refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/roles/gitea-runner/molecule/binary/converge.yml

@@ -1,12 +0,0 @@
----
-- name: Converge
-  hosts: all
-  become: true
-  vars:
-    gitea_url: "http://localhost:3000"
-    registration_token: "fake-token-for-testing"
-    runner_name: "molecule-test-runner"
-    runner_mode: "binary"
-    skip_runner_registration: true
-  roles:
-    - role: gitea-runner

ansible/roles/gitea-runner/molecule/binary/molecule.yml

@@ -1,39 +0,0 @@
----
-driver:
-  name: docker
-
-platforms:
-  - name: ${MOLECULE_PLATFORM_NAME:-ubuntu-2204}
-    image: ${MOLECULE_PLATFORM_IMAGE:-ubuntu:22.04}
-    command: ${MOLECULE_PLATFORM_COMMAND:-sleep infinity}
-    volumes:
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
-    cgroupns_mode: host
-    privileged: true
-    pre_build_image: false
-
-provisioner:
-  name: ansible
-  playbooks:
-    converge: converge.yml
-    prepare: ../common/prepare.yml
-  env:
-    ANSIBLE_ROLES_PATH: "../../.."
-
-scenario:
-  test_sequence:
-    - dependency
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    - idempotence
-    - side_effect
-    - verify
-    - cleanup
-    - destroy
-
-verifier:
-  name: ansible

ansible/roles/gitea-runner/molecule/binary/verify.yml

@@ -1,72 +0,0 @@
----
-- name: Verify
-  hosts: all
-  become: true
-  vars:
-    runner_name: "molecule-test-runner"
-  pre_tasks:
-    - name: Load role defaults
-      ansible.builtin.include_vars:
-        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
-    - name: Override runner mode for binary scenario
-      ansible.builtin.set_fact:
-        runner_mode: "binary"
-  tasks:
-    - name: Check gitea_runner binary exists
-      ansible.builtin.stat:
-        path: "{{ gitea_runner_binary_path }}"
-      register: gitea_runner_stat
-
-    - name: Assert gitea_runner binary exists
-      ansible.builtin.assert:
-        that:
-          - gitea_runner_stat.stat.exists
-        fail_msg: "gitea_runner binary is missing at {{ gitea_runner_binary_path }}"
-
-    - name: Check Docker is installed
-      ansible.builtin.command: docker --version
-      changed_when: false
-
-    - name: Check systemd template unit exists
-      ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-{{ runner_mode | default('docker') }}@.service"
-      register: service_stat
-
-    - name: Assert template unit exists
-      ansible.builtin.assert:
-        that:
-          - service_stat.stat.exists
-        fail_msg: "Systemd template unit is missing"
-
-    - name: Check instance data directory exists
-      ansible.builtin.stat:
-        path: "{{ gitea_runner_data_dir }}"
-      register: data_dir_stat
-
-    - name: Assert instance data directory exists
-      ansible.builtin.assert:
-        that:
-          - data_dir_stat.stat.exists
-        fail_msg: "Instance data directory is missing"
-
-    - name: Check prune timer exists
-      ansible.builtin.stat:
-        path: /etc/systemd/system/docker-prune.timer
-      register: timer_stat
-
-    - name: Assert prune timer exists
-      ansible.builtin.assert:
-        that:
-          - timer_stat.stat.exists
-        fail_msg: "Docker prune timer is missing"
-
-    - name: Check config file exists
-      ansible.builtin.stat:
-        path: "{{ gitea_runner_config_dir }}/config.yaml"
-      register: config_stat
-
-    - name: Assert config file exists
-      ansible.builtin.assert:
-        that:
-          - config_stat.stat.exists
-        fail_msg: "Config file is missing"

ansible/roles/gitea-runner/molecule/common/prepare.yml

@@ -19,16 +19,3 @@
       community.general.pacman:
         update_cache: true
       when: ansible_facts['os_family'] == 'Archlinux'
-
-    - name: Ensure /etc/docker directory exists
-      ansible.builtin.file:
-        path: /etc/docker
-        state: directory
-        mode: "0755"
-
-    - name: Configure Docker daemon for vfs storage driver (DinD)
-      ansible.builtin.copy:
-        dest: /etc/docker/daemon.json
-        content: |
-          {"storage-driver": "vfs"}
-        mode: "0644"

ansible/roles/gitea-runner/molecule/default/verify.yml

@@ -9,42 +9,39 @@
       ansible.builtin.include_vars:
         dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
-    - name: Check Docker is installed
-      ansible.builtin.command: docker --version
-      changed_when: false
+    - name: Check runner user exists
+      ansible.builtin.user:
+        name: "{{ gitea_runner_service_user }}"
+      register: user_info
+      check_mode: true
 
