tenseleyflow/shithub / 1945c79

 Replace the generated token placeholders with per-host values from

 `shithubd admin runner register`, preferably through ansible-vault or host_vars.

 Then run:

 ```sh

 For a production-like runner host, manually verify:

 2. Trigger `.shithub/workflows/checkout-canary.yml` on trunk.

 3. Confirm the run appears in the Actions tab and the check run completes.

 4. Confirm step logs stream while the job is running and finalize to object

 Operators register a runner with:

 ```sh

 ```

 The command inserts `workflow_runners`, stores only a SHA-256 hash in

 `POST /api/v1/runners/heartbeat` accepts:

 Request body:

 ```json

 ```

 Returns 204 when no matching job is claimable. Returns 200 with

 ```sh

 shithubd admin runner register \

   --name runner-1 \

 ```

 ```sh

 export RUNNER_TOKEN='<printed-token>'

 shithubd-runner run \

   --server-url "$BASE" \

   --token "$RUNNER_TOKEN" \

   --workspace-root /var/lib/shithubd-runner/workspaces \

   --network shithub-actions \

   --dns-servers 172.30.0.1

 [runner]

 token = "<printed-token>"

 capacity = 1

 poll_interval = "5s"

 workspace_root = "/var/lib/shithubd-runner/workspaces"

 The config path defaults to `/etc/shithubd-runner/config.toml`.

 Environment variables use the `SHITHUB_RUNNER_` prefix, for example

 `SHITHUB_RUNNER_TOKEN` or `SHITHUB_RUNNER_SERVER__BASE_URL`.

 The Ansible runner role creates the `shithub-actions` bridge, runs the

 allowlist resolver at `172.30.0.1`, and installs firewall rules that

 curl -fsS "$BASE/api/v1/runners/heartbeat" \

   -H "Authorization: Bearer $RUNNER_TOKEN" \

   -H "Content-Type: application/json" \

   | tee /tmp/shithub-claim.json

 ```

 ```sh

 shithubd admin runner register \

   --name smoke-runner-1 \

 ```

 4. Push a `run:`-only workflow:

 ```yaml

 shithubd admin actions runner list

 ```

 Important metrics:

 - `shithub_actions_queue_depth{resource="runs|jobs"}`

 - `SHITHUB_ACTIONS_VUS=50` controls concurrent virtual users.

 - `SHITHUB_ACTIONS_DURATION=10m` controls the steady-state window.

   labels.

 - `SHITHUB_RUNNER_CAPACITY=17` keeps three runners near the 50-concurrent

   target.

 - **Run never appears:** confirm the workflow file is under

   `.shithub/workflows/`, parse it with `shithubd admin actions parse <file>`,

   and verify the trigger event matches `on:`.

 - **Step logs buffer:** verify the Caddy route above and confirm the SSE route

   is still mounted outside compression and short timeouts.

 - **`actions/checkout@v4` fails:** confirm the job is still running, the repo

 shithubd admin runner register \

   --name prod-runner-1 \

   --labels self-hosted,linux,ubuntu-latest,x64 \

 ```

 Only the token hash is stored in Postgres; the raw token cannot be

 recovered later.

 For a generated DigitalOcean inventory, register one token per runner host and

 use the host name as the runner name:

 shithubd admin runner register \

   --name shithub-runner-shared-linux-1 \

   --labels self-hosted,linux,ubuntu-latest,x64 \

 ```

 ## Inventory

 `runs-on: ubuntu-latest` is a runner label, not a promise that shithub downloads

 a hosted Ubuntu image for you. The site operator decides which image a matching

 ## Current limit

 2. Keep `actions/checkout@v4`, but replace marketplace and artifact `uses:`

    actions with equivalent `run:` commands for now.

 3. Confirm `runs-on:` matches a label registered by your shithub operator.

 Marketplace actions, Docker actions, composite actions, hosted runner images,

 matrix expansion, service containers, submodules, LFS, and artifact transfer