────────┐
│  Host Docker      │
│  Daemon           │
│  (builds, runs)   │
└──────────────────┘

3.3 KiB Raw Blame History