[lightningspirit]

Summary

The runners can use a GitHub App instead of a PAT. An App belongs to the org, has no expiration date, and does not stop working when a user leaves.

• start.sh: when APP_ID and APP_PRIVATE_KEY_FILE are set, it makes a JWT (RS256, valid for 9 minutes) with openssl, gets an installation token (valid for 1 hour) and uses it like the PAT for the registration and removal tokens. APP_INSTALLATION_ID is optional: if it is not set, the runner gets it from GET /orgs/{org}/installation.
• The PAT (ACCESS_TOKEN_FILE) still works. If both are set, the App has priority. With neither, the script stops with a clear message.
• The key is read with sudo, like the PAT, so a 0600 Compose secret works.
• tests/app-jwt.sh: checks the header, the claims (iss, iat, exp, max. 10 minutes) and the RS256 signature with a new key. Runs in the sysbox job.
• README: App setup (only Self-hosted runners: Read and write) and a docker-compose.override.yml example with secrets: !override.
• Dockerfile: openssl in the apt-get list (already in the base image). .gitignore: *.pem.

Test plan

• shellcheck: no findings.
• JWT test in the runner image: header, claims and signature OK.
• No authentication set: clear error message.
• Unknown App ID (key 0600, other owner): GitHub refuses it, and the runner stops with the clear error.
• README override: docker compose config mounts only github_app-key.
• CI sysbox job passes.
• x1-hel1: create the App, switch with the override, and check that the runners register and a job runs.

🤖 Generated with Claude Code