fix GCE runner: add build tools, libcurl, NOPASSWD sudo, Node.js 20

servers/gcp/runners/startup.sh

@@ -15,9 +15,41 @@ set -euxo pipefail
 exec > >(tee /var/log/runner-bootstrap.log) 2>&1
 
 apt-get update
-# nodejs/npm needed for JavaScript actions like actions/checkout and
-# google-github-actions/auth. python3 is for our inline label-rewrite below.
-apt-get install -y curl ca-certificates docker.io git jq nodejs npm python3
+
+# Core system tools and C build dependencies required by CI jobs.
+# libcurl4-openssl-dev + build-essential are needed by the El compiler C build;
+# libssl-dev/libsqlite3-dev/libpq-dev for downstream projects.
+# python3 is for the inline label-rewrite step below.
+apt-get install -y --no-install-recommends \
+    curl \
+    ca-certificates \
+    docker.io \
+    git \
+    jq \
+    python3 \
+    wget \
+    unzip \
+    zip \
+    xz-utils \
+    rsync \
+    file \
+    sudo \
+    make \
+    build-essential \
+    pkg-config \
+    gcc \
+    libcurl4-openssl-dev \
+    libssl-dev \
+    libsqlite3-dev \
+    libpq-dev \
+    libffi-dev \
+    zlib1g-dev
+
+# Node.js 20 LTS via NodeSource — Ubuntu 24.04's bundled nodejs is 18.x
+# which works but 20 LTS matches what our other CI images use.
+curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+apt-get install -y --no-install-recommends nodejs
+npm install -g yarn
 
 # Make docker usable by the unprivileged runner user
 systemctl enable --now docker
@@ -25,6 +57,10 @@ systemctl enable --now docker
 useradd -m -s /bin/bash runner || true
 usermod -aG docker runner
 
+# Allow the runner user to install packages and run system commands
+# in CI workflow steps without a password prompt.
+echo "runner ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
 # act_runner — pinned to a known-good release. Bump RUNNER_VERSION when
 # upgrading. The project moved from gitea/act_runner to gitea/runner around
 # the 0.6.x series; the binary inside the asset is still called act_runner.