GitLab Runner已激活但不执行任务，求推荐排查步骤

问题场景 #

在MacOS上通过sudo权限注册了GitLab Runner，GitLab的Settings->CI/CD->Runners页面显示Runner已激活，但任务始终处于pending状态；且刚注册完成时Runner显示未激活，执行gitlab-runner verify后才变为激活状态。

使用的CI YAML配置：

stages:          # List of stages for jobs, and their order of execution
  - build
  - test
  - deploy

build-job:       # This job runs in the build stage, which runs first.
  stage: build
  script:
    - echo "Compiling the code..."
    - echo "Compile complete."

unit-test-job:   # This job runs in the test stage.
  stage: test    # It only starts when the job in the build stage completes successfully.
  script:
    - echo "Running unit tests... This will take about 60 seconds."
    - sleep 60
    - echo "Code coverage is 90%"

lint-test-job:   # This job also runs in the test stage.
  stage: test    # It can run at the same time as unit-test-job (in parallel).
  script:
    - echo "Linting code... This will take about 10 seconds."
    - sleep 10
    - echo "No lint issues found."

deploy-job:      # This job runs in the deploy stage.
  stage: deploy  # It only runs when *both* jobs in the test stage complete successfully.
  environment: production
  script:
    - echo "Deploying application..."
    - echo "Application successfully deployed."

注册命令：

sudo gitlab-runner register \
  --non-interactive \
  --executor "shell" \
  --url "https://gitlab.myorg.org/" \
  --registration-token "MY_TOKEN" \
  --description "runner-test" \
  --maintenance-note "Free-form maintainer notes about this runner" \
  --run-untagged="true" \
  --locked="false" \
  --access-level="not_protected"

1. 检查GitLab Runner服务状态 #

• 执行sudo gitlab-runner status确认服务是否在运行，若未运行则启动：sudo gitlab-runner start
• 实时监控Runner日志排查异常：sudo gitlab-runner run，或通过MacOS系统日志查看：log stream --predicate 'process == "gitlab-runner"'，重点关注连接失败、权限报错类信息

2. 验证Runner配置文件正确性 #

• 查看MacOS上默认配置文件路径：/etc/gitlab-runner/config.toml
• 核对文件内的url、token与注册参数是否完全一致，避免拼写错误
• 确认executor字段为shell，且shell配置（如默认bash）无异常

3. 排查Runner运行权限问题 #

• 由于使用sudo注册，Runner默认以gitlab-runner系统用户运行，切换至该用户测试基础命令：sudo su - gitlab-runner -s /bin/bash，尝试执行YAML中的echo、sleep等命令，确认无权限拦截
• 测试私有项目克隆权限：在gitlab-runner用户下手动克隆目标项目，验证是否能正常获取代码

4. 确认Runner与任务的标签匹配规则 #

• 虽然注册时设置了--run-untagged="true"，仍需检查项目CI/CD设置：进入Settings->CI/CD->Runners，确认“Run untagged jobs”选项已开启
• 检查YAML中所有job是否指定了tags字段，若有则Runner必须包含对应标签才能执行任务

5. 测试GitLab实例与Runner的网络连通性 #

• 在Runner机器上执行ping gitlab.myorg.org，确认网络链路通畅
• 测试HTTPS API访问：curl -v https://gitlab.myorg.org/api/v4/runners，若使用自签证书，需在config.toml中添加tls_ca_file = "/path/to/ca.crt"字段，或注册时追加--tls-ca-file="/path/to/ca.crt"参数

6. 重新注册并重置Runner #

• 停止当前Runner服务：sudo gitlab-runner stop
• 注销旧Runner：sudo gitlab-runner unregister --name runner-test
• 重新注册（可尝试不使用sudo，避免权限层级问题），完成后启动服务：gitlab-runner start

内容的提问来源于stack exchange，提问作者codesling