ci: fix runner node

deploy/ansible/group_vars/all.yml

@@ -13,6 +13,11 @@ act_runner_sha256: "027d726127bb67e191d57052fdb66e74ec7f76966f790a18727147fa2b80
 act_runner_binary: "gitea-runner-{{ act_runner_version }}-linux-amd64"
 act_runner_download_url: "https://gitea.com/gitea/runner/releases/download/v{{ act_runner_version }}/{{ act_runner_binary }}"
 
+# Node.js major version installed on the host executor. JS actions
+# (actions/checkout@v4, etc.) are run with `node`; without it act_runner
+# fails with "Cannot find: node in PATH". Bump this to change versions.
+node_major_version: "26"
+
 # Registration tokens come from env vars named by each project's `token_env`
 # (e.g. RUNNER_TOKEN_GATEHOUSE_API). Export them on the control node before running.
 # Mint from: Gitea repo → Settings → Actions → Runners → Create new runner token.

deploy/ansible/install-runner.yml

@@ -20,6 +20,36 @@
         create_home: true
         home: "{{ runner_home }}"
 
+    # JS actions (actions/checkout@v4, etc.) execute with `node` on the host
+    # executor. Without it act_runner fails: "Cannot find: node in PATH".
+    # git is needed by checkout for its fetch step.
+    - name: Ensure git is present
+      ansible.builtin.apt:
+        name: git
+        state: present
+        update_cache: true
+
+    - name: Install Node.js {{ node_major_version }}.x (NodeSource)
+      block:
+        # Key is ASCII-armored, so store it as .asc — apt reads .gpg as binary
+        # and .asc as armored; a mismatch fails repo signature verification.
+        - name: Add NodeSource apt key
+          ansible.builtin.get_url:
+            url: https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key
+            dest: /usr/share/keyrings/nodesource.asc
+            mode: "0644"
+
+        - name: Add NodeSource apt repo
+          ansible.builtin.apt_repository:
+            repo: "deb [signed-by=/usr/share/keyrings/nodesource.asc] https://deb.nodesource.com/node_{{ node_major_version }}.x nodistro main"
+            filename: nodesource
+
+        - name: Install nodejs
+          ansible.builtin.apt:
+            name: nodejs
+            state: present
+            update_cache: true
+
     - name: Install runners for each project
       ansible.builtin.include_tasks: tasks/install_project.yml
       loop: "{{ runners }}"