From a90e9b827cdd85d4d525ea82f515cd45f91245ed Mon Sep 17 00:00:00 2001 From: forgejo-backport-action Date: Sun, 29 Mar 2026 19:28:34 +0200 Subject: [PATCH] [v15.0/forgejo] feat: use `--token-url` in runner setup instructions (#11877) **Backport:** https://codeberg.org/forgejo/forgejo/pulls/11874 Use `--token-url` instead of `--token` in the runner setup instructions. `--token-url` is more secure. It was also decided [not to implement `--token`](https://code.forgejo.org/forgejo/runner/pulls/1457). The new instructions look as follows: ``` $ echo -n "a3bac733-079f-4917-ae9f-4acb99f1827b" > /path/to/runner-token $ forgejo-runner daemon \ --url http://192.168.178.62:3000/ \ --uuid 5982831f-8ee7-42c7-abcc-49c7d6dba586 \ --token-url file:///path/to/runner-token \ --label docker:docker://node:lts ``` `--label` is also new because Forgejo Runner is inoperable when neither a runner configuration nor `--label` are present. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes (can be removed for Go changes) - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. *The decision if the pull request will be shown in the release notes is up to the mergers / release team.* The content of the `release-notes/.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead. Co-authored-by: Andreas Ahlenstorf Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11877 Reviewed-by: Andreas Ahlenstorf Co-authored-by: forgejo-backport-action Co-committed-by: forgejo-backport-action --- templates/shared/actions/runner_setup.tmpl | 6 ++++-- tests/e2e/runner-management.test.e2e.ts | 6 +++--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/templates/shared/actions/runner_setup.tmpl b/templates/shared/actions/runner_setup.tmpl index b18c995b3b..a24f63d536 100644 --- a/templates/shared/actions/runner_setup.tmpl +++ b/templates/shared/actions/runner_setup.tmpl @@ -43,10 +43,12 @@

{{ctx.Locale.Tr "actions.runners.runner_setup.instruction_replace_connection_name"}}

{{ctx.Locale.Tr "actions.runners.runner_setup.heading_using_options"}}
- 
forgejo-runner daemon \
+		
$ echo -n "{{.Runner.Token}}" > /path/to/runner-token
+$ forgejo-runner daemon \
 	--url {{.AppURL}} \
 	--uuid {{.Runner.UUID}} \
-	--token {{.Runner.Token}}
+	--token-url file:///path/to/runner-token \
+	--label docker:docker://node:lts
 

 		
{{ctx.Locale.Tr "actions.runners.runner_setup.instruction_advanced_configurations"}}

 	
diff --git a/tests/e2e/runner-management.test.e2e.ts b/tests/e2e/runner-management.test.e2e.ts
index 8f4d5584be..cecde7a850 100644
--- a/tests/e2e/runner-management.test.e2e.ts
+++ b/tests/e2e/runner-management.test.e2e.ts
@@ -134,7 +134,7 @@ test.describe('Runners of user2', () => {
 
     await expect(page.getByRole('heading', {name: 'Using program options'})).toBeVisible();
     await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`--uuid ${runnerUUID}`);
-    await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`--token ${runnerToken}`);
+    await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`echo -n "${runnerToken}"`);
 
     // Go back to list of runners.
     await page.getByRole('link', {name: 'List of runners', exact: true}).click();
@@ -238,7 +238,7 @@ test.describe('Runners of user2', () => {
 
     await expect(page.getByRole('heading', {name: 'Using program options'})).toBeVisible();
     await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`--uuid ${runnerUUID}`);
-    await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`--token ${runnerToken}`);
+    await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`echo -n "${runnerToken}"`);
   });
 
   test('delete runner', async ({page}) => {
@@ -425,7 +425,7 @@ test.describe('Global runners', () => {
 
     await expect(page.getByRole('heading', {name: 'Using program options'})).toBeVisible();
     await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`--uuid ${runnerUUID}`);
-    await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`--token ${runnerToken}`);
+    await expect(page.getByLabel('How to invoke forgejo-runner')).toContainText(`echo -n "${runnerToken}"`);
 
     // Go back to list of runners.
     await page.getByRole('link', {name: 'List of runners', exact: true}).click();