#!/usr/bin/env bash
# Container entrypoint: register an EPHEMERAL runner, process exactly one job,
# exit. The host supervisor (ecd-runner-supervisor.sh) restarts a fresh container
# for the next job. The fine-grained PAT never enters this container — we receive
# only a short-lived registration token in RUNNER_TOKEN.
set -euo pipefail

: "${REPO:?REPO required (owner/repo)}"
: "${RUNNER_TOKEN:?RUNNER_TOKEN required (registration token)}"
: "${RUNNER_NAME:?RUNNER_NAME required}"
: "${RUNNER_LABELS:?RUNNER_LABELS required}"

cd /home/runner/actions-runner

./config.sh \
  --url "https://github.com/${REPO}" \
  --token "${RUNNER_TOKEN}" \
  --name "${RUNNER_NAME}" \
  --labels "${RUNNER_LABELS}" \
  --work _work \
  --ephemeral \
  --unattended \
  --replace

# With --ephemeral, run.sh runs one job, deregisters itself, then exits.
exec ./run.sh
