Test the hosted runners with the pipelines that the active projects use today on GitLab CI. Put one test workflow for each use case in a test repository on Forgejo. 69 active projects (activity since 2025-10-08) have a GitLab CI configuration (sweep of 2026-10-08). They fall into 10 use cases. A project can have more than one use case. | # | Use case | Projects | Examples | Runner | |---|---|---|---|---| | 1 | Go and Rust: build, test, lint | 23 | `mattermost-contact-bot`, `sdg-orchestrator`, `cert-manager-webhook-transip` | Kubernetes | | 2 | Node.js: build, test, lint | 9 | `catalog`, `fieldlab-bzlg`, `uit-betrouwbare-bron/documentatie` | Kubernetes | | 3 | Python: build, test | 8 | `wiat`, `rva`, `siem-soc` | Kubernetes | | 4 | Java: Maven or Gradle build, test | 5 | `woz-axon4-java`, `bkwi-graphql-server-huurtoeslag`, `voorbeelden` | Kubernetes | | 5 | Container image build and push (kaniko, ko) | 46 | `fieldlab-interest-form`, `digid-proxy`, `demo-build-container-image` | Kubernetes (`kaniko` label) | | 6 | Tests with service containers (`services:`) | 10 | `fds-catalogus`, `ace-sdg`, `effectively` | Kubernetes | | 7 | Helm, Kustomize and OpenTofu checks | 17 | `platform/flux/core`, `laadpalen-applicatie`, `platform/terraform/applications` | Kubernetes | | 8 | Release, deploy and write back to the repository | 17 | `catalog` (semantic-release), `developer.overheid.nl` (deploy), `helm-charts/open-fsc` (git push) | Kubernetes | | 9 | Security scans (GitLab SAST, secret detection, dependency scan) | 4 | `demo-build-container-image`, `open-ftv`, `developer.overheid.nl` | Kubernetes | | 10 | Multi-arch image builds (amd64 and arm64) | 4 | `open-ftv` (ko), `compliance-tester-contrib`, `open-fsc-contrib`, `ace-go` (Buildah) | Kubernetes for ko, KubeVirt (#1351) for Buildah | | 11 | Registry push and pull, without a build tool | all that push | — | Kubernetes. `docker push` needs a daemon, so only in a KubeVirt VM (#1351) | ## Checklist Repository: [`forgejo/runner-tests`](https://code.digitaledienst.overheid.nl/forgejo/runner-tests), mirrored to [`ecosystem/forgejo/runner-tests`](https://gitlab.com/digilab.overheid.nl/ecosystem/forgejo/runner-tests). Runner: `digikluster-k8s`, Kubernetes executor (#1348). Results: see the comments. - [x] Create the test repository on Forgejo and the mirror on GitLab - [x] 1 Go and Rust: build, vet, test, golangci-lint (`01-go-rust.yml`) - [x] 2 Node.js: build and test, with `actions/checkout` (`02-node.yml`) - [x] 3 Python: pytest (`03-python.yml`) - [x] 4 Java: Spring Boot with JPA on PostgreSQL, Maven build and test (`04-java.yml`). 502 downloads, peak memory 905 MiB of 6 GiB. Uses a mirror of Maven Central, because Maven Central returns HTTP 429 - [x] 5a Image with the upstream kaniko (`05a-image-kaniko.yml`) - [ ] 5b Image with our kaniko build (`05b-image-kaniko-fork.yml`). **Skipped for now** (2026-10-29): the kaniko fork publishes no image until #1355 (on hold). The workflow stays and fails on both executors until then - [x] 5c Image with ko (`05c-image-ko.yml`) - [x] 6 PostgreSQL service container (`06-services.yml`) - [x] 7 Helm lint and template, Kustomize build, OpenTofu plan (`07-helm-kustomize-tofu.yml`) - [x] 8 Write back with the automatic token, Forgejo release, Helm chart push (`08-release-write-back.yml`) - [x] 9 Trivy scan (`09-security.yml`) - [x] 10a Multi-arch with ko: one OCI image index with `amd64` and `arm64` (`10a-multiarch-ko.yml`) - [x] 10b Multi-arch with Buildah and QEMU (`10b-multiarch-buildah.yml`). Passes on `vm` since 2026-10-29 (#1351), also with QEMU for arm64 only in our own VM image - [x] 11 Registry push of a scratch image with the bot token, and an anonymous pull (`11-registry.yml`) - [x] 11b `docker build` and `docker push` in a KubeVirt VM (`11b-docker-build-push.yml`). Passes on `vm` since 2026-10-29: a build with a `RUN` step, push with the bot token, pull and run, with the Docker daemon of the VM. Fails on `default` as expected (no daemon) - [x] Record the results in this issue - [ ] Package mirror for Maven, npm, PyPI and Go. Needs a ticket - [ ] Report upstream: the plugin resolves a relative `working-directory` from `/` ## Steps 1. Create the test repository on Forgejo. 2. For each use case, write one workflow. Base it on the GitLab CI job of one example project. For use case 5, write three workflows that build and push the same image: - **ko**: build a Go image without a Dockerfile. - **kaniko**: the archived upstream image `gcr.io/kaniko-project/executor`, as the GitLab projects use it today. - **kaniko fork**: the maintained fork (Chainguard). Switch to our own fork when #1347 is done. For use case 10, write two workflows. Each one builds `linux/amd64` and `linux/arm64` in one pipeline, and pushes one OCI image index that holds both architectures: - **ko multi-arch**: as `open-ftv` does today. Set `defaultPlatforms` to `linux/amd64` and `linux/arm64` in `.ko.yaml`. ko cross-compiles Go, so no QEMU is necessary. This runs on the Kubernetes executor. - **Dockerfile multi-arch**: `buildah build --platform linux/amd64,linux/arm64 --manifest <image>`, then `buildah manifest push --all`. The `RUN` steps of the arm64 build need QEMU emulation, so this runs in a KubeVirt VM (#1351). Today the research projects build each architecture on a separate GitLab.com runner and join the images with `buildah manifest`. kaniko cannot do a multi-arch build in one job: it builds one architecture at a time. 3. Run the workflows on the hosted runner (#1348). Run use cases 10b and 11b after #1351. 4. Record the result of each use case in this issue: pass, or fail with the cause. 5. For each failure, decide: a fix in the runner, a change for the conversion of the pipelines, or a known limit. ## Points to check - Use case 5: kaniko needs `mkdir -p /workspace` after the build. JavaScript actions need `node` in the job image. - Use case 8: Forgejo has no `CI_JOB_TOKEN`. Deploys through the GitLab agent (`KUBE_CONTEXT`) need other credentials and an entry in the egress allowlist (C2). - Use case 9: the GitLab security templates produce GitLab reports. Decide on a replacement, for example Trivy. See [ADR 0009](https://gitlab.com/digilab.overheid.nl/ecosystem/forgejo/epic/-/blob/main/docs/adr/0009-ci-runners-kubernetes-executor-and-kubevirt-vm-per-job.md).