From cd0cb3093348cc6506ca5fda0e411dd6d4ea5adb Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Thu, 23 Apr 2026 21:19:17 -0500
Subject: [PATCH] ci: add neuron-technologies runner for Gitea Actions

---
 servers/legion/apps/gitea-runner.yaml         | 80 +++++++++++++++++++
 .../k8s/gitea-runner/external-secrets.yaml    | 27 ++++++-
 2 files changed, 105 insertions(+), 2 deletions(-)

diff --git a/servers/legion/apps/gitea-runner.yaml b/servers/legion/apps/gitea-runner.yaml
index 654a0e9..2902f60 100644
--- a/servers/legion/apps/gitea-runner.yaml
+++ b/servers/legion/apps/gitea-runner.yaml
@@ -77,3 +77,83 @@ spec:
           hostPath:
             path: /var/run/docker.sock
             type: Socket
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: neuron-technologies-runner
+  namespace: ci
+  labels:
+    app: neuron-technologies-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: neuron-technologies-runner
+  template:
+    metadata:
+      labels:
+        app: neuron-technologies-runner
+      annotations:
+        config-version: "2026-04-24-initial"
+    spec:
+      initContainers:
+        - name: register
+          image: registry.neuralplatform.ai/ci-base:latest
+          workingDir: /data
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              act_runner register \
+                --instance "$GITEA_INSTANCE_URL" \
+                --token "$GITEA_RUNNER_REGISTRATION_TOKEN" \
+                --name neuron-technologies \
+                --labels "self-hosted:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-latest:docker://registry.neuralplatform.ai/ci-base:latest,ubuntu-24.04:docker://registry.neuralplatform.ai/ci-base:latest,linux,x64" \
+                --no-interactive
+              cat > /data/config.yaml << 'EOF'
+              runner:
+                capacity: 2
+                timeout: 3h
+              container:
+                network: host
+                docker_host: "unix:///var/run/docker.sock"
+                force_pull: false
+                valid_volumes:
+                  - /var/run/docker.sock
+                default_image: "registry.neuralplatform.ai/ci-base:latest"
+                extra_hosts:
+                  - "gitea.git.svc.cluster.local:10.43.1.53"
+              EOF
+          envFrom:
+            - secretRef:
+                name: neuron-technologies-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: runner
+          image: registry.neuralplatform.ai/ci-base:latest
+          workingDir: /data
+          command: ["act_runner", "daemon", "--config", "/data/config.yaml"]
+          envFrom:
+            - secretRef:
+                name: neuron-technologies-runner-secret
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+          resources:
+            requests:
+              memory: 512Mi
+              cpu: 250m
+            limits:
+              memory: 4Gi
+              cpu: "4"
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
diff --git a/servers/legion/k8s/gitea-runner/external-secrets.yaml b/servers/legion/k8s/gitea-runner/external-secrets.yaml
index a1cfb05..47c112e 100644
--- a/servers/legion/k8s/gitea-runner/external-secrets.yaml
+++ b/servers/legion/k8s/gitea-runner/external-secrets.yaml
@@ -1,6 +1,5 @@
 ---
-# gitea-runner-secret — Gitea act-runner registration token
-# GITEA_INSTANCE_URL is static (not a secret); GITEA_RUNNER_REGISTRATION_TOKEN comes from Vault
+# gitea-runner-secret — neural-platform org runner token
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
@@ -25,3 +24,27 @@ spec:
       remoteRef:
         key: secret/data/gitea
         property: runner_token
+---
+# neuron-technologies-runner-secret — neuron-technologies org runner token
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: neuron-technologies-runner-secret
+  namespace: ci
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: neuron-technologies-runner-secret
+    creationPolicy: Owner
+    template:
+      data:
+        GITEA_INSTANCE_URL: "http://192.168.8.148:30322"
+        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
+  data:
+    - secretKey: runner_token
+      remoteRef:
+        key: secret/data/gitea
+        property: neuron_technologies_runner_token