Reducing GitHub Actions Minutes with Self-Hosted Runners

# values.yaml — gha-runner-scale-set Helm chart (ARC 0.9+)

# Point at your repository or organisation; replace with your actual URL.
githubConfigUrl: "https://github.com/YOUR_ORG/YOUR_REPO"

# Secret created in the next section; must contain githubToken or app credentials.
githubConfigSecret: arc-runner-secret

# Start with zero runners; ARC provisions on demand as jobs queue.
minRunners: 0

# Upper bound — set to match your max concurrent PR builds.
maxRunners: 12

# Runner process isolation: each job gets a fresh container, preventing
# host OS environment leakage and secrets cross-contamination.
containerMode:
  type: "kubernetes"

template:
  spec:
    # Run the runner container as non-root for host security.
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
    containers:
      - name: runner
        # Use a pre-baked image with Node.js 20, Docker CLI, and Playwright
        # browsers pre-installed to eliminate cold-start installation time.
        image: ghcr.io/actions/actions-runner:latest
        resources:
          requests:
            cpu: "1"
            memory: "2Gi"
          limits:
            cpu: "4"
            memory: "8Gi"
        env:
          # Hook fires before each job; use it to warm caches or set env.
          - name: ACTIONS_RUNNER_HOOK_JOB_STARTED
            value: /hooks/job-started.sh
        volumeMounts:
          # Shared NFS/EFS volume keeps node_modules between ephemeral runners.
          - name: npm-cache
            mountPath: /home/runner/.npm
    volumes:
      - name: npm-cache
        persistentVolumeClaim:
          claimName: runner-npm-cache-pvc

# .github/workflows/build.yml — changed runs-on only; rest of your workflow is unchanged.
jobs:
  build:
    # Replace "ubuntu-latest" with the scale-set name you give the Helm release.
    runs-on: [self-hosted, frontend-build]
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@v4
      - name: Cache node_modules
        uses: actions/cache@v4
        with:
          path: ~/.npm
          # Hash includes both package-lock.json and the runner OS to prevent
          # cross-platform cache collisions.
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

# List the ten most-recent workflow runs with their billable duration.
gh api repos/{owner}/{repo}/actions/runs \
  --jq '.workflow_runs[:10] | .[] | {name: .name, conclusion: .conclusion, run_minutes: .run_attempt}' \
  || { echo "API rate limit exceeded or auth failed"; exit 1; }

# Export billable usage by job name for the current billing period.
gh api /orgs/{org}/settings/billing/actions \
  --jq '{included_minutes: .included_minutes, total_paid_minutes: .total_paid_minutes_used}'

# Create the namespace and secret once.
kubectl create namespace arc-systems

kubectl create secret generic arc-runner-secret \
  --namespace arc-systems \
  --from-literal=githubToken="ghp_YOUR_PAT_HERE" \
  || { echo "Secret creation failed — check namespace exists"; exit 1; }

# Install the ARC controller (manages the scale sets).
helm install arc \
  --namespace arc-systems \
  oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller \
  || { echo "ARC controller install failed"; exit 1; }

# Install the scale set using your values.yaml above.
# The release name ("frontend-build") becomes the runs-on label in your workflow.
helm install frontend-build \
  --namespace arc-systems \
  -f values.yaml \
  oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set \
  || { echo "Scale set install failed — check values.yaml syntax"; exit 1; }

- name: Restore npm cache from volume
  uses: actions/cache@v4
  with:
    path: /home/runner/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-npm-

# 1. Confirm runners registered and are visible to ARC.
kubectl get autoscalingrunnerset -n arc-systems
# Expected: NAME=frontend-build, DESIRED=0 (idle), READY=0

# 2. Trigger a workflow run and watch pods scale up.
kubectl get pods -n arc-systems --watch
# Expected: runner-pod-XXXX transitions Running → Completed within your SLO window.

# 3. Verify the runner appeared in GitHub's runner list.
gh api repos/{owner}/{repo}/actions/runners \
  --jq '.runners[] | {name: .name, status: .status, labels: [.labels[].name]}'
# Expected: at least one runner with status=online and label "frontend-build".

# 4. Check cache hit rate on a re-run (should be >80% after the first warm run).
gh run view --log <run-id> | grep "Cache hit"
# Expected line: "Cache restored successfully from key: Linux-npm-..."

# Verify the secret has the correct key name.
kubectl get secret arc-runner-secret -n arc-systems -o jsonpath='{.data}' | jq 'keys'
# Must include "githubToken" (exact case).

# Re-create with the correct key if wrong.
kubectl delete secret arc-runner-secret -n arc-systems
kubectl create secret generic arc-runner-secret \
  --namespace arc-systems \
  --from-literal=githubToken="ghp_VALID_TOKEN"

gh api repos/{owner}/{repo}/actions/runners \
  --jq '.runners[] | {name: .name, access_level: .access_level}'
# access_level must be "repository", not "organization".