Container images for self-hosted GitHub Actions runners used by Government of Alberta ADSP projects. Each image is the redhat-actions runner base plus the system dependencies for a specific end-to-end test framework.
They exist because CI e2e jobs must run against network-private dev/test environment URLs that GitHub-hosted runners can't reach. Deployed as self-hosted runners in OpenShift, they run inside the network.
| Image | For |
|---|---|
ghcr.io/govalta/github-runner-playwright |
Playwright e2e (Chromium) — @abgov/nx-adsp-generated app pipelines |
ghcr.io/govalta/github-runner-cypress |
Cypress e2e — adsp-applications |
Node and the test framework/browser are installed per job (via
actions/setup-node + npm ci + npx playwright install /
cypress-io/github-action). These images therefore only carry the browser
system libraries — which Playwright's/Cypress's own dep-installers don't cover
on RHEL/UBI — and stay version-agnostic.
.github/workflows/publish.yml builds each variant and pushes to GHCR on:
- push to
maintouchingimages/**, - a weekly schedule (base-image / OS security patches),
- manual dispatch.
Packages are public: the images contain only public software and no credentials (runner registration is supplied at deploy time), and public means consumers need no pull secret. After the first publish, set each GHCR package's visibility to Public once in its package settings.
Run the image as a self-hosted runner Deployment, providing registration via env
(GITHUB_OWNER, GITHUB_REPOSITORY, GITHUB_PAT, RUNNER_LABELS, …). The
@abgov/nx-oc:pipeline generator emits this Deployment for generated repos.
Two guardrails:
- Mount the internal CA at runtime (
NODE_EXTRA_CA_CERTS→ a mounted ConfigMap/Secret). Do not bake internal certificates into these public images. - Never register these runners against a public repo that accepts untrusted fork PRs — a self-hosted runner executes PR code inside your cluster. Use private repos or gated workflows.
Add images/<variant>/Dockerfile (FROM quay.io/redhat-github-actions/runner +
that framework's browser deps) and add <variant> to the matrix in
publish.yml.
Apache-2.0 — see LICENSE.