Build and publish large runner docker image

[iMichka]

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

---

[iMichka]

Can someone add the AWS_PROJECT_ID secret? I can't because I am not a lead maintainer anymore and lost access to this repo.

[Copilot]

Pull request overview

Adds automation and container assets to build and publish a “large runner” Docker image derived from the Homebrew brew image, intended to run a self-hosted GitHub Actions runner inside the container.

Changes:

• Add a runner container startup script that configures the runner from a base64-encoded JIT config and starts the runner.
• Add a runner image Docker build context (Dockerfile + entrypoint script).
• Add a GitHub Actions workflow to build multi-arch runner images and publish a manifest (and mirror to AWS/ECR).

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File	Description
runner/startup.sh	New entrypoint script to configure the actions runner from RUNNER_JITCONFIG and launch it.
runner/DockerFile	New Docker build definition for the runner image based on the Homebrew brew image.
.gitignore	Unignore the new runner/ directory so it is committed despite the repo’s “ignore everything then allowlist” approach.
.github/workflows/runner.yml	New workflow to build/publish the runner image on successful completion of the existing Docker workflow.

Comments suppressed due to low confidence (6)

.github/workflows/runner.yml:154

• merge_group is not an event for this workflow (it only runs on workflow_run), so this condition prevents pushing the manifest. Gate only on the check output (or remove the condition entirely).

      - name: Push manifest
        run: |
          mapfile -t digest_args < <(find /tmp/digests -maxdepth 1 -type f -printf '%f\n' | sed "s#^#${IMAGE}@sha256:#")

.github/workflows/runner.yml:162

• This workflow runs on workflow_run, so the merge_group check here will never be true. As a result, the AWS deployment steps are skipped even when a new image was built.

        shell: bash
        env:
          AWS_PROJECT_ID: ${{ secrets.AWS_PROJECT_ID }}

.github/workflows/runner.yml:175

• Same as above: this workflow runs on workflow_run, so github.event_name == 'merge_group' is never true and this step is skipped. Use the check output to gate publishing.

        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_PROJECT_ID }}:role/GithubActionsRoleECRPush

.github/workflows/runner.yml:183

• Same issue: the merge_group event condition is unreachable in a workflow_run-only workflow, so this login step will be skipped.

      - name: Generate AWS image name
        env:

.github/workflows/runner.yml:188

• Same unreachable merge_group condition in a workflow_run-only workflow. Without fixing this, AWS_IMAGE is never set and the push step can't run.

        run: |
          echo "AWS_IMAGE=${AWS_REGISTRY}/runner-ecr:${BREW_IMAGE_DIGEST}-${GITHUB_SHA}" >> "$GITHUB_ENV"
          echo "AWS_IMAGE_LATEST=${AWS_REGISTRY}/runner-ecr:latest" >> "$GITHUB_ENV"

.github/workflows/runner.yml:197

• Same unreachable merge_group condition in a workflow_run-only workflow; this prevents the image from being pushed to ECR.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MikeMcQuaid]

Thanks! Few files to move around etc. but good step in the right direction 😍

[MikeMcQuaid]

Thanks!

[MikeMcQuaid]

Thanks, looking better! Few more comments.

[iMichka]

Note for all: I have greatly modified the end of the upload step, to remove the intermediate upload of the long runner image to GitHub. Instead, once the image is built, it is directly uploaded to AWS. This removed a bunch of superfluous steps and code

[MikeMcQuaid]

Thanks, looking much nicer!