Name:           rgoon-runner
Version:        0.2.0
Release:        4%{?dist}
Summary:        Standalone CI/CD runner for RepoGoon
License:        MPL-2.0
URL:            https://repogoon.org/repo/repogoon-org/rgoon-runner
Source0:        %{name}-%{version}.tar.gz

BuildRequires:  gcc
BuildRequires:  make
BuildRequires:  python3
BuildRequires:  systemd-rpm-macros
BuildRequires:  util-linux

Requires:       podman
Requires(pre):  gawk
Requires(pre):  grep
Requires(pre):  shadow-utils

%description
rgoon-runner is a standalone CI/CD runner for RepoGoon written in C. It
registers itself against a RepoGoon instance, long-polls for jobs, and runs
each job inside a Podman container under a managed system service.

%prep
%autosetup

%build
%set_build_flags
%make_build

%install
%make_install \
    PREFIX=%{_prefix} \
    SYSCONFDIR=%{_sysconfdir} \
    LOCALSTATEDIR=%{_localstatedir} \
    SYSTEMDUNITDIR=%{_unitdir}

%check
%make_build test

%pre
getent group rgoon-runner >/dev/null || groupadd -r rgoon-runner
getent passwd rgoon-runner >/dev/null || \
    useradd -r -g rgoon-runner -d %{_sharedstatedir}/rgoon-runner \
    -s /sbin/nologin -c "RepoGoon CI/CD runner" rgoon-runner

# Rootless Podman needs subordinate IDs to represent container ownership. System
# users do not receive these ranges automatically. Preserve administrator-owned
# mappings and allocate the first unused host-configured block for missing ones.
allocate_subid_range() {
    subid_file="$1"
    usermod_option="$2"
    login_defs_prefix="$3"

    grep -q '^rgoon-runner:' "$subid_file" 2>/dev/null && return 0

    range_min="$(awk -v key="${login_defs_prefix}_MIN" '$1 == key { print $2; exit }' /etc/login.defs)"
    range_max="$(awk -v key="${login_defs_prefix}_MAX" '$1 == key { print $2; exit }' /etc/login.defs)"
    range_size="$(awk -v key="${login_defs_prefix}_COUNT" '$1 == key { print $2; exit }' /etc/login.defs)"

    case "$range_min:$range_max:$range_size" in
        *[!0-9:]*|:*|*::*|*:)
            echo "Invalid ${login_defs_prefix} allocation policy in /etc/login.defs" >&2
            return 1
            ;;
    esac
    if [ "$range_size" -le 0 ] || [ "$range_min" -gt "$range_max" ]; then
        echo "Invalid ${login_defs_prefix} allocation policy in /etc/login.defs" >&2
        return 1
    fi

    subid_range="$(awk -F: \
        -v range_min="$range_min" \
        -v range_max="$range_max" \
        -v range_size="$range_size" '
        BEGIN {
            count = 0
        }
        NF >= 3 && $2 ~ /^[0-9]+$/ && $3 ~ /^[0-9]+$/ {
            first[count] = $2
            last[count] = $2 + $3 - 1
            count++
        }
        END {
            for (candidate = range_min;
                 candidate + range_size - 1 <= range_max;
                 candidate += range_size) {
                candidate_last = candidate + range_size - 1
                available = 1
                for (i = 0; i < count; i++) {
                    if (candidate <= last[i] && candidate_last >= first[i]) {
                        available = 0
                        break
                    }
                }
                if (available) {
                    print candidate "-" candidate_last
                    exit
                }
            }
        }
    ' "$subid_file" 2>/dev/null)"

    if [ -z "$subid_range" ]; then
        echo "Unable to allocate subordinate IDs for rgoon-runner in $subid_file" >&2
        return 1
    fi

    usermod "$usermod_option" "$subid_range" rgoon-runner
}

allocate_subid_range /etc/subuid --add-subuids SUB_UID || exit 1
allocate_subid_range /etc/subgid --add-subgids SUB_GID || exit 1
exit 0

%post
%systemd_post rgoon-runner.service

%preun
%systemd_preun rgoon-runner.service

%postun
%systemd_postun_with_restart rgoon-runner.service

%files
%license LICENSE
%doc README.md
%{_bindir}/rgoon-runner
%attr(0644,rgoon-runner,rgoon-runner) %config(noreplace) %{_sysconfdir}/rgoon-runner/runner.yml
%attr(0755,rgoon-runner,rgoon-runner) %dir %{_sysconfdir}/rgoon-runner
%attr(0755,rgoon-runner,rgoon-runner) %dir %{_sharedstatedir}/rgoon-runner
%{_unitdir}/rgoon-runner.service

%changelog
* Mon Aug 03 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.2.0-4
- Enforce a ten-minute maximum runtime for job containers
- Keep integration tests bounded and reliable in root-based build environments

* Mon Aug 03 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.2.0-3
- Allow rootless Podman to use the newuidmap and newgidmap capabilities

* Sun Aug 02 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.2.0-2
- Provision subordinate UID and GID ranges for rootless Podman

* Sat Aug 01 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.2.0-1
- Add configurable runner labels to registration
- Persist command-line registration labels and advertise them for job matching

* Sun Jul 26 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.1.0-2
- Preserve service access to runner identity files created during root registration

* Wed Jul 22 2026 Eddi-Jay Ohlms <e.ohlms@setup-tooling.org> - 0.1.0-1
- Initial RPM packaging for rgoon-runner