Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions .markdown-link-check.json
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,16 @@
"pattern": "^https://github\\.com/.*/wiki/"
},
{
"pattern": "^https://github\\.com/users/.*/projects/"
"pattern": "^https://github\\.com/users/"
},
{
"pattern": "^https?://localhost[:/]"
"pattern": "^https?://localhost"
},
{
"pattern": "^mailto:"
},
{
"pattern": "^https?://www\\.computerhope\\.com"
},
{
"pattern": "^#"
Expand Down
12 changes: 11 additions & 1 deletion .markdownlint-cli2.jsonc
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,24 @@
"MD013": false,
// Allow duplicate headings in sibling sections (e.g. multiple "Usage" under different parents)
"MD024": { "siblings_only": true },
// Allow multiple top-level headings — some docs combine related guides
"MD025": false,
// Allow ordered lists with non-sequential prefixes (continuation numbering)
"MD029": false,
// Allow inline HTML (badges, images, diagrams, details/summary blocks)
"MD033": false,
// Allow bare URLs — common in reference docs and config examples
"MD034": false,
// Allow emphasis used as visual separators (bold sub-headings in lists)
"MD036": false,
// Allow fenced code blocks without language (plain text output examples)
"MD040": false,
// Allow multiple blank lines (common after HTML blocks)
"MD012": false,
// Allow first line to be non-heading (frontmatter, comments, etc.)
"MD041": false
"MD041": false,
// Skip link-fragment validation — many anchors are generated or context-dependent
"MD060": false
},
"globs": [
"docs/**/*.md",
Expand Down
7 changes: 4 additions & 3 deletions docs/BRANCH_PROTECTION_GUIDE.md
Original file line number Diff line number Diff line change
Expand Up @@ -241,13 +241,14 @@ The monitoring workflow checks:
gh run view <run-id>
```

# Check your repository permissions
2. **Check Your Repository Permissions**

```bash
gh api repos/GrammaTonic/github-runner/collaborators/$USER/permission --jq .permission
```

```
3. **Branch Protection Conflicts**

2. **Branch Protection Conflicts**
```bash
# View current protection rules
gh api repos/GrammaTonic/github-runner/branches/main/protection
Expand Down
22 changes: 17 additions & 5 deletions docs/CHROME_RUNNER_X86_DEPLOYMENT.md
Original file line number Diff line number Diff line change
@@ -1,33 +1,37 @@
# Using Ubuntu Resolute for Chrome Runner
# Chrome Runner x86 Deployment Guide

## Ubuntu Resolute Base Image

The Chrome runner image is built on `ubuntu:resolute` to ensure compatibility with the latest browser and UI testing dependencies. This approach may result in more reported CVEs due to pre-release packages.

#### CVE Handling
## CVE Handling

- All app-level dependencies are patched using npm `overrides` and local installs.
- CVEs in npm's internal modules are documented and tracked; they do not impact runner security.
- Trivy scans are automated in all test scripts, and results are stored for compliance and audit.

#### Example Trivy Scan Command
### Example Trivy Scan Command

```bash
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
aquasec/trivy:latest image github-runner-chrome:test-local > test-results/docker/trivy_scan_<timestamp>.txt
```
# Chrome Runner x86 Deployment Guide

## Overview

This guide helps you deploy the GitHub Actions Chrome runner on x86_64 architecture to resolve ARM64 compatibility issues.

## Prerequisites

- **x86_64 system** (Linux/Windows with x86, AWS EC2, Google Cloud, etc.)
- **Docker** installed and running
- **GitHub Personal Access Token** with `repo` scope

## Quick Start

### 1. Configure Environment

```bash
# Copy and edit configuration
cp config/chrome-runner.env.example config/chrome-runner.env
Expand All @@ -37,18 +41,21 @@ nano config/chrome-runner.env # or your preferred editor
```

**Required configuration:**

```bash
GITHUB_TOKEN=ghp_your_actual_token_here
GITHUB_REPOSITORY=your-username/your-repo-name
```

### 2. Deploy Chrome Runner

```bash
# Run the deployment script
./scripts/deploy-chrome-x86.sh
```

### 3. Verify Deployment

```bash
# Check status
./scripts/deploy-chrome-x86.sh status
Expand All @@ -72,19 +79,23 @@ docker compose -f docker/docker-compose.chrome.yml --env-file config/chrome-runn
## Troubleshooting

### Architecture Issues

- Ensure you're running on x86_64 architecture
- Check with: `uname -m` (should return `x86_64`)

### Permission Issues

- The deployment script handles permission fixes automatically
- If manual deployment, ensure config.sh has execute permissions

### GitHub Token Issues

- Verify token has `repo` scope for private repositories
- Check token hasn't expired
- Ensure repository name format is correct: `username/repo-name`

### Docker Issues

- Ensure Docker daemon is running
- Check available disk space
- Verify no port conflicts
Expand Down Expand Up @@ -130,7 +141,8 @@ jobs:
## Support

If you encounter issues:

1. Check the logs: `docker logs github-runner-chrome`
2. Verify configuration in `config/chrome-runner.env`
3. Ensure GitHub token has correct permissions
4. Confirm you're on x86_64 architecture
4. Confirm you're on x86_64 architecture
6 changes: 6 additions & 0 deletions docs/CODE_SCANNING_FIXES.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# Code Scanning Security Fixes

## Overview

This document summarizes the code scanning security issues that were identified and fixed in this repository.

## Issues Fixed
Expand All @@ -11,11 +12,13 @@ This document summarizes the code scanning security issues that were identified
**Location**: Line 404
**Severity**: Medium
**Original Code**:

```bash
for container in $containers; do
```

**Fixed Code**:

```bash
while IFS= read -r container; do
[[ -z "$container" ]] && continue
Expand All @@ -31,6 +34,7 @@ done <<< "$containers"
**Location**: Lines 156, 161, 162, 164
**Severity**: Info
**Changes Made**:

- Line 156: `case ${TARGETARCH} in` → `case "${TARGETARCH}" in`
- Line 161: Quoted file path in test condition
- Line 162: Quoted curl output path
Expand All @@ -41,6 +45,7 @@ done <<< "$containers"
## Validation

All fixes have been validated using:

- ShellCheck for shell scripts
- Hadolint for Dockerfiles
- Bash syntax verification
Expand All @@ -55,6 +60,7 @@ All fixes have been validated using:
## Additional Notes

The repository already has good security practices in place:

- Input validation in entrypoint scripts
- Secure temporary file handling with `mktemp`
- Regular Trivy security scans
Expand Down
10 changes: 7 additions & 3 deletions docs/DEPLOYMENT.md
Original file line number Diff line number Diff line change
Expand Up @@ -58,11 +58,15 @@
cd /opt/github-runner

# Configure environment

cp config/runner.env.example config/runner.env
# Edit config/runner.env with production values

# Start runners
# Edit config/runner.env with production values

# Start runners

./scripts/quick-start.sh

```

3. **Monitoring Setup**
Expand All @@ -75,7 +79,7 @@
curl -f http://localhost:3000/api/health
```

### Post-deployment
## Post-deployment

- [ ] Verify runner registration in GitHub
- [ ] Test job execution
Expand Down
Loading