From a8931aeca8fb3d6df2ec5b41061d3af30b6e7582 Mon Sep 17 00:00:00 2001
From: moilanik <niko.moilanen@tietoevry.com>
Date: Sat, 27 Jun 2026 03:03:30 +0300
Subject: [PATCH 1/6] =?UTF-8?q?v=C3=A4litet=C3=A4=C3=A4n=20opt=20extra=20p?=
 =?UTF-8?q?aram,=20ett=C3=A4=20esim.=20helm=20build=20onnnistuu=20gitops?=
 =?UTF-8?q?=20repossa?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/gitops-dispatch.yml |  7 ++++++-
 scripts/gitops-dispatch.sh           |  3 ++-
 scripts/gitops-update.sh             |  7 ++++++-
 skills/gitops-update/SKILL.md        | 28 ++++++++++++++++++++++++++--
 4 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/gitops-dispatch.yml b/.gitea/workflows/gitops-dispatch.yml
index 6f763d4..6a88400 100644
--- a/.gitea/workflows/gitops-dispatch.yml
+++ b/.gitea/workflows/gitops-dispatch.yml
@@ -17,6 +17,9 @@ on:
       GITOPS_REPO:
         required: true
         type: string
+      GITOPS_EXTRA_CMD:
+        required: false
+        type: string
     secrets:
       GITOPS_DISPATCH_TOKEN:
         required: true
@@ -34,6 +37,7 @@ env:
   GITOPS_SOURCE_COMMIT: ${{ github.sha }}
   GITEA_API_URL: ${{ fromJson(inputs.env_json).GITEA_API_URL }}
   GITOPS_TAG_PREFIX: ${{ fromJson(inputs.env_json).GIT_TAG_PREFIX || '' }}
+  GITOPS_EXTRA_CMD: ${{ inputs.GITOPS_EXTRA_CMD || '' }}
   GITOPS_WORKFLOW: gitops-service.yaml
   GITOPS_DISPATCH_TIMEOUT: 30
 
@@ -61,7 +65,8 @@ jobs:
             --arg source_repo "$GITOPS_SOURCE_REPO" \
             --arg source_commit "$GITOPS_SOURCE_COMMIT" \
             --arg git_tag_prefix "${GITOPS_TAG_PREFIX:-}" \
-            '{dispatch_id: $dispatch_id, file: $file, yq_tpl: $yq_tpl, version: $version, source_repo: $source_repo, source_commit: $source_commit, git_tag_prefix: $git_tag_prefix}')
+            --arg extra_cmd "${GITOPS_EXTRA_CMD:-}" \
+            '{dispatch_id: $dispatch_id, file: $file, yq_tpl: $yq_tpl, version: $version, source_repo: $source_repo, source_commit: $source_commit, git_tag_prefix: $git_tag_prefix, extra_cmd: $extra_cmd}')
           curl -s -X POST \
             "${GITEA_API_URL}/api/v1/repos/${GITOPS_REPO}/actions/workflows/${GITOPS_WORKFLOW}/dispatches" \
             -H "Authorization: token $GITEA_TOKEN" \
diff --git a/scripts/gitops-dispatch.sh b/scripts/gitops-dispatch.sh
index c5dce72..9819ebe 100644
--- a/scripts/gitops-dispatch.sh
+++ b/scripts/gitops-dispatch.sh
@@ -22,7 +22,8 @@ INPUTS=$(jq -nc \
   --arg source_repo "$GITOPS_SOURCE_REPO" \
   --arg source_commit "$GITOPS_SOURCE_COMMIT" \
   --arg git_tag_prefix "${GITOPS_TAG_PREFIX:-}" \
-  '{file: $file, yq_tpl: $yq_tpl, version: $version, source_repo: $source_repo, source_commit: $source_commit, git_tag_prefix: $git_tag_prefix}')
+  --arg extra_cmd "${GITOPS_EXTRA_CMD:-}" \
+  '{file: $file, yq_tpl: $yq_tpl, version: $version, source_repo: $source_repo, source_commit: $source_commit, git_tag_prefix: $git_tag_prefix, extra_cmd: $extra_cmd}')
 
