From 9629994e5508968899b60b058c1614a481d2a691 Mon Sep 17 00:00:00 2001
From: Emi Griffith <me@emigriffith.dev>
Date: Fri, 24 Jul 2026 00:32:21 -0700
Subject: [PATCH] infra/forgejo: push ci-runner and cut the LAN runner over to
 it

Image is live at git.thermograph.org/emi/thermograph/ci-runner:v1.
register-lan-runner.sh's LABELS default now points at it, and the
live runner's registration was cut over directly (labels edited in
~/forgejo-runner/.runner, no re-registration needed).
---
 infra/deploy/forgejo/README.md              | 20 ++++++++++----------
 infra/deploy/forgejo/register-lan-runner.sh |  2 +-
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/infra/deploy/forgejo/README.md b/infra/deploy/forgejo/README.md
index 03f6957..caf2ffe 100644
--- a/infra/deploy/forgejo/README.md
+++ b/infra/deploy/forgejo/README.md
@@ -122,22 +122,22 @@ rewrite). `ci-runner` is a slim Debian base with `docker-ce-cli` +
 `python3-yaml` for the other jobs that need them (`shell-lint`,
 `observability-validate`).
 
-Built and verified locally; **not yet pushed** — pushing to
-`git.thermograph.org/emi/thermograph/ci-runner` needs a PAT with
-`write:package` scope (the embedded git-remote token lacks it, same
-requirement documented in `backend-build-push.yml`). Once pushed:
+Pushed as `git.thermograph.org/emi/thermograph/ci-runner:v1`. Rebuild/push
+(requires a PAT with `write:package` scope — the embedded git-remote token
+lacks it, same requirement documented in `backend-build-push.yml`):
 
 ```bash
 docker build -t git.thermograph.org/emi/thermograph/ci-runner:v1 deploy/forgejo/ci-runner
 docker push git.thermograph.org/emi/thermograph/ci-runner:v1
 ```
 
-then cut the live runner over by editing the `labels` array in
-`~/forgejo-runner/.runner` on the desktop (same runner id/token, no
-re-registration) and updating `register-lan-runner.sh`'s `LABELS` default so
-future re-provisioning matches. Only after that cutover is verified working
-should the now-redundant `apt-get install docker.io` / `python3-yaml` steps be
-removed from the workflows that had them — removing them first would break
+`register-lan-runner.sh`'s `LABELS` default now points at this image, so
+fresh registrations pick it up automatically. The live runner is cut over by
+editing the `labels` array in `~/forgejo-runner/.runner` on the desktop (same
+runner id/token, no re-registration needed) and restarting the service. Only
+after a real job has run successfully under the new image should the
+now-redundant `apt-get install docker.io` / `python3-yaml` steps be removed
+from the workflows that had them — removing them first would break
 every job still running on `node:20-bookworm`.
 
 ## Why Postgres here and not the Thermograph app's TimescaleDB
diff --git a/infra/deploy/forgejo/register-lan-runner.sh b/infra/deploy/forgejo/register-lan-runner.sh
index 71f1c90..6edb92b 100755
--- a/infra/deploy/forgejo/register-lan-runner.sh
+++ b/infra/deploy/forgejo/register-lan-runner.sh
@@ -26,7 +26,7 @@ set -euo pipefail
 FORGEJO_URL="${1:?usage: $0 <forgejo_url> <registration_token>}"
 TOKEN="${2:?}"
 RUNNER_DIR="${RUNNER_DIR:-$HOME/forgejo-runner}"
-LABELS="${LABELS:-docker:docker://node:20-bookworm,thermograph-lan}"
+LABELS="${LABELS:-docker:docker://git.thermograph.org/emi/thermograph/ci-runner:v1,thermograph-lan}"
 
 echo "==> Stopping and disabling the old GitHub Actions runner service, if present"
 systemctl --user stop github-actions-runner 2>/dev/null || true