-    - name: Check runner image was pulled
-      ansible.builtin.command: docker images gitea/runner --format '{{ '{{' }} .Repository {{ '}}' }}:{{ '{{' }} .Tag {{ '}}' }}'
-      register: image_list
-      changed_when: false
-
-    - name: Assert runner image exists locally
+    - name: Assert runner user exists
       ansible.builtin.assert:
         that:
-          - "'gitea/runner' in image_list.stdout"
-        fail_msg: "Runner Docker image was not pulled"
+          - user_info.state == "present"
+        fail_msg: "Runner system user was not created"
 
-    - name: Check prune timer exists
+    - name: Check runner binary exists
       ansible.builtin.stat:
-        path: /etc/systemd/system/docker-prune.timer
-      register: timer_stat
+        path: "{{ gitea_runner_binary_path }}"
+      register: binary_stat
 
-    - name: Assert prune timer exists
+    - name: Assert runner binary exists
       ansible.builtin.assert:
         that:
-          - timer_stat.stat.exists
-        fail_msg: "Docker prune timer is missing"
+          - binary_stat.stat.exists
+        fail_msg: "Gitea runner binary is missing"
 
-    - name: Check systemd template unit exists
+    - name: Check systemd user service exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-{{ runner_mode | default('docker') }}@.service"
+        path: "{{ gitea_runner_home }}/.config/systemd/user/gitea-runner.service"
       register: service_stat
 
-    - name: Assert template unit exists
+    - name: Assert user service exists
       ansible.builtin.assert:
         that:
           - service_stat.stat.exists
-        fail_msg: "Systemd template unit is missing"
+        fail_msg: "Systemd user service is missing"
 
     - name: Check instance data directory exists
       ansible.builtin.stat:
@@ -57,9 +54,9 @@
           - data_dir_stat.stat.exists
         fail_msg: "Instance data directory is missing"
 
-    - name: Check config file exists in data directory
+    - name: Check config file exists in config directory
       ansible.builtin.stat:
-        path: "{{ gitea_runner_data_dir }}/config.yaml"
+        path: "{{ gitea_runner_config_dir }}/config.yaml"
       register: config_stat
 
     - name: Assert config file exists
@@ -67,3 +64,14 @@
         that:
           - config_stat.stat.exists
         fail_msg: "Config file is missing"
+
+    - name: Check prune timer exists
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_home }}/.config/systemd/user/docker-prune.timer"
+      register: timer_stat
+
+    - name: Assert prune timer exists
+      ansible.builtin.assert:
+        that:
+          - timer_stat.stat.exists
+        fail_msg: "Docker prune timer is missing"

ansible/roles/gitea-runner/molecule/deregister/side_effect.yml

@@ -4,12 +4,18 @@
   become: true
   vars:
     runner_name: "deregister-test-runner"
+  pre_tasks:
+    - name: Load role defaults
+      ansible.builtin.include_vars:
+        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
     - name: Ensure fake .runner file exists
       ansible.builtin.copy:
-        dest: "/var/lib/gitea-runner/{{ runner_name }}/.runner"
+        dest: "{{ gitea_runner_data_dir }}/.runner"
         content: |
           {"id": 1, "uuid": "test-uuid-1234", "name": "{{ runner_name }}", "address": "http://localhost:3000"}
+        owner: "{{ gitea_runner_service_user }}"
+        group: "{{ gitea_runner_service_user }}"
         mode: "0644"
 
 - name: Deregister runner
@@ -19,7 +25,6 @@
     runner_name: "deregister-test-runner"
     registration_token: "fake-token-for-testing"
     gitea_url: "http://localhost:3000"
-    runner_mode: "docker"
     skip_runner_registration: false
   tasks:
     - name: Include deregistration tasks

ansible/roles/gitea-runner/molecule/deregister/verify.yml

@@ -9,7 +9,7 @@
   tasks:
     - name: Check registration file was removed
       ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/deregister-test-runner/.runner"
+        path: "{{ gitea_runner_data_dir }}/.runner"
       register: runner_file_stat
 
     - name: Assert registration file no longer exists
@@ -18,13 +18,13 @@
           - not runner_file_stat.stat.exists
         fail_msg: "Registration file (.runner) was not removed by deregistration"
 
-    - name: Check systemd template still exists
+    - name: Check systemd user service still exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-{{ runner_mode | default('docker') }}@.service"
+        path: "{{ gitea_runner_home }}/.config/systemd/user/gitea-runner.service"
       register: service_stat
 
-    - name: Assert systemd template still exists after deregister
+    - name: Assert user service still exists after deregister
       ansible.builtin.assert:
         that:
           - service_stat.stat.exists
-        fail_msg: "Systemd template unit was incorrectly removed"
+        fail_msg: "Systemd user service was incorrectly removed"

ansible/roles/gitea-runner/molecule/lifecycle/side_effect.yml

@@ -5,24 +5,17 @@
   vars:
     runner_name: "lifecycle-test-runner"
   pre_tasks:
-    - name: Check if systemd is available
-      ansible.builtin.stat:
-        path: /run/systemd/system
-      register: systemd_available
+    - name: Load role defaults
+      ansible.builtin.include_vars:
+        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
-    - name: Stop gitea-runner systemd instance
-      ansible.builtin.systemd:
-        name: "gitea-runner-docker@{{ runner_name }}"
-        state: stopped
-        daemon_reload: true
-      when: systemd_available.stat.exists
+    - name: Stop gitea-runner user service
+      ansible.builtin.command: "sudo -u {{ gitea_runner_service_user }} systemctl --user stop gitea-runner"
+      changed_when: true
 
-    - name: Disable gitea-runner systemd instance
-      ansible.builtin.systemd:
-        name: "gitea-runner-docker@{{ runner_name }}"
-        enabled: false
-        daemon_reload: true
-      when: systemd_available.stat.exists
+    - name: Disable gitea-runner user service
+      ansible.builtin.command: "sudo -u {{ gitea_runner_service_user }} systemctl --user disable gitea-runner"
+      changed_when: true
 
 - name: Re-enable and start runner
   hosts: all
@@ -30,21 +23,14 @@
   vars:
     runner_name: "lifecycle-test-runner"
   pre_tasks:
-    - name: Check if systemd is available
-      ansible.builtin.stat:
-        path: /run/systemd/system
-      register: systemd_available
+    - name: Load role defaults
+      ansible.builtin.include_vars:
+        dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
-    - name: Enable gitea-runner systemd instance
-      ansible.builtin.systemd:
-        name: "gitea-runner-docker@{{ runner_name }}"
-        enabled: true
-        daemon_reload: true
-      when: systemd_available.stat.exists
+    - name: Enable gitea-runner user service
+      ansible.builtin.command: "sudo -u {{ gitea_runner_service_user }} systemctl --user enable gitea-runner"
+      changed_when: true
 
-    - name: Start gitea-runner systemd instance
-      ansible.builtin.systemd:
-        name: "gitea-runner-docker@{{ runner_name }}"
-        state: started
-        daemon_reload: true
-      when: systemd_available.stat.exists
+    - name: Start gitea-runner user service
+      ansible.builtin.command: "sudo -u {{ gitea_runner_service_user }} systemctl --user start gitea-runner"
+      changed_when: true

ansible/roles/gitea-runner/molecule/lifecycle/verify.yml

@@ -9,38 +9,20 @@
       ansible.builtin.include_vars:
         dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
-    - name: Check systemd template unit exists
+    - name: Check systemd user service exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-{{ runner_mode | default('docker') }}@.service"
-      register: template_stat
+        path: "{{ gitea_runner_home }}/.config/systemd/user/gitea-runner.service"
+      register: service_stat
 
-    - name: Assert template unit exists
+    - name: Assert user service exists
       ansible.builtin.assert:
         that:
-          - template_stat.stat.exists
-        fail_msg: "Systemd template unit is missing"
-
-    - name: Check if systemd is available
-      ansible.builtin.stat:
-        path: /run/systemd/system
-      register: systemd_available
-
-    - name: Check instance is enabled
-      ansible.builtin.systemd:
-        name: "gitea-runner-{{ runner_mode | default('docker') }}@lifecycle-test-runner"
-      register: service_status
-      when: systemd_available.stat.exists
-
-    - name: Assert instance is enabled
-      ansible.builtin.assert:
-        that:
-          - service_status.status.LoadState == 'loaded'
-        fail_msg: "Systemd instance is not loaded"
-      when: systemd_available.stat.exists
+          - service_stat.stat.exists
+        fail_msg: "Systemd user service is missing"
 
     - name: Check instance data directory exists after lifecycle
       ansible.builtin.stat:
-        path: "{{ gitea_runner_base_data_dir }}/{{ runner_name }}"
+        path: "{{ gitea_runner_data_dir }}"
       register: data_dir_stat
 
     - name: Assert instance data directory exists

ansible/roles/gitea-runner/molecule/multi-instance/converge.yml

@@ -6,7 +6,6 @@
     gitea_url: "http://localhost:3000"
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-runner-a"
-    runner_mode: "binary"
     skip_runner_registration: true
   roles:
     - role: gitea-runner
@@ -18,7 +17,6 @@
     gitea_url: "http://localhost:3000"
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-runner-b"
-    runner_mode: "binary"
     skip_runner_registration: true
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/multi-instance/verify.yml

@@ -6,24 +6,32 @@
     - name: Load role defaults
       ansible.builtin.include_vars:
         dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
-    - name: Override runner mode for multi-instance scenario
-      ansible.builtin.set_fact:
-        runner_mode: "binary"
   tasks:
-    - name: Check systemd template unit exists
+    - name: Check first runner user exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-{{ runner_mode | default('docker') }}@.service"
-      register: template_stat
+        path: "{{ gitea_runner_base_home }}/grm-molecule-runner-a"
+      register: home_a_stat
 
-    - name: Assert template unit exists
+    - name: Assert first runner user home exists
       ansible.builtin.assert:
         that:
-          - template_stat.stat.exists
-        fail_msg: "Systemd template unit is missing"
+          - home_a_stat.stat.exists
+        fail_msg: "First runner user home is missing"
+
+    - name: Check second runner user exists
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_base_home }}/grm-molecule-runner-b"
+      register: home_b_stat
+
+    - name: Assert second runner user home exists
+      ansible.builtin.assert:
+        that:
+          - home_b_stat.stat.exists
+        fail_msg: "Second runner user home is missing"
 
     - name: Check first instance data directory exists
       ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/molecule-runner-a"
+        path: "{{ gitea_runner_base_data_dir }}/molecule-runner-a"
       register: data_a_stat
 
     - name: Assert first instance data directory exists
@@ -34,7 +42,7 @@
 
     - name: Check second instance data directory exists
       ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/molecule-runner-b"
+        path: "{{ gitea_runner_base_data_dir }}/molecule-runner-b"
       register: data_b_stat
 
     - name: Assert second instance data directory exists
@@ -45,7 +53,7 @@
 
     - name: Check first instance config exists
       ansible.builtin.stat:
-        path: "/etc/gitea-runner/molecule-runner-a/config.yaml"
+        path: "{{ gitea_runner_base_config_dir }}/molecule-runner-a/config.yaml"
       register: config_a_stat
 
     - name: Assert first instance config exists
@@ -56,7 +64,7 @@
 
     - name: Check second instance config exists
       ansible.builtin.stat:
-        path: "/etc/gitea-runner/molecule-runner-b/config.yaml"
+        path: "{{ gitea_runner_base_config_dir }}/molecule-runner-b/config.yaml"
       register: config_b_stat
 
     - name: Assert second instance config exists

ansible/roles/gitea-runner/molecule/template-content/converge.yml

@@ -1,23 +1,11 @@
 ---
-- name: Converge Docker mode
+- name: Converge
   hosts: all
   become: true
   vars:
     gitea_url: "http://localhost:3000"
     registration_token: "fake-token-for-testing"
-    runner_name: "template-docker-runner"
-    skip_runner_registration: true
-  roles:
-    - role: gitea-runner
-
-- name: Converge Binary mode
-  hosts: all
-  become: true
-  vars:
-    gitea_url: "http://localhost:3000"
-    registration_token: "fake-token-for-testing"
-    runner_name: "template-binary-runner"
-    runner_mode: "binary"
+    runner_name: "template-test-runner"
     skip_runner_registration: true
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/template-content/verify.yml

@@ -2,65 +2,42 @@
 - name: Verify
   hosts: all
   become: true
+  vars:
+    runner_name: "template-test-runner"
   pre_tasks:
     - name: Load role defaults
       ansible.builtin.include_vars:
         dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
-    - name: Check Docker mode systemd template exists
+    - name: Check systemd user service exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-docker@.service"
-      register: docker_template_stat
+        path: "{{ gitea_runner_home }}/.config/systemd/user/gitea-runner.service"
+      register: service_stat
 
-    - name: Assert Docker mode systemd template exists
+    - name: Assert user service exists
       ansible.builtin.assert:
         that:
-          - docker_template_stat.stat.exists
-        fail_msg: "Docker systemd template is missing"
+          - service_stat.stat.exists
+        fail_msg: "Systemd user service is missing"
 
-    - name: Read rendered Docker systemd template
+    - name: Read rendered user service template
       ansible.builtin.slurp:
-        src: "/etc/systemd/system/gitea-runner-docker@.service"
-      register: docker_template
+        src: "{{ gitea_runner_home }}/.config/systemd/user/gitea-runner.service"
+      register: service_template
 
-    - name: Assert Docker mode template contains expected directives
+    - name: Assert user service template contains expected directives
       ansible.builtin.assert:
         that:
-          - "'Type=oneshot' in docker_template.content | b64decode"
-          - "'RemainAfterExit=yes' in docker_template.content | b64decode"
-          - "'Requires=docker.service' in docker_template.content | b64decode"
-          - "'docker run -d' in docker_template.content | b64decode"
-          - "'ExecStop=/usr/bin/docker stop' in docker_template.content | b64decode"
-          - "'Restart=on-failure' in docker_template.content | b64decode"
-        fail_msg: "Docker systemd template is missing expected directives"
-
-    - name: Check Binary mode systemd template exists
-      ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-binary@.service"
-      register: binary_template_stat
-
-    - name: Assert Binary mode systemd template exists
-      ansible.builtin.assert:
-        that:
-          - binary_template_stat.stat.exists
-        fail_msg: "Binary systemd template is missing"
-
-    - name: Read rendered Binary systemd template
-      ansible.builtin.slurp:
-        src: "/etc/systemd/system/gitea-runner-binary@.service"
-      register: binary_template
-
-    - name: Assert Binary mode template contains expected directives
-      ansible.builtin.assert:
-        that:
-          - "'Type=simple' in binary_template.content | b64decode"
-          - "'ExecStart={{ gitea_runner_binary_path }}' in binary_template.content | b64decode"
-          - "'Restart=on-failure' in binary_template.content | b64decode"
-        fail_msg: "Binary systemd template is missing expected directives"
+          - "'Type=simple' in service_template.content | b64decode"
+          - "'ExecStart={{ gitea_runner_binary_path }}' in service_template.content | b64decode"
+          - "'Restart=on-failure' in service_template.content | b64decode"
+          - "'DOCKER_HOST=unix:///run/user' in service_template.content | b64decode"
+          - "'XDG_RUNTIME_DIR=/run/user' in service_template.content | b64decode"
+        fail_msg: "User service template is missing expected directives"
 
     - name: Read rendered prune service template
       ansible.builtin.slurp:
-        src: "/etc/systemd/system/docker-prune.service"
+        src: "{{ gitea_runner_home }}/.config/systemd/user/docker-prune.service"
       register: prune_service
 
     - name: Assert prune service contains expected directives
@@ -69,17 +46,16 @@
           - "'Type=oneshot' in prune_service.content | b64decode"
           - "'docker system prune' in prune_service.content | b64decode"
           - "'docker volume prune' in prune_service.content | b64decode"
-          - "'label=gitea-runner=true' in prune_service.content | b64decode"
         fail_msg: "Prune service template is missing expected directives"
 
     - name: Read rendered prune timer template
       ansible.builtin.slurp:
-        src: "/etc/systemd/system/docker-prune.timer"
+        src: "{{ gitea_runner_home }}/.config/systemd/user/docker-prune.timer"
       register: prune_timer
 
     - name: Assert prune timer contains expected directives
       ansible.builtin.assert:
         that:
-          - "'OnCalendar=daily' in prune_timer.content | b64decode"
+          - "'OnCalendar={{ gitea_runner_prune_schedule }}' in prune_timer.content | b64decode"
           - "'Persistent=true' in prune_timer.content | b64decode"
         fail_msg: "Prune timer template is missing expected directives"

ansible/roles/gitea-runner/molecule/update/converge.yml

@@ -1,23 +1,11 @@
 ---
-- name: Converge Docker mode
+- name: Converge
   hosts: all
   become: true
   vars:
     gitea_url: "http://localhost:3000"
     registration_token: "fake-token-for-testing"
-    runner_name: "update-docker-runner"
-    skip_runner_registration: true
-  roles:
-    - role: gitea-runner
-
-- name: Converge Binary mode
-  hosts: all
-  become: true
-  vars:
-    gitea_url: "http://localhost:3000"
-    registration_token: "fake-token-for-testing"
-    runner_name: "update-binary-runner"
-    runner_mode: "binary"
+    runner_name: "update-test-runner"
     skip_runner_registration: true
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/update/side_effect.yml

@@ -1,24 +1,11 @@
 ---
-- name: Update Docker mode runner
+- name: Update runner
   hosts: all
   become: true
   vars:
-    runner_name: "update-docker-runner"
-    runner_mode: "docker"
+    runner_name: "update-test-runner"
   tasks:
-    - name: Include Docker update tasks
+    - name: Include update tasks
       ansible.builtin.include_role:
         name: gitea-runner
-        tasks_from: docker_update.yml
-
-- name: Update Binary mode runner
-  hosts: all
-  become: true
-  vars:
-    runner_name: "update-binary-runner"
-    runner_mode: "binary"
-  tasks:
-    - name: Include binary update tasks
-      ansible.builtin.include_role:
-        name: gitea-runner
-        tasks_from: binary_update.yml
+        tasks_from: update_runner.yml

ansible/roles/gitea-runner/molecule/update/verify.yml

@@ -2,23 +2,14 @@
 - name: Verify
   hosts: all
   become: true
+  vars:
+    runner_name: "update-test-runner"
   pre_tasks:
     - name: Load role defaults
       ansible.builtin.include_vars:
         dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
-    - name: Check Docker runner image still exists after update
-      ansible.builtin.command: docker images gitea/runner --format '{{ '{{' }} .Repository {{ '}}' }}:{{ '{{' }} .Tag {{ '}}' }}'
-      register: image_list
-      changed_when: false
-
-    - name: Assert runner image exists after update
-      ansible.builtin.assert:
-        that:
-          - "'gitea/runner' in image_list.stdout"
-        fail_msg: "Runner Docker image missing after update"
-
-    - name: Check binary runner executable still exists after update
+    - name: Check runner binary still exists after update
       ansible.builtin.stat:
         path: "{{ gitea_runner_binary_path }}"
       register: binary_stat
@@ -27,48 +18,26 @@
       ansible.builtin.assert:
         that:
           - binary_stat.stat.exists
-        fail_msg: "Binary runner executable missing after update"
+        fail_msg: "Runner binary missing after update"
 
-    - name: Check Docker mode systemd template still exists
+    - name: Check systemd user service still exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-docker@.service"
-      register: docker_service_stat
+        path: "{{ gitea_runner_home }}/.config/systemd/user/gitea-runner.service"
+      register: service_stat
 
-    - name: Assert Docker mode systemd template still exists after update
+    - name: Assert user service exists after update
       ansible.builtin.assert:
         that:
-          - docker_service_stat.stat.exists
-        fail_msg: "Docker mode systemd template missing after update"
+          - service_stat.stat.exists
+        fail_msg: "Systemd user service missing after update"
 
-    - name: Check Binary mode systemd template still exists
+    - name: Check instance data directory still exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-binary@.service"
-      register: binary_service_stat
+        path: "{{ gitea_runner_data_dir }}"
+      register: data_stat
 
-    - name: Assert Binary mode systemd template still exists after update
+    - name: Assert data directory exists after update
       ansible.builtin.assert:
         that:
-          - binary_service_stat.stat.exists
-        fail_msg: "Binary mode systemd template missing after update"
-
-    - name: Check Docker mode data directory still exists
-      ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/update-docker-runner"
-      register: docker_data_stat
-
-    - name: Assert Docker mode data directory exists after update
-      ansible.builtin.assert:
-        that:
-          - docker_data_stat.stat.exists
-        fail_msg: "Docker runner data directory missing after update"
-
-    - name: Check Binary mode data directory still exists
-      ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/update-binary-runner"
-      register: binary_data_stat
-
-    - name: Assert Binary mode data directory exists after update
-      ansible.builtin.assert:
-        that:
-          - binary_data_stat.stat.exists
-        fail_msg: "Binary runner data directory missing after update"
+          - data_stat.stat.exists
+        fail_msg: "Runner data directory missing after update"