fix: validate persisted runner registration before reusing it

[compscidr]

Problem

The upstream myoung34 entrypoint reuses CONFIGURED_ACTIONS_RUNNER_FILES_DIR credentials unconditionally — if .runner exists it skips registration entirely, with no validation and no fallback. When the runner has meanwhile been removed server-side (GitHub prunes runners offline >14 days; manual deletion), the stored credentials are dead and the container crash-loops forever, even though a valid ACCESS_TOKEN is in the environment the whole time.

This is the failure mode that has repeatedly taken down the Bump CI runners after image updates: container recreation → stale persisted registration → restart loop until someone wipes the volume or redeploys by hand.

Fix

A thin preflight entrypoint that runs before the upstream one:

• Only acts when CONFIGURED_ACTIONS_RUNNER_FILES_DIR is set, .runner exists, and ACCESS_TOKEN is present.
• Reads agentId from the persisted .runner (BOM-tolerant) and asks GitHub whether that runner still exists (org and repo scopes; enterprise left as-is).
• HTTP 404 → wipes .runner / .credentials / .credentials_rsaparams from the persist dir, so the upstream entrypoint falls through to fresh ACCESS_TOKEN registration and stores the new credentials back.
• HTTP 200 → reuse as before. Anything else (transient errors, bad scopes, missing env) → leave untouched. Behavior is never worse than upstream.

Declaring ENTRYPOINT resets the base image's inherited CMD, so the base CMD is restated verbatim.

Testing

• bash -n + shellcheck clean.
• Functional test with mocked curl/parent-entrypoint: 200 keeps credentials, 404 deletes all three files then execs parent, 503 leaves untouched, missing ACCESS_TOKEN no-ops, repo-scope URL parsing verified, args pass through to the parent CMD.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a preflight wrapper entrypoint to validate (via GitHub API) whether a persisted runner registration is still valid before the upstream entrypoint reuses it, preventing crash-loops caused by stale .runner credentials and enabling automatic re-registration when the runner was deleted/pruned server-side.

Changes:

• Introduces preflight-entrypoint.sh to detect persisted registrations, query runner existence (org/repo scopes), and wipe persisted credentials only on definitive 404s.
• Updates Dockerfile to install the preflight entrypoint as the image ENTRYPOINT and restate the base image CMD.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
preflight-entrypoint.sh	Adds a startup preflight that validates persisted runner registrations and wipes dead credentials on HTTP 404 to allow fresh registration.
Dockerfile	Switches to the preflight entrypoint and reasserts the base CMD so runtime behavior remains consistent aside from the preflight.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.