# GitLab Runner (lab-ci)

CI for the shelf runs on a single GitLab Runner registered against
`git.reeseapps.com`.

- Executor: docker; the runner daemon lives on `rack7-pbx2`.
- Registration token format: `glrt-` plus 20 hex chars (rotated 2026-06).
- Tags: `lab-ci` (default) and `pve-upgrade` (the gated upgrade job).
- Job images: `ghcr.io/reese/lab-ci:2026.7` for ansible plays,
  `debian:13-slim` for lint.
- Concurrency is capped at 2; the `pve-upgrade` job never runs in
  parallel with itself.