 DIR="$(cd "$(dirname "$0")" && pwd)"
 echo "gitops-dispatch: dispatching to $GITOPS_REPO/$GITOPS_WORKFLOW..."
diff --git a/scripts/gitops-update.sh b/scripts/gitops-update.sh
index cc3410e..608c130 100755
--- a/scripts/gitops-update.sh
+++ b/scripts/gitops-update.sh
@@ -84,7 +84,12 @@ _gitops_update() {
 
   cd "${CLONE_DIR}" || _gitops_fail "Failed to enter clone directory"
   yq eval -i "${YQ_EXPR}" "${INPUT_FILE}" || _gitops_fail "Failed to update ${INPUT_FILE}"
-  git add "${INPUT_FILE}" || _gitops_fail "Failed to stage ${INPUT_FILE}"
+  if [ -n "${GITOPS_EXTRA_CMD:-}" ]; then
+    eval "${GITOPS_EXTRA_CMD}" || _gitops_fail "Extra command failed: ${GITOPS_EXTRA_CMD}"
+    git add -A || _gitops_fail "Failed to stage all changes"
+  else
+    git add "${INPUT_FILE}" || _gitops_fail "Failed to stage ${INPUT_FILE}"
+  fi
 
   if git diff --cached --quiet; then
     echo "No changes — ${INPUT_FILE} already at ${VERSION}"
diff --git a/skills/gitops-update/SKILL.md b/skills/gitops-update/SKILL.md
index 9b1e45d..991615e 100644
--- a/skills/gitops-update/SKILL.md
+++ b/skills/gitops-update/SKILL.md
@@ -56,6 +56,9 @@ on:
       git_tag_prefix:
         required: false
         type: string
+      extra_cmd:
+        required: false
+        type: string
 
 env:
   INPUT_FILE: ${{ inputs.file }}
@@ -66,6 +69,7 @@ env:
   GITOPS_REPO: ${{ github.repository }}
   GITEA_API_URL: ${{ gitea.server_url }}
   GIT_TAG_PREFIX: ${{ inputs.git_tag_prefix || '' }}
+  GITOPS_EXTRA_CMD: ${{ inputs.extra_cmd || '' }}
 
 jobs:
   update:
@@ -130,15 +134,35 @@ gitops-update:
 
 This single job handles: dispatch → poll → find commit SHA → set commit-status on your commit → produce `GITOPS_SUMMARY` output.
 
+To run extra commands (e.g. `helm dependency update`) after the version bump and before the commit:
+
+```yaml
+gitops-update:
+  needs: [load-config, check-version, helm-build-push]
+  if: success()
+  uses: niko/gitea-ci-library/.gitea/workflows/gitops-dispatch.yml@v1
+  secrets: inherit
+  with:
+    env_json: ${{ needs.load-config.outputs.env_json }}
+    version: ${{ needs.check-version.outputs.version }}
+    GITOPS_FILE: Chart.yaml
+    GITOPS_YQ_TPL: '(.dependencies[] | select(.name == "agent-platform-helm") | .version) = "{{VERSION}}"'
+    GITOPS_REPO: niko/agent-platform-gitops
+    GITOPS_EXTRA_CMD: helm dependency update
+```
+
+When `GITOPS_EXTRA_CMD` is set, the script runs it after `yq` and stages all changes (`git add -A`) instead of only the input file — so any files generated by the extra command (e.g. `Chart.lock`, `charts/`) are included in the commit.
+
 ### 2.3 Parameters
 
 | Input | Required | Description |
-|---|---|---|
+|---|---|---|---|
 | `env_json` | Yes | Config JSON with `GITEA_API_URL`, optional `GIT_TAG_PREFIX` (for multi-component repos) |
 | `version` | Yes | Version to write (e.g. `0.2.3`) |
 | `GITOPS_FILE` | Yes | Path in GitOps repo (e.g. `dev/Chart.yaml`) |
 | `GITOPS_YQ_TPL` | Yes | yq expression, `{{VERSION}}` is replaced at runtime |
 | `GITOPS_REPO` | Yes | GitOps repo slug (e.g. `niko/agent-platform-gitops`) |
+| `GITOPS_EXTRA_CMD` | No | Shell command to run after yq update, before git commit (e.g. `helm dependency update`) |
 
