Replace Containerfile with Forgejo Actions

hosts/sigma/gitea.nix

@@ -6,7 +6,7 @@
 }: {
   # https://forgejo.org/docs/latest/admin/actions/
   services.gitea-actions-runner = {
-    package = pkgs.gitea-actions-runner; # TODO: forgejo
+    package = pkgs.forgejo-actions-runner;
     instances."default" = {
       enable = true;
       name = "default";
@@ -15,16 +15,17 @@
       tokenFile = config.age.secrets.gitea-actions-runner-token-file.path;
       # The Forgejo runner relies on application containers (Docker, Podman,
       # etc) to execute a workflow in an isolated environment. Labels are used
-      # to map jobs' `runs-on` to their runtime environment. Note that changing
-      # these labels requires a new registration token.
+      # to map jobs' `runs-on` to their runtime environment. Many common
+      # actions require bash, git and nodejs, as well as a filesystem that
+      # follows the filesystem hierarchy standard.
       labels = [
-        "nixos-latest:docker://nixos/nix:2.21.0"
+        "debian-latest:docker://node:20-bullseye"
       ];
       # https://forgejo.org/docs/latest/admin/actions/#configuration
       settings = {
         runner = {
           # Default fetch interval is 2s -- no need to spam the server
-          fetch_interval = "1m";
+          fetch_interval = "5m";
         };
       };
     };
@@ -37,4 +38,3 @@
     group = "root";
   };
 }
-

overlays/default.nix

@@ -1,3 +1,3 @@
 {...}: {
-  imports = [];
+  imports = [./forgejo-actions-runner.nix];
 }

overlays/forgejo-actions-runner.nix

@@ -0,0 +1,24 @@
+{...}: {
+  # Running containers without /bin/sleep (such as nixos) requires newer
+  # forgejo act runner. See https://codeberg.org/forgejo/forgejo/issues/2611.
+  nixpkgs.overlays = [
+    (final: prev: {
+      forgejo-actions-runner = prev.callPackage "${prev.path}/pkgs/development/tools/continuous-integration/forgejo-actions-runner" {
+        buildGoModule = args:
+          prev.buildGoModule (args
+            // rec {
+              version = "3.4.1";
+
+              src = prev.fetchFromGitea {
+                domain = "codeberg.org";
+                owner = "forgejo";
+                repo = "runner";
+                rev = "v${version}";
+                hash = "sha256-c8heIHt+EJ6LnZT4/6TTWd7v85VRHjH72bdje12un4M=";
+              };
+              vendorHash = "sha256-FCCQZdAYRtJR3DGQIEvUzv+1kqvxVTGkwJwZSohq28s=";
+            });
+      };
+    })
+  ];
+}