Use runner-owned job workspaces

[gjkim42]

Summary

• Mount the job workspace volume at /workspace while placing the Git worktree at /workspace/repository.
• Let the non-root runner create and own the repository directory before checkout.
• Assert that generated runner Jobs keep the worktree below the mounted volume root.
• Exercise Git in a post-checkout e2e workflow step without leaking checkout's safe-directory configuration.

Root cause

Kubernetes creates the emptyDir mount root as root. The runner can write through its supplemental fsGroup, but Git requires the repository directory to be owned by the process UID. actions/checkout temporarily marks the path safe only for its own action process, so later run steps fail with dubious ownership.

Impact

Git commands work in subsequent workflow steps without disabling Git ownership checks, changing workflow files, requiring a privileged init container, or assuming a fixed runner UID. PR #9 remains the deployment smoke test.

Validation

• make verify
• make test
• go test -tags=e2e ./test/e2e -run '^$'
• Full Kind-based e2e test runs in PR CI

Release note

Fixed Git ownership errors in workflow steps after checkout on non-root runners.

[gjkim42]

/kelos claude-review

[kelos-bot]

🤖 Kelos Task Status

Task open-actions-claude-reviewer-issue-comment-abf9d52c88a6 has succeeded. ✅

[kelos-bot]

🤖 Open Actions Claude Reviewer Agent @gjkim42

Review Summary

Verdict: APPROVE
Overall correctness: patch is correct
Scope: Mounts the job workspace volume at /workspace while placing the Git worktree at /workspace/repository, so the non-root runner creates and owns the repository directory and later steps pass Git's ownership check.

Findings Overview

Priority	Count	File:Line	Summary
P0	0	—	none
P1	0	—	none
P2	1	test/fixture/github/main.go:90	e2e fixture masks the fixed ownership failure and no run step executes git
P3	1	cmd/open-actions-runner/main.go:24	Runner --workspace default still points at the volume mount root

Findings

Tests

• [P2] test/fixture/github/main.go:90 — The Kind e2e cannot catch a behavioral regression of this fix. The fixture checkout script runs git config --global --add safe.directory ${workspace}, which suppresses exactly the dubious-ownership condition this PR fixes, and the only subsequent run: step ("Verify runner context") executes go test but no git command. The new unit assertion in internal/controller/runner_controller_test.go only pins the --workspace=/workspace/repository string, not the ownership semantics, so a change that re-roots the worktree at a root-owned path (e.g. a manifest or fsGroup change) would ship green. Consider dropping the fixture's global safe.directory line — unnecessary now that the runner owns the worktree — and adding a git command such as git rev-parse --verify HEAD to the "Verify runner context" step, so the e2e fails with dubious ownership if the worktree ever lands on a root-owned directory again.

Suggestions (optional)

• [P3] cmd/open-actions-runner/main.go:24 — The --workspace flag default remains /workspace, which this PR establishes as the root-owned volume mount root that is unusable as a worktree in the deployed topology. The controller always passes the flag explicitly, so this is inert in production, but aligning the default with the deployed layout (/workspace/repository) would keep a bare open-actions-runner invocation inside the runner image from re-hitting the ownership failure.

Key takeaways

• The fix is minimal and mechanically sound: the runner's existing os.MkdirAll (internal/runner/runner.go:140) creates /workspace/repository owned by the runner UID via the fsGroup: 65532 setgid volume root, which satisfies Git's ownership check without safe.directory overrides, privileged init containers, or a fixed runner UID.
• GITHUB_WORKSPACE, the github.workspace expression context, and step working-directory resolution all derive from the same --workspace flag, so the layout change is consistent end to end; Job creation is create-only with AlreadyExists tolerated, so in-flight Jobs from an older controller are unaffected.
• The one real gap is e2e coverage: the fixture currently masks the failure mode this PR fixes, so the behavioral guarantee is untested.