 ### 2.4 Output
 
@@ -177,7 +201,7 @@ report-summary:
 ## 4. What happens at runtime
 
 1. Consumer's `gitops-dispatch.yml` generates a unique `dispatch_id` and POSTs it to the GitOps repo
-2. GitOps workflow clones its own repo, applies `yq`, commits + pushes
+2. GitOps workflow clones its own repo, applies `yq`, runs `GITOPS_EXTRA_CMD` if set, then commits + pushes
 3. Consumer polls the GitOps repo's runs until the workflow completes
 4. Consumer lists recent commits and finds the matching one by commit message `"gitops: update version to X.Y.Z"`
 5. Consumer sets commit-status `gitops/{repo}[/{prefix}]` on its own commit with a link to the exact GitOps commit
-- 
2.52.0


From 0d28c3e865d1524dd8f498c81eeeab8f45c93f14 Mon Sep 17 00:00:00 2001
From: moilanik <niko.moilanen@tietoevry.com>
Date: Sat, 27 Jun 2026 03:09:37 +0300
Subject: [PATCH 2/6] =?UTF-8?q?gitops=20commit=20koodi=20commit=20tekij?=
 =?UTF-8?q?=C3=A4n=20nimiin?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/gitops-dispatch.yml | 10 +++++++++-
 scripts/gitops-dispatch.sh           |  4 +++-
 scripts/gitops-update.sh             |  4 ++--
 skills/gitops-update/SKILL.md        | 10 ++++++++++
 4 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/gitops-dispatch.yml b/.gitea/workflows/gitops-dispatch.yml
index 6a88400..42ef2bd 100644
--- a/.gitea/workflows/gitops-dispatch.yml
+++ b/.gitea/workflows/gitops-dispatch.yml
@@ -53,12 +53,20 @@ jobs:
           ID=$(date +%s | md5sum | head -c 8)
           echo "dispatch_id=$ID" >> "$GITHUB_OUTPUT"
 
