From d54ec38a1c68e83f1f76bd17a144a586353cc7f2 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Tue, 5 May 2026 10:27:45 -0500
Subject: [PATCH] fix GCE runner: add build tools, libcurl, NOPASSWD sudo,
 Node.js 20

---
 servers/gcp/runners/startup.sh | 42 +++++++++++++++++++++++++++++++---
 1 file changed, 39 insertions(+), 3 deletions(-)

diff --git a/servers/gcp/runners/startup.sh b/servers/gcp/runners/startup.sh
index b8a2bfe..bd2ed9f 100644
--- a/servers/gcp/runners/startup.sh
+++ b/servers/gcp/runners/startup.sh
@@ -15,9 +15,41 @@ set -euxo pipefail
 exec > >(tee /var/log/runner-bootstrap.log) 2>&1
 
 apt-get update
-# nodejs/npm needed for JavaScript actions like actions/checkout and
-# google-github-actions/auth. python3 is for our inline label-rewrite below.
-apt-get install -y curl ca-certificates docker.io git jq nodejs npm python3
+
+# Core system tools and C build dependencies required by CI jobs.
+# libcurl4-openssl-dev + build-essential are needed by the El compiler C build;
+# libssl-dev/libsqlite3-dev/libpq-dev for downstream projects.
+# python3 is for the inline label-rewrite step below.
+apt-get install -y --no-install-recommends \
+    curl \
+    ca-certificates \
+    docker.io \
+    git \
+    jq \
+    python3 \
+    wget \
+    unzip \
+    zip \
+    xz-utils \
+    rsync \
+    file \
+    sudo \
+    make \
+    build-essential \
+    pkg-config \
+    gcc \
+    libcurl4-openssl-dev \
+    libssl-dev \
+    libsqlite3-dev \
+    libpq-dev \
+    libffi-dev \
+    zlib1g-dev
+
+# Node.js 20 LTS via NodeSource — Ubuntu 24.04's bundled nodejs is 18.x
+# which works but 20 LTS matches what our other CI images use.
+curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+apt-get install -y --no-install-recommends nodejs
+npm install -g yarn
 
 # Make docker usable by the unprivileged runner user
 systemctl enable --now docker
@@ -25,6 +57,10 @@ systemctl enable --now docker
 useradd -m -s /bin/bash runner || true
 usermod -aG docker runner
 
+# Allow the runner user to install packages and run system commands
+# in CI workflow steps without a password prompt.
+echo "runner ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
+
 # act_runner — pinned to a known-good release. Bump RUNNER_VERSION when
 # upgrading. The project moved from gitea/act_runner to gitea/runner around
 # the 0.6.x series; the binary inside the asset is still called act_runner.