Register: add --token-file flag

At the moment, the only way to pass the secret Gitea token to the
runner CLI is directly through a CLI parameter. That's an issue on a
multi-user system where the CLI parameters are world-readable through
/proc/PID/cmdline. On a Linux system, there's sadly no way to hide the
cmdline parameters.

We usually go around this limitation by storing the secrets in a file
and protect it through tight ACL rules. Adding a way to inject the
secret token via a file during the register command.

As a nice side-effect, this improves the systemd integration by
allowing us to directly use the LoadCredential mechanism.

internal/app/cmd/cmd.go

@@ -37,6 +37,7 @@ func Execute(ctx context.Context) {
 	registerCmd.Flags().BoolVar(&regArgs.NoInteractive, "no-interactive", false, "Disable interactive mode")
 	registerCmd.Flags().StringVar(&regArgs.InstanceAddr, "instance", "", "Gitea instance address")
 	registerCmd.Flags().StringVar(&regArgs.Token, "token", "", "Runner token")
+	registerCmd.Flags().StringVar(&regArgs.TokenFile, "token-file", "", "Path to a file containing the runner token")
 	registerCmd.Flags().StringVar(&regArgs.RunnerName, "name", "", "Runner name")
 	registerCmd.Flags().StringVar(&regArgs.Labels, "labels", "", "Runner tags, comma separated")
 	rootCmd.AddCommand(registerCmd)

internal/app/cmd/register.go

@@ -73,6 +73,7 @@ type registerArgs struct {
 	NoInteractive bool
 	InstanceAddr  string
 	Token         string
+	TokenFile     string
 	RunnerName    string
 	Labels        string
 }
@@ -250,13 +251,26 @@ func printStageHelp(stage registerStage) {
 }
 
 func registerNoInteractive(ctx context.Context, configFile string, regArgs *registerArgs) error {
+	var token string
 	cfg, err := config.LoadDefault(configFile)
 	if err != nil {
 		return err
 	}
+	if regArgs.Token == "" && regArgs.TokenFile == "" {
+		return fmt.Errorf("Missing Token argument. token or token-file should be set.")
+	}
+	if regArgs.TokenFile != "" {
+		token_bytes, err := os.ReadFile(regArgs.TokenFile)
+		if err != nil {
+			return fmt.Errorf("Cannot read the token file: %s", regArgs.TokenFile, err)
+		}
+		token = string(token_bytes)
+	} else {
+		token = regArgs.Token
+	}
 	inputs := &registerInputs{
 		InstanceAddr: regArgs.InstanceAddr,
-		Token:        regArgs.Token,
+		Token:        token,
 		RunnerName:   regArgs.RunnerName,
 		Labels:       defaultLabels,
 	}