+      - name: Resolve commit author
+        id: author
+        run: |
+          echo "name=$(git log -1 --format='%an')" >> "$GITHUB_OUTPUT"
+          echo "email=$(git log -1 --format='%ae')" >> "$GITHUB_OUTPUT"
+
       - name: Dispatch to GitOps repo
         env:
           GITEA_TOKEN: ${{ secrets.GITOPS_DISPATCH_TOKEN }}
         run: |
           INPUTS=$(jq -nc \
             --arg dispatch_id "${{ steps.gen.outputs.dispatch_id }}" \
+            --arg author_name "${{ steps.author.outputs.name }}" \
+            --arg author_email "${{ steps.author.outputs.email }}" \
             --arg file "$GITOPS_FILE" \
             --arg yq_tpl "$GITOPS_YQ_TPL" \
             --arg version "$GITOPS_VERSION" \
@@ -66,7 +74,7 @@ jobs:
             --arg source_commit "$GITOPS_SOURCE_COMMIT" \
             --arg git_tag_prefix "${GITOPS_TAG_PREFIX:-}" \
             --arg extra_cmd "${GITOPS_EXTRA_CMD:-}" \
-            '{dispatch_id: $dispatch_id, file: $file, yq_tpl: $yq_tpl, version: $version, source_repo: $source_repo, source_commit: $source_commit, git_tag_prefix: $git_tag_prefix, extra_cmd: $extra_cmd}')
+            '{dispatch_id: $dispatch_id, author_name: $author_name, author_email: $author_email, file: $file, yq_tpl: $yq_tpl, version: $version, source_repo: $source_repo, source_commit: $source_commit, git_tag_prefix: $git_tag_prefix, extra_cmd: $extra_cmd}')
           curl -s -X POST \
             "${GITEA_API_URL}/api/v1/repos/${GITOPS_REPO}/actions/workflows/${GITOPS_WORKFLOW}/dispatches" \
             -H "Authorization: token $GITEA_TOKEN" \
diff --git a/scripts/gitops-dispatch.sh b/scripts/gitops-dispatch.sh
index 9819ebe..85df4ea 100644
--- a/scripts/gitops-dispatch.sh
+++ b/scripts/gitops-dispatch.sh
@@ -23,7 +23,9 @@ INPUTS=$(jq -nc \
   --arg source_commit "$GITOPS_SOURCE_COMMIT" \
   --arg git_tag_prefix "${GITOPS_TAG_PREFIX:-}" \
   --arg extra_cmd "${GITOPS_EXTRA_CMD:-}" \
-  '{file: $file, yq_tpl: $yq_tpl, version: $version, source_repo: $source_repo, source_commit: $source_commit, git_tag_prefix: $git_tag_prefix, extra_cmd: $extra_cmd}')
+  --arg author_name "${GIT_USER_NAME:-}" \
+  --arg author_email "${GIT_USER_EMAIL:-}" \
+  '{file: $file, yq_tpl: $yq_tpl, version: $version, source_repo: $source_repo, source_commit: $source_commit, git_tag_prefix: $git_tag_prefix, extra_cmd: $extra_cmd, author_name: $author_name, author_email: $author_email}')
 
 DIR="$(cd "$(dirname "$0")" && pwd)"
 echo "gitops-dispatch: dispatching to $GITOPS_REPO/$GITOPS_WORKFLOW..."
diff --git a/scripts/gitops-update.sh b/scripts/gitops-update.sh
index 608c130..ea3678f 100755
--- a/scripts/gitops-update.sh
+++ b/scripts/gitops-update.sh
@@ -98,8 +98,8 @@ _gitops_update() {
     exit 0
   fi
 
-  git -c user.name="gitea-ci-bot" \
-      -c user.email="ci@keskikuja.site" \
+  git -c user.name="${GIT_USER_NAME:-gitea-ci-bot}" \
+      -c user.email="${GIT_USER_EMAIL:-ci@keskikuja.site}" \
       commit -m "[skip ci] gitops: update version to ${VERSION}" || _gitops_fail "Failed to commit"
   GITOPS_SHA="$(git rev-parse HEAD)"
   git push || _gitops_fail "Failed to push"
diff --git a/skills/gitops-update/SKILL.md b/skills/gitops-update/SKILL.md
index 991615e..11b99d6 100644
--- a/skills/gitops-update/SKILL.md
+++ b/skills/gitops-update/SKILL.md
@@ -59,6 +59,12 @@ on:
       extra_cmd:
         required: false
         type: string
+      author_name:
+        required: false
+        type: string
+      author_email:
+        required: false
+        type: string
 
 env:
   INPUT_FILE: ${{ inputs.file }}
@@ -70,6 +76,8 @@ env:
   GITEA_API_URL: ${{ gitea.server_url }}
   GIT_TAG_PREFIX: ${{ inputs.git_tag_prefix || '' }}
   GITOPS_EXTRA_CMD: ${{ inputs.extra_cmd || '' }}
+  GIT_USER_NAME: ${{ inputs.author_name || '' }}
+  GIT_USER_EMAIL: ${{ inputs.author_email || '' }}
 
 jobs:
   update:
@@ -153,6 +161,8 @@ gitops-update:
 
 When `GITOPS_EXTRA_CMD` is set, the script runs it after `yq` and stages all changes (`git add -A`) instead of only the input file — so any files generated by the extra command (e.g. `Chart.lock`, `charts/`) are included in the commit.
 
