githubConfigUrl: https://github.com/platform-modules
githubConfigSecret: awp-arc-github-app
runnerScaleSetName: awp-trusted-internal
runnerGroup: default
minRunners: 0
maxRunners: 4
template:
  metadata:
    labels:
      awp.dev/trust-profile: trusted-internal
      awp.dev/ephemeral: "true"
  spec:
    runtimeClassName: gvisor
    automountServiceAccountToken: false
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      runAsGroup: 1001
      fsGroup: 1001
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: runner
        image: ghcr.io/actions/actions-runner:latest
        command: ["/home/runner/run.sh"]
        env:
          - name: AWP_RUNNER_TRUST_PROFILE
            value: trusted-internal
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          runAsNonRoot: true
          readOnlyRootFilesystem: false
          capabilities:
            drop: ["ALL"]
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: "4"
            memory: 8Gi
