feat(ibmcloud): add GitHub Actions runner support for IBM Power and IBM Z

[deekay2310]

Integrate the existing pkg/integrations/github framework into the IBM Cloud providers so that mapt ibmcloud ibm-power create and mapt ibmcloud ibm-z create can provision VMs that auto-register as ephemeral GitHub Actions self-hosted runners.

Since no official runner binaries exist for ppc64le/s390x, arch-specific setup scripts clone action-runner-image-pz and build the runner from source on the target VM. A new --ghactions-runner-image-repo flag controls which repo is cloned (defaults to deekay2310 fork until the RHEL script merges to github.com/IBM/action-runner-image-pz).

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds GitHub Actions self-hosted runner provisioning for IBM Cloud PowerVS and Z systems. It introduces ppc64le and s390x architecture support via new type constants, CLI parameters, architecture-specific Bash setup scripts, and cloud-init integration for both IBM Power and IBM Z providers.

Changes

GitHub Actions runner multiarch support on IBM Cloud

Layer / File(s)	Summary
Type definitions and data contracts pkg/integrations/github/types.go, pkg/integrations/integrations.go	Arch constants extended with Ppc64le and S390x; GithubRunnerArgs and UserDataValues structs gain RunnerImageRepo string field.
CLI parameter wiring and architecture mapping cmd/mapt/cmd/params/params.go	GitHub runner image repository CLI flag registered and wired into GithubRunnerArgs; Linux-to-GitHub-Actions architecture mapping updated to handle ppc64le → GitHub Actions ppc64le and s390x → GitHub Actions s390x conversions.
GitHub runner setup snippets and template selection pkg/integrations/github/ghrunner.go, pkg/integrations/github/snippet-linux-ppc64le.sh, pkg/integrations/github/snippet-linux-s390x.sh	Embedded Bash provisioning scripts added for ppc64le (RHEL 9) and s390x (Ubuntu 22.04); architecture-specific snippet lookup map introduced; template selection updated to choose architecture-specific snippet on Linux when Arch is set, with fallback to platform snippet.
IBM Power create command architecture forcing cmd/mapt/cmd/ibmcloud/hosts/ibm-power.go	Imports GitHub integration; computes ghRunnerArgs locally, sets Arch to Ppc64le, and threads into provider context instead of re-fetching from params.
IBM Power provider GitHub runner integration pkg/provider/ibmcloud/action/ibm-power/ibm-power.go, pkg/provider/ibmcloud/action/ibm-power/cloud-config	deploy() renders GitHub runner cloud-init snippet when runner args present; threads script through both GitLab-token and no-GitLab code paths; piUserData signature extended with ghRunnerScript parameter; cloud-config template adds conditional write_files entry for /opt/install-ghrunner.sh and runcmd step to execute it.
IBM Power user-data test signature updates pkg/provider/ibmcloud/action/ibm-power/ibm-power_test.go	Three test cases updated to pass additional empty-string argument to piUserData matching new function signature.
IBM Z create command architecture forcing cmd/mapt/cmd/ibmcloud/hosts/ibm-z.go	Imports GitHub integration; computes ghRunnerArgs locally, sets Arch to S390x, and threads into provider context instead of re-fetching from params.
IBM Z provider GitHub runner integration pkg/provider/ibmcloud/action/ibm-z/ibm-z.go, pkg/provider/ibmcloud/action/ibm-z/cloud-config	buildUserDataInput renders GitHub runner snippet; threads script through GitLab-token, GitHub-only, and mixed scenarios; izUserData signature extended with ghRunnerScript parameter; cloud-config template adds conditional write_files entry and runcmd step for GitHub runner provisioning.
IBM Z user-data test signature updates pkg/provider/ibmcloud/action/ibm-z/ibm-z_test.go	Three test cases updated to pass additional empty-string argument to izUserData matching new function signature.

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description is directly related to the changeset, explaining the integration of GitHub runner framework into IBM Cloud providers and the architecture-specific setup approach.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and directly summarizes the main change: adding GitHub Actions runner support for IBM Power and IBM Z architectures in the ibmcloud provider.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

pkg/provider/ibmcloud/action/ibm-z/ibm-z_test.go (1)

40-55: 💤 Low value

Consider adding a test case for GitHub runner provisioning.

