feat(gha-runner): custom ARC runner image with build tools

The minimal actions/actions-runner image lacks tools our g5t-uk workflows need
(make/build-essential for Makefile targets + Python C-extensions, libatomic1 for
pnpm, the docker compose plugin for compose smoke tests), so lint/test jobs fail
on the self-hosted runners.

Add an arm64-only gha-runner image (FROM actions/actions-runner + those packages),
built and published by the standard matrix (publish.yml) like every other image.
arm64-only because the ARC runners are aarch64.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mgarratt

images/gha-runner/Dockerfile

@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1
+# Custom GitHub Actions runner image for the g5t-uk ARC scale set.
+#
+# The upstream actions/actions-runner image is intentionally minimal and lacks
+# tools that ubuntu-latest ships and our workflows assume:
+#   make + build-essential -> Makefile targets and Python C-extension builds
+#   libatomic1             -> pnpm's prebuilt binary needs libatomic.so.1
+#   docker compose plugin  -> the `docker compose` subcommand (compose smoke tests)
+#
+# arm64-only: the cluster nodes (and therefore the runners) are aarch64.
+ARG RUNNER_VERSION=2.335.1
+FROM ghcr.io/actions/actions-runner:${RUNNER_VERSION}
+
+ARG COMPOSE_VERSION=v2.32.4
+
+USER root
+
+# hadolint ignore=DL3008
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      build-essential \
+      ca-certificates \
+      curl \
+      git \
+      jq \
+      libatomic1 \
+      make \
+ && rm -rf /var/lib/apt/lists/*
+
+# Docker Compose v2 as a CLI plugin (not packaged in the runner image). aarch64
+# binary into a standard cli-plugins search path so `docker compose` resolves.
+RUN mkdir -p /usr/local/lib/docker/cli-plugins \
+ && curl -fsSL "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-aarch64" \
+      -o /usr/local/lib/docker/cli-plugins/docker-compose \
+ && chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+
+USER runner

images/gha-runner/README.md

@@ -0,0 +1,17 @@
+# gha-runner
+
+Custom GitHub Actions runner image for the **g5t-uk ARC scale set** — the
+upstream `actions/actions-runner` plus the tools `ubuntu-latest` ships that the
+minimal image doesn't, so self-hosted lint/test jobs work:
+
+- `make` + `build-essential` — Makefile targets and Python C-extension builds
+- `libatomic1` — pnpm's prebuilt binary needs `libatomic.so.1`
+- the `docker compose` CLI plugin — compose-based smoke tests
+
+`arm64`-only (the runners are aarch64). Built and published by the standard
+matrix (`publish.yml`) like every other image, to
+`ghcr.io/mgarratt/docker-images/gha-runner`.
+
+The published package must be **public** so the ARC scale set can pull it without
+a secret; the `arc-runner-set` HelmRelease in the home cluster points its runner
+`image:` here.

images/gha-runner/image.toml

@@ -0,0 +1,6 @@
+image = "gha-runner"
+# arm64-only: the ARC scale-set runners are aarch64, so there is no amd64 runner
+# to schedule an amd64 variant on. The matrix passes these per-image platforms to
+# buildx.
+platforms = ["linux/arm64"]
+build_args = { RUNNER_VERSION = "2.335.1", COMPOSE_VERSION = "v2.32.4" }