swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

swarm-controller/src/forge/objects.rs

@@ -84,9 +84,8 @@ const OPERATORS_TEAM_UNITS: [&str; 7] = [
 ];
 
 /// Periodic sync interval for pull-mirrors. Forgejo syncs mirrors on-access by
-/// default, which re-introduces external DNS latency on every `git clone` (the
-/// hive-ci runner shares the host netns and is therefore affected by host
-/// resolver blips). A fixed periodic interval isolates CI from transient DNS
+/// default, which re-introduces external DNS latency on every `git clone`. A
+/// fixed periodic interval isolates CI from transient DNS
 /// failures — a stale mirror is acceptable; a broken clone because of a
 /// momentary DNS blip is not. Written in the form Forgejo echoes back, so an
 /// unchanged mirror compares equal and is not re-patched.
@@ -118,7 +117,7 @@ Do **not** push directly to `main` — agents have read-only access.
 ";
 
 /// The operator-declared pull-mirrors (nix `deploy.forgejo.mirrors`, plus the
-/// CI-auto `actions/checkout` entry), JSON-encoded by `hive-forge/default.nix`.
+/// `actions/checkout` entry `deploy.forgejo.actionsFromSelf` adds), JSON-encoded by `hive-forge/default.nix`.
 /// Absent or empty means no mirrors.
 const MIRRORS_ENV: &str = "SWARM_CONTROLLER_FORGE_MIRRORS";
 

swarm-controller/src/forge/runner_token.rs

@@ -0,0 +1,116 @@
+//! The forge's runner registration token, published to the swarm secret store
+//! at [`ci::registration_token_path`], where the CI runner's fetch unit
+//! (`nix/host-modules/swarm-ci-runner.nix`) reads it under the runner's own
+//! certificate.
+//!
+//! Forgejo answers `GET /admin/runners/registration-token` with the same
+//! instance-wide token until someone resets it. The runner re-registers on
+//! every new value it reads, which leaves its previous entry on the forge, so
+//! a pass writes only when the forge's token differs from the one this process
+//! last wrote. The controller's store grant on the path is write-only, so that
+//! last write is held in memory: a restarted controller writes the current
+//! token once.
+
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use swarm_secret_client::ci;
+
+use super::Client;
+
+/// How often [`spawn`] re-reads the forge's token.
+const RECONCILE_INTERVAL: std::time::Duration = std::time::Duration::from_mins(5);
+
+/// Whether `current`, the forge's token now, has to be written, given the one
+/// this process last wrote (`None` before its first write).
+fn needs_write(last_written: Option<&str>, current: &str) -> bool {
+    last_written != Some(current)
+}
+
+impl Client {
+    /// The forge's instance-wide runner registration token.
+    ///
+    /// # Errors
+    /// When the forge refuses the call, or answers without a token.
+    pub async fn runner_registration_token(&self) -> Result<String> {
+        let answer = self
+            .api
+            .admin_get_registration_token()
+            .await
+            .context("GET /admin/runners/registration-token")?;
+        answer
+            .token
+            .filter(|t| !t.is_empty())
+            .context("the forge answered without a runner registration token")
+    }
+}
+
+/// One pass: read the forge's token and write it when it is not the one
+/// `last_written` holds. Returns the token it wrote, if it wrote one.
+async fn pass(client: &Client, last_written: Option<&str>) -> Result<Option<String>> {
+    let token = client.runner_registration_token().await?;
+    if !needs_write(last_written, &token) {
+        return Ok(None);
+    }
+    let path = ci::registration_token_path()?;
+    let store = crate::store::connect()
+        .await
+        .context("logging in to the swarm secret store")?;
+    store
+        .write(
+            &path,
+            &ci::Credential {
+                value: token.clone(),
+            },
+        )
+        .await
+        .with_context(|| format!("writing {path}"))?;
+    Ok(Some(token))
+}
+
+/// Publish the forge's runner registration token now and every
+/// [`RECONCILE_INTERVAL`] after. A pass that fails is logged and retried on
+/// the next tick; it never stops the daemon.
+pub fn spawn(client: Arc<Client>) {
+    tokio::spawn(async move {
+        let mut ticker = tokio::time::interval(RECONCILE_INTERVAL);
+        let mut last_written: Option<String> = None;
+        loop {
+            ticker.tick().await;
+            match pass(&client, last_written.as_deref()).await {
+                Ok(Some(written)) => {
+                    tracing::info!("runner registration token: written to the store");
+                    last_written = Some(written);
+                }
+                Ok(None) => tracing::debug!("runner registration token: unchanged"),
+                Err(e) => tracing::warn!(
+                    error = %format!("{e:#}"),
+                    retry_in_s = RECONCILE_INTERVAL.as_secs(),
+                    "runner registration token: pass failed; retrying next tick"
+                ),
+            }
+        }
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::needs_write;
+
+    #[test]
+    fn the_first_pass_writes() {
+        assert!(needs_write(None, "t1"));
+    }
+
+    #[test]
+    fn an_unchanged_token_is_not_rewritten() {
+        // A rewrite of the same value is harmless to the runner, but it is a
+        // new store version every five minutes for nothing.
+        assert!(!needs_write(Some("t1"), "t1"));
+    }
+
+    #[test]
+    fn a_reset_token_is_written() {
+        assert!(needs_write(Some("t1"), "t2"));
+    }
+}