The existing tests verify GitLab runner and otelcol integration but don't cover the new GitHub Actions runner path. A test case calling izUserData(nil, "", " #!/bin/bash\n echo gh") and verifying install-ghrunner.sh appears in the decoded output would increase confidence in the template rendering.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/provider/ibmcloud/action/ibm-z/ibm-z_test.go` around lines 40 - 55, Add a
new unit test to cover the GitHub Actions runner path: create a test (e.g.,
TestIzUserData_githubRunner) that calls izUserData(nil, "", "      #!/bin/bash\n
echo gh") and fails if izUserData returns an error; decode the output with
decodeIzOutput(t, out) and assert the resulting cfg contains
"install-ghrunner.sh" (and optionally that it includes any expected
runcmd/write_files lines). Use the same helpers and style as
TestIzUserData_noRunner so the new test lives alongside it and verifies the
template renders the GitHub runner installer.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/integrations/github/snippet-linux-ppc64le.sh`:
- Around line 4-7: The RunnerImageRepo value risks executing arbitrary code
because it's embedded into snippet-linux-ppc64le.sh and snippet-linux-s390x.sh
(git clone {{ .RunnerImageRepo }} then bash -c '. scripts/vm.sh ...'); update
cmd/mapt/cmd/params/params.go and pkg/integrations/github/ghrunner.go to enforce
a safe trust model: either restrict the --ghactions-runner-image-repo flag to
admin-only (check caller permissions where flags are parsed/used in params.go),
add validation/allowlist logic in ghrunner.go to validate RunnerImageRepo
against a configured set of allowed hostnames/URLs before embedding into the
snippet, and if neither is possible add clear documentation and runtime warning
logs wherever RunnerImageRepo is accepted (and sanitize inputs to prevent
local-path/ssh/git-protocol abuses); reference the symbols RunnerImageRepo,
cmd/mapt/cmd/params/params.go, pkg/integrations/github/ghrunner.go, and the two
snippet files when making the change.

In `@pkg/integrations/github/snippet-linux-s390x.sh`:
- Around line 4-7: The template embeds an untrusted RunnerImageRepo directly
into shell commands (git clone {{ .RunnerImageRepo }} ... and bash -c '.
scripts/vm.sh ...'), which allows arbitrary repo URLs to be executed; fix by
enforcing validation or admin-only restriction where RunnerImageRepo is set:
implement a validateRunnerImageRepo(url) check for HTTPS scheme, host ==
"github.com" (or other approved host), and an allowlist of specific owner/repo
patterns (reject raw strings, file://, ssh, or IP hosts), call this validation
where the --ghactions-runner-image-repo flag is parsed and refuse/exit on
invalid values, and then continue to render RunnerImageRepo into
pkg/integrations/github/snippet-linux-s390x.sh only after validation (also
consider quoting the variable in the git clone command and running git clone
--depth=1 to limit exposure); alternatively restrict the flag to trusted
administrators and document the requirement for approved repositories.

---

Nitpick comments:
In `@pkg/provider/ibmcloud/action/ibm-z/ibm-z_test.go`:
- Around line 40-55: Add a new unit test to cover the GitHub Actions runner
path: create a test (e.g., TestIzUserData_githubRunner) that calls
izUserData(nil, "", "      #!/bin/bash\n      echo gh") and fails if izUserData
returns an error; decode the output with decodeIzOutput(t, out) and assert the
resulting cfg contains "install-ghrunner.sh" (and optionally that it includes
any expected runcmd/write_files lines). Use the same helpers and style as
TestIzUserData_noRunner so the new test lives alongside it and verifies the
template renders the GitHub runner installer.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 0708cbed-1d28-4c34-b06b-76c3e58bcb05

📥 Commits

Reviewing files that changed from the base of the PR and between a2f7a23 and c9a4b05.

📒 Files selected for processing (14)

• cmd/mapt/cmd/ibmcloud/hosts/ibm-power.go
• cmd/mapt/cmd/ibmcloud/hosts/ibm-z.go
• cmd/mapt/cmd/params/params.go
• pkg/integrations/github/ghrunner.go
• pkg/integrations/github/snippet-linux-ppc64le.sh
• pkg/integrations/github/snippet-linux-s390x.sh
• pkg/integrations/github/types.go
• pkg/integrations/integrations.go
• pkg/provider/ibmcloud/action/ibm-power/cloud-config
• pkg/provider/ibmcloud/action/ibm-power/ibm-power.go
• pkg/provider/ibmcloud/action/ibm-power/ibm-power_test.go
• pkg/provider/ibmcloud/action/ibm-z/cloud-config
• pkg/provider/ibmcloud/action/ibm-z/ibm-z.go
• pkg/provider/ibmcloud/action/ibm-z/ibm-z_test.go