+By default the GitOps commit is made as `gitea-ci-bot`. To use the original commit author instead, the dispatch workflow resolves it automatically from the consumer repo — no extra config needed. Just ensure the GitOps repo's `gitops-service.yaml` template has the `author_name` and `author_email` inputs and env mappings.
+
 ### 2.3 Parameters
 
 | Input | Required | Description |
-- 
2.52.0


From 4bdb4f3d6a0a5e52f720e6fe00e6f782cb18a416 Mon Sep 17 00:00:00 2001
From: moilanik <niko.moilanen@tietoevry.com>
Date: Sat, 27 Jun 2026 03:32:28 +0300
Subject: [PATCH 3/6] kaikki ajot ilman dind konttia. docker ja helm ajot dind
 kontissa.

---
 .gitea/workflows/ci-container-build-push.yml |  2 +-
 .gitea/workflows/docker-build-push.yml       |  4 +-
 README.md                                    | 51 ++++++++++++++++----
 3 files changed, 44 insertions(+), 13 deletions(-)

diff --git a/.gitea/workflows/ci-container-build-push.yml b/.gitea/workflows/ci-container-build-push.yml
index 1091e6b..eca6612 100644
--- a/.gitea/workflows/ci-container-build-push.yml
+++ b/.gitea/workflows/ci-container-build-push.yml
@@ -23,7 +23,7 @@ on:
 
 jobs:
   build-push:
-    runs-on: ubuntu-latest
+    runs-on: docker
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.gitea/workflows/docker-build-push.yml b/.gitea/workflows/docker-build-push.yml
index 3ffff45..af9ddbd 100644
--- a/.gitea/workflows/docker-build-push.yml
+++ b/.gitea/workflows/docker-build-push.yml
@@ -32,7 +32,7 @@ concurrency:
 
 jobs:
   build-push:
-    runs-on: ubuntu-latest
+    runs-on: docker
     steps:
       - uses: actions/checkout@v4
       - uses: actions/checkout@v4
@@ -91,7 +91,7 @@ jobs:
           fi
 
   tag-commit:
-    runs-on: ubuntu-latest
+    runs-on: docker
     needs: [build-push]
     steps:
       - uses: actions/checkout@v4
diff --git a/README.md b/README.md
index 6ca81f5..a9f3974 100644
--- a/README.md
+++ b/README.md
@@ -141,7 +141,7 @@ kubectl create secret generic act-runner-token \
 
 ### 4. Helm install / upgrade
 
-Menee samalla komennolla. 
+Menee samalla komennolla.
 
 > Muista asettaa variables ennen ajoa.
 
@@ -151,58 +151,89 @@ ja sitä kautta Gitea ei tarvitse päivityksessä mitään temppuja.
 Päivityksen jälkeen muista tappaa pod (käynnistyy automaattisesti uudelleen), että lataa varmasti kaikki uudesta. Sillä ConfigMap tms eivät lataudu
 mikäli pod jatkaa ajamista.
 
