feat: add GitLab runner provider

.dockerignore

@@ -0,0 +1,5 @@
+.git
+/tmp/
+ci-runner-farm.tgz
+docs/sessions
+*.err

.github/workflows/lint.yml

@@ -1,8 +1,8 @@
 name: Lint
 
-# Fast static gate for the plugin: shell syntax, PHP syntax, and the config-parity
-# guard (engine / default.cfg / UI $defaults must agree — see tests/config-parity.sh).
-# No build or runtime; complements package-plugins.yml.
+# Linux gate for syntax, config/provider contracts, fork release safety, safe
+# paths, and a temporary package build. The same entry point is available to
+# local developers through tests/run-linux-checks.sh.
 
 on:
   pull_request:
@@ -20,38 +20,16 @@ concurrency:
 
 jobs:
   lint:
-    name: Shell + PHP syntax and config parity
+    name: Repository checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           persist-credentials: false
 
-      - name: Shell syntax (bash -n)
-        run: |
-          set -e
-          # *.sh always; plus the extension-less shell scripts Unraid runs from nchan/
-          # and event/ (lint the ones with a shell shebang, skip any non-shell helper).
-          for f in $(git ls-files '*.sh'); do echo "bash -n $f"; bash -n "$f"; done
-          for f in $(git ls-files 'src/usr/local/emhttp/plugins/*/nchan/*' 'src/usr/local/emhttp/plugins/*/event/*'); do
-            case "$(head -1 "$f" 2>/dev/null)" in '#!'*sh*) echo "bash -n $f"; bash -n "$f" ;; esac
-          done
+      - name: Run repository checks
+        run: bash tests/check.sh
 
-      - name: PHP syntax (php -l)
-        run: |
-          set -e
-          # *.php plus the .page files, which are PHP under a small "key=val ... ---" header
-          # (php -l treats the header as literal text). RunnerFarmSettings.page holds the
-          # $defaults array, so a syntax error there must not slip past this gate.
-          for f in $(git ls-files '*.php' 'src/usr/local/emhttp/plugins/*/*.page'); do
-            grep -q '<?php' "$f" || continue
-            echo "php -l $f"
-            php -l "$f"
-          done
-
-      - name: Config parity
-        run: bash tests/config-parity.sh
-
-      - name: Path guards
-        run: bash tests/safe-paths.sh
+      - name: Lint generated GitLab Runner configuration
+        run: bash tests/gitlab-runner-lint.sh

.github/workflows/release-please.yml

@@ -17,6 +17,9 @@ concurrency:
 
 jobs:
   release-please:
+    # Forks keep this workflow for upstream parity, but must never create a
+    # release PR, tag, release, or asset from their own main branch.
+    if: ${{ github.repository == 'unraid/ci-runner-farm' }}
     runs-on: ubuntu-latest
     outputs:
       pr: ${{ steps.release.outputs.pr || '' }}
@@ -34,7 +37,7 @@ jobs:
   # then commit it back onto the PR branch.
   prepare-plugin-release-pr:
     needs: release-please
-    if: ${{ needs.release-please.outputs.pr != '' }}
+    if: ${{ github.repository == 'unraid/ci-runner-farm' && needs.release-please.outputs.pr != '' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout release PR
@@ -72,7 +75,7 @@ jobs:
 
   validate-plugin-release:
     needs: release-please
-    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    if: ${{ github.repository == 'unraid/ci-runner-farm' && needs.release-please.outputs.release_created == 'true' }}
     uses: ./.github/workflows/release.yml
     with:
       tag: ${{ needs.release-please.outputs.tag_name }}
@@ -83,7 +86,7 @@ jobs:
     needs:
       - release-please
       - validate-plugin-release
-    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    if: ${{ github.repository == 'unraid/ci-runner-farm' && needs.release-please.outputs.release_created == 'true' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout release tag

.github/workflows/release.yml

@@ -22,6 +22,9 @@ permissions:
 
 jobs:
   release:
+    # A fork may push a v* tag or dispatch this workflow while developing. Keep
+    # upstream's release validation intact without treating fork tags as releases.
+    if: ${{ github.repository == 'unraid/ci-runner-farm' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout