Building an Autonomous CI/CD Pipeline Using Self-Hosted Gitea Actions and Hardened Runner Nodes

Punti chiave

1. Use ephemeral runners. Each job gets a fresh environment, preventing state leakage between runs.
2. Isolate runner nodes. Run runners on dedicated hosts or VMs, not on production servers.
3. Restrict network access. Runners should reach only the registry and Git server, not the broader network.
4. Manage secrets carefully. Use Gitea's secret management and never print secrets in logs.
5. Pin action versions. Use commit SHAs instead of tags to prevent supply-chain attacks.
6. Limit job permissions. Grant the minimum token scopes needed for each workflow.
7. Monitor runner health. Track job duration, failure rates, and resource usage.
8. Clean up after jobs. Remove containers, caches, and temporary files after each run.

Architecture

Gitea hosts the repository and orchestrates workflows. Runner nodes poll for jobs, execute them in isolated containers, and report results. Network policies restrict runner access, and secret management prevents credential exposure.

Production configuration

name: build
on: [push]
jobs:
  build:
    runs-on: self-hosted
    permissions:
      contents: read
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
    - name: Build
      run: |
        set -euo pipefail
        docker build -t app:$GITHUB_SHA .
    - name: Scan
      run: trivy image app:$GITHUB_SHA

# run runner in a container with restricted network
docker run -d --name gitea-runner \
  --network runner-net \
  --read-only \
  --tmpfs /tmp \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  gitea/act_runner:latest

# firewall rules for runner network
iptables -A FORWARD -s 10.0.1.0/24 -d 10.0.0.5 -p tcp --dport 3000 -j ACCEPT
iptables -A FORWARD -s 10.0.1.0/24 -j DROP

gitea-runner --version
# check runner logs for secret leaks
grep -r 'GITEA_TOKEN\|SECRET' /var/log/gitea-runner/ || echo 'no leaks'
# audit workflow permissions
grep -r 'permissions:' .gitea/workflows/

Edge cases from production

• Docker socket access gives runners root on the host; use rootless Docker or a separate daemon.
• Ephemeral runners need fast provisioning; pre-pull images to reduce startup time.
• Secrets in workflow files are visible to anyone with read access; use Gitea's secret store.
• Runner nodes accumulate disk from caches; schedule cleanup jobs.

Domande frequenti