+Klusterissa on kaksi StatefulSetiä, joilla on eri labelit:
+- **`act-runner`** — yleisrunneri ilman DinD:tä (label `ubuntu-latest`)
+- **`act-runner-docker`** — Docker-buildien runneri DinD:llä (label `docker`)
+
+Vain `docker-build-push.yml` ja `ci-container-build-push.yml` käyttävät `docker`-labelia.
+Kaikki muut workflowt (testit, lintit, helm-publish, gitops-dispatch) ajetaan `ubuntu-latest`-runnerilla,
+joka ei käynnistä turhaa Docker-daemonia.
+
 ```bash
 helm repo add gitea https://dl.gitea.com/charts
 helm repo update
 
+# 1. Yleisrunneri (ei DinD)
 helm upgrade --install act-runner gitea/actions \
   --set enabled=true \
   --set giteaRootURL="$GITEA_URL" \
   --set existingSecret=act-runner-token \
   --set existingSecretKey=token \
-  --set statefulset.replicas=3 \
+  --set statefulset.replicas=2 \
   --set statefulset.runner.tag=1.0.8 \
-  --set statefulset.dind.tag=29.5.2-dind \
   --set-string 'statefulset.runner.config=log:
   level: info
 cache:
-  enabled: false
+  enabled: true
+container:
+  require_docker: false' \
+  --namespace "$GITEA_ACTIONS_NAMESPACE" \
+  --create-namespace
+
+# 2. Docker-runner (DinD)
+helm upgrade --install act-runner-docker gitea/actions \
+  --set enabled=true \
+  --set giteaRootURL="$GITEA_URL" \
+  --set existingSecret=act-runner-token \
+  --set existingSecretKey=token \
+  --set statefulset.replicas=1 \
+  --set statefulset.runner.tag=1.0.8 \
+  --set statefulset.dind.tag=29.5.2-dind \
+  --set-string 'statefulset.runner.labels=docker' \
+  --set-string 'statefulset.runner.config=log:
+  level: info
+cache:
+  enabled: true
 container:
   require_docker: true
   docker_timeout: 300s' \
-  --namespace "$GITEA_ACTIONS_NAMESPACE" \
-  --create-namespace
+  --namespace "$GITEA_ACTIONS_NAMESPACE"
 ```
 
-path escapes from parent -bugi korjattiin Docker 29.5.2:ssa. Tämän teko aikana default on 29.5.1 — juuri tämän alle jäävä versio.
+`path escapes from parent` -bugi korjattiin Docker 29.5.2:ssa. Tämän teko aikana default on 29.5.1 — juuri tämän alle jäävä versio.
 
 Oletus-lokitaso on `debug` — suositeltu `info`. Näkee jobien aloitukset ja valmistumiset ilman konttikerrosten purkua (Downloading/Extracting-spämmiä). `debug` on tarpeen vain vianselvityksessä.
 
+`cache.enabled: true` nappaa image-cachen käyttöön — ilman sitä jokainen ajo lataa konttikuvat uudestaan.
+
 #### Docker (DinD)
 
 Helm chart deployaa DinD:n init-sidecarina (`docker:dind` samassa podissa).
 `require_docker: true` kytkee jobit siihen — erillistä DinD-asennusta ei tarvita.
+Vain Docker-runnerissa on tämä päällä.
 
 **DinD-tag pinottu:** `29.5.2-dind` (ei chart-oletusta). Docker 29.5.1 aiheuttaa act-runnerissa
 `path escapes from parent` -virheen job-kontin käynnistyksessä.
 
 Maven/npm-ajot käyttävät vain workflow'n `container:`-imagea; DinD tarvitaan vasta Docker-buildissä.
 
-### 3. Varmista
+### 5. Varmista
 
 ```bash
 kubectl get pods -n gitea-actions
 # → act-runner-runner-0  Running
+# → act-runner-docker-runner-0  Running
 
-kubectl exec -n gitea-actions act-runner-runner-0 -c dind -- docker version
+kubectl exec -n gitea-actions act-runner-docker-runner-0 -c dind -- docker version
 # → Server Version: 29.5.2 (tai uudempi)
 ```
 
-Gitean puolella runner ilmestyy Active-tilaan pienellä viiveellä:
+Gitean puolella runnerit ilmestyvät Active-tilaan pienellä viiveellä:
 
 ```
 Site Admin → Actions → Runners  (tai Org → Settings → Actions → Runners)
 # → act-runner-runner-0  Active  ubuntu-latest
+# → act-runner-docker-runner-0  Active  docker
 ```
 
 Tämän jälkeen `.gitea/workflows/ci.yml` triggeröityy automaattisesti pushista.
-- 
2.52.0


