behave: Allow running nested containers with gitea actions

behave/Containerfile

@@ -3,13 +3,16 @@ FROM opensuse/leap:15.6
 RUN zypper -n modifyrepo --disable repo-openh264 || : \
     && zypper ar --repo http://download.opensuse.org/repositories/OBS:/Server:/Unstable/15.6/OBS:Server:Unstable.repo \
     && zypper ar --repo http://download.opensuse.org/repositories/devel:/tools:/scm/15.6/devel:tools:scm.repo \
+    && zypper ar --repo https://download.opensuse.org/repositories/devel:/Factory:/git-workflow/15.6/devel:Factory:git-workflow.repo \
     && zypper -n --gpg-auto-import-keys refresh
 
 RUN zypper -n install \
     bash \
     bash-completion \
+    crun \
+    fuse-overlayfs \
     git \
-    gitea \
+    gitea-action-runner \
     less \
     obs-api \
     obs-gitea-bridge \
@@ -20,10 +23,13 @@ RUN zypper -n install \
     openslp \
     openssl \
     perl-XML-SAX \
+    podman \
+    podman-docker \
     rpm-build \
     sqlite3 \
     systemd \
     vim \
+    && zypper -n install --repo=devel_tools_scm gitea \
     && rm -rf /var/cache/zypp/*
 
 COPY container-files/ /

behave/container-files/opt/setup/gitea.sh

@@ -141,3 +141,19 @@ popd
 
 # create test-GitPkgA package in test:factory that has scmsync set to gitea
 $OSC api -X PUT '/source/test:factory/test-GitPkgA/_meta' --file "$TOPDIR"/fixtures/pac/test-GitPkgA.xml
+
+
+# gitea-action-runner
+systemctl enable podman.socket
+systemctl enable gitea-action-runner.service
+
+# auth token for action runners
+export TOKEN_ACT_RUNNER="rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr"
+su - gitea -c "echo \"INSERT INTO action_runner_token (token, owner_id, repo_id, is_active) VALUES ('$TOKEN_ACT_RUNNER', 0, 0, 1);\" | sqlite3 $DB_PATH"
+
+# gitea-action-runner.service requires .runner file in this location
+pushd /var/lib/gitea-action-runner
+gitea-action-runner register --no-interactive --instance http://localhost:3000 --token=$TOKEN_ACT_RUNNER
+# localhost in the container spawned by the gitea action runner is different than the localhost gitea is running in
+# so we need to redirect the address to the parent container
+sed -i 's@"address": ".*"@"address": "http://host.containers.internal:3000"@' .runner

behave/container-run.sh

@@ -10,12 +10,13 @@ podman run \
     --detach \
     --interactive \
     --tty \
-    --volume="$TOPDIR":/opt/workdir \
+    --volume "$TOPDIR":/opt/workdir \
     --cap-add SYS_PTRACE \
+    --privileged \
+    --security-opt label=disable \
     -p 1443:443 \
     -p 1082:82 \
     -p 3000:3000 \
-    -p 3001:3000 \
     -p 3022:3022 \
     obs-server
 

behave/features/steps/podman.py

@@ -183,6 +183,8 @@ class Container:
             "--detach",
             "--interactive",
             "--tty",
+            "--privileged",
+            "--security-opt", "label=disable",
         ]
 
         with get_free_port() as obs_https, get_free_port() as gitea_http, get_free_port() as gitea_ssh: