Runner image is not pinned on GitLab

[hannes-ucsc]

While the 3rd party base image is pinned, we don't pin the runner image we build from that base image. The build refers to that image using the latest tag. The image is typically built locally from the Azul source by an operator but whoever pushes the image last will win, no matter from what commit they build from.

[dsotirho-ucsc]

Assignee to consider next steps.

[hannes-ucsc]

The default runner image is currently configured in the runner's config.toml but can be overridden in .gitlab-ci.yml. The former is tracked in a separate Git repo to which only the system administrator has access. We should remove the setting from config.toml and instead specify a fully qualified image reference in .gitlab-ci.yml where the image is used and in terraform/gitlab/runner/Makefile where the image is built and pushed. We need to figure out a way to consolidate both references. We could try environment.boot but it is not clear if GitLab can be made to read such a file before it launches the first job. The inclusion mechanisms are documented here. We could also have the Makefile parse .gitlab-ci.yml to extract the hard-coded reference from there.

The registry the image is pushed to is associated with the project on GitLab. It would be good to restrict push access to operators, i.e., maintainers of the project.