feat(github-runner-exporter): Forgejo runners in the runner series, forge label #520

Merged

kblack0610 merged 1 commit from feat/forgejo-runners-exporter into master

2026-11-04 03:39:21 +00:00

kblack0610 commented

2026-11-04 03:38:40 +00:00

Owner

The runner exporter now reads Forgejo too, so the CI board and the hub show Forgejo runners next to GitHub's.

Runner rows come from the runner pods in the forgejo namespace. A namespaced Role (apps/forgejo/runner-reader-rbac.yaml) lets the exporter's new ServiceAccount get and list pods, read pod logs, and read only the forgejo-runner-config configmap.
Job and run rows come from the Forgejo API for the repos in FORGEJO_REPOS.
Every CI series carries a forge label. The HA sensor, the dashboard and its generator read api_ok{forge="github"}, so a Forgejo read failure never shows as GitHub down.

Until a read-only token exists, forgejo:repos/* reports api_ok 0 (kind runs) and the runner rows still show. No alert or Infra banner reads kind="runs", so nothing pages. Token: a kblack0610 token with only read:repository, added with sops apps/github-runner-exporter/github-runner-exporter-secret.yaml as key forgejo-token. That step is filed on the human sheet.

Tests: test_exporter.py 62/62.

https://claude.ai/code/session_01BALUC6LnQX9Quuz7grTxLX

The runner exporter now reads Forgejo too, so the CI board and the hub show Forgejo runners next to GitHub's. - Runner rows come from the runner pods in the `forgejo` namespace. A namespaced Role (`apps/forgejo/runner-reader-rbac.yaml`) lets the exporter's new ServiceAccount get and list pods, read pod logs, and read only the `forgejo-runner-config` configmap. - Job and run rows come from the Forgejo API for the repos in `FORGEJO_REPOS`. - Every CI series carries a `forge` label. The HA sensor, the dashboard and its generator read `api_ok{forge="github"}`, so a Forgejo read failure never shows as GitHub down. Until a read-only token exists, `forgejo:repos/*` reports `api_ok` 0 (kind `runs`) and the runner rows still show. No alert or Infra banner reads `kind="runs"`, so nothing pages. Token: a kblack0610 token with only `read:repository`, added with `sops apps/github-runner-exporter/github-runner-exporter-secret.yaml` as key `forgejo-token`. That step is filed on the human sheet. Tests: `test_exporter.py` 62/62. https://claude.ai/code/session_01BALUC6LnQX9Quuz7grTxLX

kblack0610 added 1 commit

2026-11-04 03:38:40 +00:00

feat(github-runner-exporter): Forgejo runners in the runner series, forge label

checks / ci-disk-prune (pull_request) Successful in 10s

Details

checks / zomboid-scripts (pull_request) Successful in 12s

Details

checks / fleet-roster (pull_request) Successful in 13s

Details

checks / prometheus-rules (pull_request) Successful in 12s

Details

checks / kustomize-builds (pull_request) Successful in 5s

Details

890a558829

The two forgejo-runner pods are rows in github_runner_state, pool="forgejo",
one row per capacity slot (<pod>/<n>), and Forgejo waiting jobs, finished
jobs, durations, pool workflows and last jobs join the same series. Every row
carries forge="github" or forge="forgejo", so hub-core, the cc:pool_* rules
and the CI dashboards pick the pool up with no query change.

Forgejo 14 has no runner-list API, so the runners come from the runner pods
and their ConfigMap (new Role in forgejo, bound to a new exporter
ServiceAccount), and the runner of a task from its "task <id> repo is" log
line. Jobs and tasks come from /repos/{o}/{r}/actions/runners/jobs and
/actions/tasks, which need an owner token: FORGEJO_TOKEN reads the new
optional forgejo-token key of the exporter secret, which a human adds.

The HA "CI GitHub API" sensor and the Grafana "GitHub API" stat now read
api_ok{forge="github"}, so a missing Forgejo token does not read as GitHub
down.

Claude-Session: https://claude.ai/code/session_01BALUC6LnQX9Quuz7grTxLX