From c6fb2fee683dfe671ca80d625625eb14b1fc4540 Mon Sep 17 00:00:00 2001
From: moilanik <niko.moilanen@tietoevry.com>
Date: Sat, 27 Jun 2026 03:38:57 +0300
Subject: [PATCH 4/6] runner label

---
 README.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index a9f3974..9f12002 100644
--- a/README.md
+++ b/README.md
@@ -189,14 +189,16 @@ helm upgrade --install act-runner-docker gitea/actions \
   --set statefulset.replicas=1 \
   --set statefulset.runner.tag=1.0.8 \
   --set statefulset.dind.tag=29.5.2-dind \
-  --set-string 'statefulset.runner.labels=docker' \
   --set-string 'statefulset.runner.config=log:
   level: info
 cache:
   enabled: true
 container:
   require_docker: true
-  docker_timeout: 300s' \
+  docker_timeout: 300s
+runner:
+  labels:
+    - "docker:docker://catthehacker/ubuntu:act-latest"' \
   --namespace "$GITEA_ACTIONS_NAMESPACE"
 ```
 
-- 
2.52.0


From cdad6acb6a897a09f3a220a4153cb4bb71f700d9 Mon Sep 17 00:00:00 2001
From: moilanik <niko.moilanen@tietoevry.com>
Date: Sat, 27 Jun 2026 03:45:53 +0300
Subject: [PATCH 5/6] foo

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 9f12002..2a20b8f 100644
--- a/README.md
+++ b/README.md
@@ -200,7 +200,7 @@ runner:
   labels:
     - "docker:docker://catthehacker/ubuntu:act-latest"' \
   --namespace "$GITEA_ACTIONS_NAMESPACE"
-```
+``` 
 
 `path escapes from parent` -bugi korjattiin Docker 29.5.2:ssa. Tämän teko aikana default on 29.5.1 — juuri tämän alle jäävä versio.
 
-- 
2.52.0


From 0e22d9e55332db0e3d0ec00719835d15f4fc6a7b Mon Sep 17 00:00:00 2001
From: moilanik <niko.moilanen@tietoevry.com>
Date: Sat, 27 Jun 2026 05:17:21 +0300
Subject: [PATCH 6/6] =?UTF-8?q?resursseja=20lis=C3=A4=C3=A4=20dind?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 2a20b8f..2953bf1 100644
--- a/README.md
+++ b/README.md
@@ -152,18 +152,18 @@ Päivityksen jälkeen muista tappaa pod (käynnistyy automaattisesti uudelleen),
 mikäli pod jatkaa ajamista.
 
 Klusterissa on kaksi StatefulSetiä, joilla on eri labelit:
-- **`act-runner`** — yleisrunneri ilman DinD:tä (label `ubuntu-latest`)
-- **`act-runner-docker`** — Docker-buildien runneri DinD:llä (label `docker`)
+- **`act-runner`** — yleisrunneri (label `ubuntu-latest`). DinD-sidecar on olemassa mutta idle — `require_docker: false` estää runneria käyttämästä sitä.
+- **`act-runner-docker`** — Docker-buildien runneri (label `docker`). DinD on aktiivinen, `require_docker: true`.
 
 Vain `docker-build-push.yml` ja `ci-container-build-push.yml` käyttävät `docker`-labelia.
-Kaikki muut workflowt (testit, lintit, helm-publish, gitops-dispatch) ajetaan `ubuntu-latest`-runnerilla,
-joka ei käynnistä turhaa Docker-daemonia.
+Kaikki muut workflowt (testit, lintit, helm-publish, gitops-dispatch) ajetaan `ubuntu-latest`-runnerilla.
+Steppien suoritus ei mene Docker Daemonin läpi, joten konekielisiä kontteja luodaan suoraan K8s-runtimella.
 
