githubConfigUrl: https://github.com/alexcodeplace/overdeck
githubConfigSecret: arc-github-config
runnerScaleSetName: arc-k3s
minRunners: 0
maxRunners: 1

listenerTemplate:
  spec:
    containers:
      - name: listener
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]

# One pod at a time owns the local-path RWO content cache. Workspaces remain
# per-pod emptyDir state and are never shared between jobs.
template:
  metadata:
    labels:
      app.kubernetes.io/name: arc-runner
  spec:
    serviceAccountName: arc-runner
    automountServiceAccountToken: false
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      runAsGroup: 1001
      fsGroup: 1001
      seccompProfile:
        type: RuntimeDefault
    containers:
      - name: runner
        image: ghcr.io/actions/actions-runner@sha256:0cfdcc701ce933c6d243c6b0b2da767366dc9f2e99961d4c3754b0b78084cdda
        imagePullPolicy: IfNotPresent
        command: ["/home/runner/run.sh"]
        env:
          - name: PNPM_STORE_DIR
            value: /cache/pnpm/store
          - name: VENV_ARCHIVE_DIR
            value: /cache/venv-archives
        resources:
          requests:
            cpu: "1"
            memory: 2Gi
          limits:
            cpu: "4"
            memory: 8Gi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
        volumeMounts:
          - name: content-cache
            mountPath: /cache
          - name: workspace
            mountPath: /home/runner/_work
    volumes:
      - name: content-cache
        persistentVolumeClaim:
          claimName: pnpm-store
      - name: workspace
        emptyDir: {}
