# 06 — Runner integration

## What you'll do

Tell the airgap `workspace-builder` where to find this repository and
have Flux reconcile the change.

## The single edit

Open the airgap runner's HelmRelease values file:

`apps/runwhen-env/airgap/runwhen-runner/helm.yaml`

Under `spec.values.workspaceBuilder.workspaceInfo.configMap.data.codeCollections`,
append one entry. Before:

```yaml
codeCollections:
- repoURL: http://rw-airgap-cc-catalog-svc.runwhen-env-airgap:8080/git/rw-cli-codecollection.git
  ref: main
```

After:

```yaml
codeCollections:
- repoURL: http://rw-airgap-cc-catalog-svc.runwhen-env-airgap:8080/git/rw-cli-codecollection.git
  ref: main
- repoURL: https://<gitea-token>@gitea.airgap.shared.runwhen.com/gitea-admin/simple-private-codecollection.git
  ref: main
```

The `<gitea-token>` value is a Gitea personal access token with at least
`read:repository` scope on the `simple-private-codecollection` repo.

Screenshot placeholder: `images/06-helm-yaml-diff.png` — annotated diff of
the two-line addition.

## What we intentionally did NOT change

- `runner.codeCollections` — the list of code collections whose Robot
  code is executed by worker pods. Because our private CC ships **no
  robots**, it never needs a runner worker. The runtime lives in the
  already-registered `rw-generic-codecollection`.
- Any secret configuration — we are using the fastest working option:
  the token embedded directly in the `repoURL`. This trades tidiness
  for zero setup complexity. See "Trade-offs" below.

## Trade-offs of token-in-URL (option B)

The token becomes visible to anyone with read access to the
`workspace-builder` `ConfigMap` — via `kubectl get cm workspace-builder
-o yaml` in the runner namespace, and to anyone reading the Flux repo.
That is acceptable for a **test** token you can rotate, but not
production hygiene.

Two better options once this example is working:

### Option A — cc-catalog proxy (production path)

Turn on runtime git sync in the platform-side cc-catalog service and add
a `simple-private-codecollection` slug there. The workspace-builder then
clones from the internal proxy URL (no token in ConfigMap):

```yaml
- repoURL: http://rw-airgap-cc-catalog-svc.runwhen-env-airgap:8080/git/simple-private-codecollection.git
  ref: main
```

That requires editing `apps/runwhen-env/airgap/runwhen-platform/helmrelease.yaml`
to (a) add the slug under `ccCatalog.config.sources[].codecollections`
and (b) enable `git.runtime_sync: true` with `git.auth.token_env`
pointing at a Kubernetes secret storing the Gitea token. Track that as a
follow-up.

### Option C — fix upstream

Patch `runwhen-local` to actually apply `authUser`/`authToken` in
[`code_collection.py`](https://github.com/runwhen-contrib/runwhen-local/blob/main/src/enrichers/code_collection.py)
`update_repo()`. Today those fields are parsed and stored on the
`CodeCollection` object but never applied to `Repo.clone_from()`. A
one-line fix to route through `git_utils.get_repo_url_with_auth()`. Then
you can pass `authUser`/`authToken` in `workspaceInfo.yaml` and reference
them as environment variables or literal values without leaking the
token.

## Trigger the change

The Flux `HelmRelease` for `runwhen-local` reconciles every 5 minutes,
but you can force it:

```bash
flux reconcile hr runwhen-local -n runwhen-env-airgap-runner --with-source
```

Watch for the reconcile to complete:

```bash
kubectl -n runwhen-env-airgap-runner get pods -w
```

You should see the `runwhen-local` pod restart (because the ConfigMap
changed). Its next start will use the new `workspaceInfo`.

## Verify the workspace-builder can reach Gitea

```bash
kubectl -n runwhen-env-airgap-runner exec deploy/runwhen-local -c workspace-builder -- \
  curl -sSI --max-time 5 https://gitea.airgap.shared.runwhen.com/ | head -1
```

Expected: `HTTP/2 200` or `HTTP/1.1 200 OK`. If the request hangs, check
`NetworkPolicy` — the airgap deps namespace should already permit this
traffic on 443.

Screenshot placeholder: `images/06-curl-gitea.png`.

## Next

Continue to [07 — Validate and observe](07-validate-and-observe.md).