 ```bash
 helm repo add gitea https://dl.gitea.com/charts
 helm repo update
 
-# 1. Yleisrunneri (ei DinD)
+# 1. Yleisrunneri (DinD idle)
 helm upgrade --install act-runner gitea/actions \
   --set enabled=true \
   --set giteaRootURL="$GITEA_URL" \
@@ -171,6 +171,9 @@ helm upgrade --install act-runner gitea/actions \
   --set existingSecretKey=token \
   --set statefulset.replicas=2 \
   --set statefulset.runner.tag=1.0.8 \
+  --set statefulset.dind.tag=29.5.2-dind \
+  --set statefulset.dind.resources.requests.memory=250Mi \
+  --set statefulset.dind.resources.limits.memory=750Mi \
   --set-string 'statefulset.runner.config=log:
   level: info
 cache:
@@ -189,6 +192,8 @@ helm upgrade --install act-runner-docker gitea/actions \
   --set statefulset.replicas=1 \
   --set statefulset.runner.tag=1.0.8 \
   --set statefulset.dind.tag=29.5.2-dind \
+  --set statefulset.dind.resources.requests.memory=250Mi \
+  --set statefulset.dind.resources.limits.memory=750Mi \
   --set-string 'statefulset.runner.config=log:
   level: info
 cache:
@@ -210,12 +215,18 @@ Oletus-lokitaso on `debug` — suositeltu `info`. Näkee jobien aloitukset ja va
 
 #### Docker (DinD)
 
-Helm chart deployaa DinD:n init-sidecarina (`docker:dind` samassa podissa).
-`require_docker: true` kytkee jobit siihen — erillistä DinD-asennusta ei tarvita.
-Vain Docker-runnerissa on tämä päällä.
+> **Huomio:** Gitea 1.26.x ei tue vielä label-pohjaista runner-valintaa.
+> `runs-on: ubuntu-latest`-jobi saattaa päätyä `docker`-labeliselle runnerille.
+> Bugi on tunnettu Gitean FAQ:ssa — korjaus tulossa myöhemmässä versiossa.
+> Katso: [docs.gitea.com/usage/actions/faq](https://docs.gitea.com/usage/actions/faq)
 
-**DinD-tag pinottu:** `29.5.2-dind` (ei chart-oletusta). Docker 29.5.1 aiheuttaa act-runnerissa
-`path escapes from parent` -virheen job-kontin käynnistyksessä.
+Helm chart deployaa DinD:n init-sidecarina (`docker:dind` samassa podissa).
+Molemmissa StatefulSetissä on DinD-sidecar, mutta:
+- **`act-runner`**: `require_docker: false` → runner ei käytä DinD:tä lainkaan, steppien suoritus menee suoraan K8s-runtimella
+- **`act-runner-docker`**: `require_docker: true` → runner luo steppikontit DinD:n kautta (tarvitaan `docker build` -komentoja varten)
+
+**DinD-tag pinottu:** `29.5.2-dind` molemmissa (ei chart-oletusta `29.5.1-dind`). Docker 29.5.1 aiheuttaa act-runnerissa
+`path escapes from parent` -virheen job-kontin käynnistyksessä sekä `mkdirat var/run: file exists` -virheen tiedostojen kopioinnissa.
 
 Maven/npm-ajot käyttävät vain workflow'n `container:`-imagea; DinD tarvitaan vasta Docker-buildissä.
 
@@ -312,5 +323,7 @@ Tarkka asennus: [skills/gitops-update/SKILL.md](skills/gitops-update/SKILL.md)
 | `existingSecret` | Kubernetes secretin nimi, jossa token |
 | `existingSecretKey` | Avain secretin sisällä |
 | `statefulset.dind.tag` | DinD-image tag (`29.5.2-dind` minimi) |
+| `statefulset.dind.resources.requests.memory` | DinD muistirequest (suositus `250Mi`) |
+| `statefulset.dind.resources.limits.memory` | DinD muistilimitti (suositus `750Mi`) |
 | `statefulset.runner.labels` | Mukautetut labelit |
 
-- 
2.52.0