gitea runners

docs/REFERENCE.md

@@ -87,6 +87,7 @@ sturdy-adventure/
 │   ├── fluent-bit.yaml
 │   ├── trivy.yaml
 │   ├── gitea.yaml
+│   ├── gitea-actions.yaml
 │   ├── sealedsecrets.yaml
 │   ├── secrets.yaml
 │   └── values/
@@ -96,6 +97,7 @@ sturdy-adventure/
 │       ├── loki-values.yaml
 │       ├── tempo-values.yaml
 │       ├── gitea-values.yaml
+│       ├── gitea-actions-values.yaml
 │       └── fluent-bit-values.yaml
 │
 ├── apps/                          # Business applications
@@ -125,6 +127,7 @@ sturdy-adventure/
 │   ├── argocd-mcp-credentials.yaml
 │   ├── dot-ai-secrets.yaml
 │   ├── gitea-credentials-sealed.yaml
+│   ├── gitea-runner-token-sealed.yaml
 │   ├── mcp10x-credentials-sealed.yaml
 │   └── musicman-credentials.yaml
 │
@@ -817,6 +820,53 @@ postgresql:
 
 **Secrets**: `gitea-credentials` (SealedSecret) containing `admin-password`, `postgres-password`, `secret` (OIDC client secret)
 
+### Gitea Actions Runners
+
+**Chart**: `actions` (from `https://dl.gitea.com/charts`)
+**Namespace**: `gitea`
+**Sync Wave**: 2 (deploys after Gitea)
+
+**Purpose**: Act runners execute Gitea Actions CI/CD workflows. Deployed as a StatefulSet with a Docker-in-Docker sidecar for container-based job execution.
+
+**Configuration**:
+```yaml
+# infra/gitea-actions.yaml + infra/values/gitea-actions-values.yaml
+replicaCount: 3
+
+runner:
+  labels:
+    - "ubuntu-latest:docker://node:20-bookworm"
+    - "ubuntu-22.04:docker://node:20-bookworm"
+  existingSecret: gitea-runner-token
+
+gitea:
+  instance:
+    url: http://gitea-http.gitea.svc.cluster.local:3000
+
+dind:
+  enabled: true  # Docker-in-Docker sidecar (privileged)
+```
+
+**Resources**:
+
+| Container | CPU Request | Memory Request | CPU Limit | Memory Limit |
+|-----------|-------------|----------------|-----------|--------------|
+| Runner | 250m | 256Mi | 1 | 1Gi |
+| DinD sidecar | 250m | 256Mi | 1 | 1Gi |
+
+**Secrets**: `gitea-runner-token` (SealedSecret) containing `token` (instance-level runner registration token from `/admin/runners`)
+
+**Setup Steps**:
+1. Get runner registration token from Gitea admin panel (`/admin/runners`)
+2. Fill in `private/gitea-runner-token.yaml` with the token
+3. Seal: `kubeseal --format yaml < private/gitea-runner-token.yaml > secrets/gitea-runner-token-sealed.yaml`
+4. Commit and push — ArgoCD deploys runners automatically
+
+**Verification**:
+- `kubectl get statefulset -n gitea` — 3/3 runners ready
+- Gitea admin panel (`/admin/runners`) — runners show as Online
+- Create test workflow in `.gitea/workflows/test.yml` — job executes
+
 ---
 
 ## Kyverno Policies
@@ -1421,6 +1471,7 @@ team: platform
 | **Tempo** | 2.6.0+ | 1.24.4 |
 | **Fluent-Bit** | 2.1.0+ | Latest |
 | **Gitea** | 1.25.4 | 12.5.0 |
+| **Gitea Act Runner** | Latest | Latest |
 | **PostgreSQL** | 16-alpine | N/A |
 | **Trivy** | Latest | Latest |