Build and publish large runner docker image by iMichka · Pull Request #23345 · Homebrew/brew

iMichka · 2026-07-28T20:18:45Z

Have you followed our Contributing guidelines?
Have you checked for other open Pull Requests for the same change?
Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
Have you explained why you'd like these changes included, not just what they do?
For bug fixes, have you given step-by-step brew commands to reproduce the bug?
Have you written new tests (excluding integration tests)? Here's an example.
Have you successfully run brew lgtm (style, typechecking and tests) locally?

AI was used to generate or assist with generating this PR.

iMichka · 2026-07-28T20:24:24Z

Can someone add the AWS_PROJECT_ID secret? I can't because I am not a lead maintainer anymore and lost access to this repo.

Copilot

Pull request overview

Adds automation and container assets to build and publish a “large runner” Docker image derived from the Homebrew brew image, intended to run a self-hosted GitHub Actions runner inside the container.

Changes:

Add a runner container startup script that configures the runner from a base64-encoded JIT config and starts the runner.
Add a runner image Docker build context (Dockerfile + entrypoint script).
Add a GitHub Actions workflow to build multi-arch runner images and publish a manifest (and mirror to AWS/ECR).

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File	Description
`runner/startup.sh`	New entrypoint script to configure the actions runner from `RUNNER_JITCONFIG` and launch it.
`runner/DockerFile`	New Docker build definition for the runner image based on the Homebrew brew image.
`.gitignore`	Unignore the new `runner/` directory so it is committed despite the repo’s “ignore everything then allowlist” approach.
`.github/workflows/runner.yml`	New workflow to build/publish the runner image on successful completion of the existing `Docker` workflow.

Comments suppressed due to low confidence (6)

.github/workflows/runner.yml:154

merge_group is not an event for this workflow (it only runs on workflow_run), so this condition prevents pushing the manifest. Gate only on the check output (or remove the condition entirely).

      - name: Push manifest
        run: |
          mapfile -t digest_args < <(find /tmp/digests -maxdepth 1 -type f -printf '%f\n' | sed "s#^#${IMAGE}@sha256:#")

.github/workflows/runner.yml:162

This workflow runs on workflow_run, so the merge_group check here will never be true. As a result, the AWS deployment steps are skipped even when a new image was built.

        shell: bash
        env:
          AWS_PROJECT_ID: ${{ secrets.AWS_PROJECT_ID }}

.github/workflows/runner.yml:175

Same as above: this workflow runs on workflow_run, so github.event_name == 'merge_group' is never true and this step is skipped. Use the check output to gate publishing.

        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_PROJECT_ID }}:role/GithubActionsRoleECRPush

.github/workflows/runner.yml:183

Same issue: the merge_group event condition is unreachable in a workflow_run-only workflow, so this login step will be skipped.


      - name: Generate AWS image name
        env:

.github/workflows/runner.yml:188

Same unreachable merge_group condition in a workflow_run-only workflow. Without fixing this, AWS_IMAGE is never set and the push step can't run.

        run: |
          echo "AWS_IMAGE=${AWS_REGISTRY}/runner-ecr:${BREW_IMAGE_DIGEST}-${GITHUB_SHA}" >> "$GITHUB_ENV"
          echo "AWS_IMAGE_LATEST=${AWS_REGISTRY}/runner-ecr:latest" >> "$GITHUB_ENV"

.github/workflows/runner.yml:197

Same unreachable merge_group condition in a workflow_run-only workflow; this prevents the image from being pushed to ECR.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        with:
+          context: runner
+          platforms: ${{ matrix.platform }}
+          build-args: HOMEBREW_BREW_IMAGE=${{ needs.resolve-base-image.outputs.brew_image }}
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}


+      - name: Check if image changed
+        if: github.event_name == 'schedule'
+        id: check
+        run: |


+  if [[ "${config_file}" != "$(basename "${config_file}")" || "${config_file:0:1}" != "." ]]; then
+    echo "Invalid file name in JIT config: ${config_file}" >&2
+    continue
+  fi


+# Must be set when running the container (e.g., via `docker run -e RUNNER_JITCONFIG=...`)
+ENV RUNNER_JITCONFIG=
+
+# Do not let .NET load icu to avoid poluting the image


MikeMcQuaid

Thanks! Few files to move around etc. but good step in the right direction 😍

MikeMcQuaid · 2026-07-29T07:34:51Z

@@ -0,0 +1,18 @@
+ARG HOMEBREW_BREW_IMAGE=ghcr.io/homebrew/brew:main


When do you want to change this?

MikeMcQuaid · 2026-07-29T07:35:24Z

@@ -0,0 +1,53 @@
+#!/bin/bash


Can this script get a comment at the top explaining what it's doing?

MikeMcQuaid · 2026-07-29T07:36:04Z

 !/README.md

+# Unignore large runner docker folder
+!/runner


Let's put this inside .github or Library/Homebrew

MikeMcQuaid · 2026-07-29T07:37:09Z

@@ -0,0 +1,53 @@
+#!/bin/bash


Let's ensure this script is put somewhere that brew style is definitely validating its syntax.

+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"


+        run: |
+          mapfile -t digest_args < <(find /tmp/digests -maxdepth 1 -type f -printf '%f\n' | sed "s#^#${IMAGE}@sha256:#")
+          docker buildx imagetools create \
+            --tag "${{ env.IMAGE }}:latest" \


MikeMcQuaid

Thanks!

MikeMcQuaid · 2026-07-30T14:04:58Z

+
+  build-runner:
+    name: Build runner Docker image (${{ matrix.platform }})
+    needs: merge


this could maybe work if we can "pull" from the local image? 🤔 not blocking but maybe worth a try

Suggested change

needs: merge

needs: build

iMichka force-pushed the longrunner branch from 7f4b369 to 845ee80 Compare July 28, 2026 20:21

iMichka marked this pull request as ready for review July 28, 2026 20:21

Copilot AI review requested due to automatic review settings July 28, 2026 20:21

Copilot started reviewing on behalf of iMichka July 28, 2026 20:21 View session

Build and publish large runner docker image

0226447

iMichka force-pushed the longrunner branch from 845ee80 to 0226447 Compare July 28, 2026 20:23

Copilot AI reviewed Jul 28, 2026

View reviewed changes

github-advanced-security AI found potential problems Jul 28, 2026

View reviewed changes

MikeMcQuaid reviewed Jul 29, 2026

View reviewed changes

Move to docker.yml

d676f2e

github-advanced-security AI found potential problems Jul 29, 2026

View reviewed changes

MikeMcQuaid reviewed Jul 30, 2026

View reviewed changes

Comment thread .github/workflows/docker.yml Outdated

Comment thread runner/Dockerfile

iMichka added 3 commits July 30, 2026 14:35

Rename to Dockerfile

6e19998

Remove resolve-runner-base-image

bf3885b

Add comment to explain RUNNER_JITCONFIG ENV

53b5e4c

MikeMcQuaid reviewed Jul 30, 2026

View reviewed changes

		@@ -0,0 +1,18 @@
		ARG HOMEBREW_BREW_IMAGE=ghcr.io/homebrew/brew:main

Uh oh!

Uh oh!

Conversation

iMichka commented Jul 28, 2026

Uh oh!

iMichka commented Jul 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MikeMcQuaid left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

MikeMcQuaid Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MikeMcQuaid Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

MikeMcQuaid left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

MikeMcQuaid Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants