add jobbuilder, code cleanup, try and use upstream spindle models

Kubernetes Operator for Github Actions Runner.md

···
-# Kubernetes Operator for Github Actions Runner
-Created at 2025-11-03 05:24:53 UTC
-
-> @ 2025-11-03 05:24:53 UTC
->
-> I want to implement a kubernetes operator similar to github actions runner controller. I want to primarily focus on the logic for spawning a “runner” container via jobs and polling logs as it’s processing. I also want to make sure i can build docker containers within these runners. And the jobs should have logic to target nodes based on os architecture. This is supposed to be a rough poc, i already have go logic that works for reading a yaml file and figuring out what workflow to run. It just needs to send that job/step to a job in kubes
-
-<details><summary>Thinking</summary>
-
-The user is asking for help implementing a Kubernetes operator similar to GitHub Actions runner controller. They want to:
-1. Spawn runner containers via Jobs
-2. Poll logs as it's processing
-3. Build docker containers within runners
-4. Target nodes based on OS architecture
-5. This is a rough POC and they already have Go logic to read YAML and figure out what workflow to run
-
-I'll provide a comprehensive answer covering the implementation of these requirements.
-
-</details>
-
-I'll help you implement a Kubernetes operator for spawning runner containers similar to GitHub Actions Runner Controller. Here's a comprehensive approach for your POC:
-
-## **Kubernetes Job Spawning Logic**
-
-Here's the core Go code structure for creating and managing Jobs:
-
-```go
-package operator
-
-import (
-    "context"
-    "fmt"
-    batchv1 "k8s.io/api/batch/v1"
-    corev1 "k8s.io/api/core/v1"
-    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-    "k8s.io/client-go/kubernetes"
-)
-
-type RunnerController struct {
-    clientset *kubernetes.Clientset
-    namespace string
-}
-
-func (rc *RunnerController) CreateRunnerJob(workflowID, stepName, stepCommand string, arch string) (*batchv1.Job, error) {
-    job := &batchv1.Job{
-        ObjectMeta: metav1.ObjectMeta{
-            Name:      fmt.Sprintf("runner-%s-%s", workflowID, stepName),
-            Namespace: rc.namespace,
-            Labels: map[string]string{
-                "workflow-id": workflowID,
-                "step-name":   stepName,
-                "type":        "runner",
-            },
-        },
-        Spec: batchv1.JobSpec{
-            Template: corev1.PodTemplateSpec{
-                ObjectMeta: metav1.ObjectMeta{
-                    Labels: map[string]string{
-                        "workflow-id": workflowID,
-                        "step-name":   stepName,
-                    },
-                },
-                Spec: corev1.PodSpec{
-                    RestartPolicy: corev1.RestartPolicyNever,
-                    NodeSelector: map[string]string{
-                        "kubernetes.io/arch": arch, // amd64, arm64, etc.
-                    },
-                    Containers: []corev1.Container{
-                        {
-                            Name:  "runner",
-                            Image: "docker:dind", // Docker in Docker image
-                            Command: []string{"/bin/sh", "-c"},
-                            Args:    []string{stepCommand},
-                            Env: []corev1.EnvVar{
-                                {
-                                    Name:  "DOCKER_HOST",
-                                    Value: "tcp://localhost:2375",
-                                },
-                            },
-                            VolumeMounts: []corev1.VolumeMount{
-                                {
-                                    Name:      "docker-graph-storage",
-                                    MountPath: "/var/lib/docker",
-                                },
-                            },
-                        },
-                        {
-                            Name:  "dind-daemon",
-                            Image: "docker:dind",
-                            Command: []string{"dockerd"},
-                            Args: []string{
-                                "--host=tcp://0.0.0.0:2375",
-                                "--storage-driver=overlay2",
-                            },
-                            SecurityContext: &corev1.SecurityContext{
-                                Privileged: &[]bool{true}[0],
-                            },
-                            VolumeMounts: []corev1.VolumeMount{
-                                {
-                                    Name:      "docker-graph-storage",
-                                    MountPath: "/var/lib/docker",
-                                },
-                            },
-                        },
-                    },
-                    Volumes: []corev1.Volume{
-                        {
-                            Name: "docker-graph-storage",
-                            VolumeSource: corev1.VolumeSource{
-                                EmptyDir: &corev1.EmptyDirVolumeSource{},
-                            },
-                        },
-                    },
-                },
-            },
-        },
-    }
-
-    return rc.clientset.BatchV1().Jobs(rc.namespace).Create(context.TODO(), job, metav1.CreateOptions{})
-}
-```
-
-## **Docker-in-Docker Configuration**
-
-For building Docker containers within your runners, you have two main approaches [^6][^2]:
-
-### **Option 1: Docker-in-Docker (DinD)**
-The above example uses a sidecar container approach with the `docker:dind` image. This provides full Docker functionality but requires **privileged mode**.
-
-### **Option 2: Kaniko (Rootless Alternative)**
-For better security, consider using Kaniko for building images without Docker daemon:
-
-```go
-// Alternative container spec for Kaniko
-{
-    Name:  "runner",
-    Image: "gcr.io/kaniko-project/executor:latest",
-    Args: []string{
-        "--dockerfile=Dockerfile",
-        "--context=git://github.com/your-repo.git",
-        "--destination=your-registry/image:tag",
-    },
-}
-```
-
-## **Log Polling Implementation**
-
-Here's how to poll and stream logs from your runner Jobs [^1][^3]:
-
-```go
-import (
-    "bufio"
-    "io"
-    "time"
-    "k8s.io/client-go/kubernetes"
-)
-
-func (rc *RunnerController) PollJobLogs(jobName string) error {
-    // Wait for pod to be created
-    time.Sleep(2 * time.Second)
-    
-    // Get pods for the job
-    labelSelector := fmt.Sprintf("job-name=%s", jobName)
-    pods, err := rc.clientset.CoreV1().Pods(rc.namespace).List(
-        context.TODO(), 
-        metav1.ListOptions{LabelSelector: labelSelector},
-    )
-    if err != nil || len(pods.Items) == 0 {
-        return fmt.Errorf("no pods found for job %s", jobName)
-    }
-    
-    podName := pods.Items[0].Name
-    
-    // Stream logs
-    req := rc.clientset.CoreV1().Pods(rc.namespace).GetLogs(podName, &corev1.PodLogOptions{
-        Follow:     true,
-        Container:  "runner",
-        Timestamps: true,
-    })
-    
-    stream, err := req.Stream(context.TODO())
-    if err != nil {
-        return err
-    }
-    defer stream.Close()
-    
-    // Read and process logs
-    reader := bufio.NewReader(stream)
-    for {
-        line, err := reader.ReadString('\n')
-        if err != nil {
-            if err == io.EOF {
-                break
-            }
-            return err
-        }
-        // Process log line (send to channel, write to file, etc.)
-        fmt.Print(line)
-    }
-    
-    return nil
-}
-```
-
-## **Architecture-Based Node Targeting**
-
-To target specific node architectures, use **nodeSelector** or **nodeAffinity** [^1]:
-
-```go
-// Enhanced node selection with affinity
-Spec: corev1.PodSpec{
-    Affinity: &corev1.Affinity{
-        NodeAffinity: &corev1.NodeAffinity{
-            RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
-                NodeSelectorTerms: []corev1.NodeSelectorTerm{
-                    {
-                        MatchExpressions: []corev1.NodeSelectorRequirement{
-                            {
-                                Key:      "kubernetes.io/arch",
-                                Operator: corev1.NodeSelectorOpIn,
-                                Values:   []string{arch}, // "amd64", "arm64"
-                            },
-                            {
-                                Key:      "kubernetes.io/os",
-                                Operator: corev1.NodeSelectorOpIn,
-                                Values:   []string{"linux"},
-                            },
-                        },
-                    },
-                },
-            },
-        },
-    },
-    // ... rest of pod spec
-}
-```
-
-## **Job Monitoring and Cleanup**
-
-Add logic to monitor job completion and cleanup:
-
-```go
-func (rc *RunnerController) WaitForJobCompletion(jobName string, timeout time.Duration) (*batchv1.Job, error) {
-    ctx, cancel := context.WithTimeout(context.Background(), timeout)
-    defer cancel()
-    
-    ticker := time.NewTicker(5 * time.Second)
-    defer ticker.Stop()
-    
-    for {
-        select {
-        case <-ctx.Done():
-            return nil, fmt.Errorf("job %s timed out", jobName)
-        case <-ticker.C:
-            job, err := rc.clientset.BatchV1().Jobs(rc.namespace).Get(
-                context.TODO(), jobName, metav1.GetOptions{},
-            )
-            if err != nil {
-                return nil, err
-            }
-            
-            if job.Status.Succeeded > 0 {
-                return job, nil
-            }
-            if job.Status.Failed > 0 {
-                return job, fmt.Errorf("job %s failed", jobName)
-            }
-        }
-    }
-}
-
-func (rc *RunnerController) CleanupJob(jobName string) error {
-    propagationPolicy := metav1.DeletePropagationBackground
-    return rc.clientset.BatchV1().Jobs(rc.namespace).Delete(
-        context.TODO(), 
-        jobName, 
-        metav1.DeleteOptions{
-            PropagationPolicy: &propagationPolicy,
-        },
-    )
-}
-```
-
-## **Integration with Your Workflow Parser**
-
-Here's how to tie it all together with your existing YAML parser:
-
-```go
-type WorkflowExecutor struct {
-    controller *RunnerController
-}
-
-func (we *WorkflowExecutor) ExecuteWorkflow(workflow *WorkflowSpec) error {
-    for _, step := range workflow.Steps {
-        // Create job for step
-        job, err := we.controller.CreateRunnerJob(
-            workflow.ID,
-            step.Name,
-            step.Command,
-            step.Architecture, // from your YAML
-        )
-        if err != nil {
-            return err
-        }
-        
-        // Start log polling in goroutine
-        go we.controller.PollJobLogs(job.Name)
-        
-        // Wait for completion
-        completedJob, err := we.controller.WaitForJobCompletion(job.Name, 30*time.Minute)
-        if err != nil {
-            return err
-        }
-        
-        // Optional: cleanup
-        if workflow.CleanupOnComplete {
-            we.controller.CleanupJob(job.Name)
-        }
-    }
-    return nil
-}
-```
-
-## **Key Considerations**
-
-- **Security**: Running Docker-in-Docker requires privileged containers. Consider using Kaniko or Buildah for rootless builds
-- **Resource Management**: Set appropriate resource limits on Jobs to prevent resource exhaustion
-- **Persistent Storage**: For caching Docker layers between builds, consider using PersistentVolumes instead of EmptyDir
-- **RBAC**: Ensure your operator has proper ServiceAccount permissions to create/delete Jobs and read logs
-
-This POC gives you a solid foundation similar to the GitHub Actions Runner Controller [^4][^5], with the core functionality you need for spawning runners, building containers, and monitoring execution.
-
-
-_References_:
-[^1]: [Jobs | Kubernetes](https://kubernetes.io/docs/concepts/workloads/controllers/job/)
-[^2]: [Jenkins: running workers in Kubernetes and Docker images build](https://dev.to/setevoy/jenkins-running-workers-in-kubernetes-and-docker-images-build-1lef)
-[^3]: [kubectl logs - Kubernetes](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_logs/)
-[^4]: [Kubernetes controller for GitHub Actions self-hosted runners](https://github.com/actions/actions-runner-controller)
-[^5]: [GitHub - evryfs/github-actions-runner-operator: K8S operator for...](https://github.com/evryfs/github-actions-runner-operator)
-[^6]: [Automating Docker Builds in Kubernetes | by Sebastien Goasguen](https://sebgoa.medium.com/automating-docker-builds-in-kubernetes-15ef047795ab)
-
-> @ 2025-11-03 05:37:24 UTC
->
-> Yeah i think i want to support buildah primarily. Not to say we can’t have ways to run alternative images later. Why would i want to choose node affinity over nodeselector?
-
-<details><summary>Thinking</summary>
-
-The user is asking about why they would choose node affinity over nodeSelector, and they want to use Buildah primarily for container builds. Let me provide a comprehensive answer about the differences between nodeSelector and nodeAffinity, and then update the code examples to use Buildah instead of Docker-in-Docker.
-
-Based on the research provided:
-1. NodeSelector is simpler but less flexible
-2. NodeAffinity provides more advanced scheduling options
-3. Buildah can run rootless, which is better for security
-
-Let me structure a response that addresses both points clearly.
-
-</details>
-
-Great choice on **Buildah**! It's much more secure since it can run rootless without requiring privileged containers. Let me explain the nodeAffinity vs nodeSelector decision and provide updated code for Buildah.
-
-## **NodeSelector vs NodeAffinity: When to Choose Which**
-
-### **NodeSelector** 
-- **Simple equality-based selection** [^4][^2]
-- Only supports "AND" logic between labels
-- More concise for basic requirements
-- Example: `kubernetes.io/arch: amd64`
-
-### **NodeAffinity** 
-NodeAffinity offers **significantly more flexibility** that you'll likely want for a runner controller [^2][^1]:
-
-1. **Complex expressions**: Use operators like `In`, `NotIn`, `Exists`, `DoesNotExist`, `Gt`, `Lt`
-2. **Soft preferences**: Use `preferredDuringSchedulingIgnoredDuringExecution` for optional requirements
-3. **Multiple criteria**: Combine multiple conditions with OR logic
-4. **Weighted preferences**: Assign weights to preferred nodes
-
-For your runner controller, **nodeAffinity is better** because:
-- You can handle fallback scenarios (prefer arm64 but accept amd64)
-- You can exclude certain nodes (avoid nodes with specific taints)
-- You can combine architecture with other requirements (GPU nodes, specific OS versions)
-
-## **Buildah-Based Runner Implementation**
-
-Here's the updated implementation using Buildah:
-
-```go
-package operator
-
-import (
-    "context"
-    "fmt"
-    batchv1 "k8s.io/api/batch/v1"
-    corev1 "k8s.io/api/core/v1"
-    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-    "k8s.io/client-go/kubernetes"
-)
-
-type BuildahRunnerConfig struct {
-    Registry      string
-    RegistryAuth  string // base64 encoded auth
-    StorageDriver string // overlay, vfs
-    Architecture  string // amd64, arm64
-}
-
-func (rc *RunnerController) CreateBuildahRunnerJob(
-    workflowID, stepName string, 
-    buildContext string,
-    config BuildahRunnerConfig,
-) (*batchv1.Job, error) {
-    
-    job := &batchv1.Job{
-        ObjectMeta: metav1.ObjectMeta{
-            Name:      fmt.Sprintf("runner-%s-%s", workflowID, stepName),
-            Namespace: rc.namespace,
-            Labels: map[string]string{
-                "workflow-id": workflowID,
-                "step-name":   stepName,
-                "builder":     "buildah",
-            },
-        },
-        Spec: batchv1.JobSpec{
-            BackoffLimit: &[]int32{2}[0],
-            Template: corev1.PodTemplateSpec{
-                ObjectMeta: metav1.ObjectMeta{
-                    Labels: map[string]string{
-                        "workflow-id": workflowID,
-                        "step-name":   stepName,
-                    },
-                    Annotations: map[string]string{
-                        "container.apparmor.security.beta.kubernetes.io/buildah": "unconfined",
-                    },
-                },
-                Spec: corev1.PodSpec{
-                    RestartPolicy: corev1.RestartPolicyNever,
-                    
-                    // Using NodeAffinity for flexible architecture targeting
-                    Affinity: &corev1.Affinity{
-                        NodeAffinity: &corev1.NodeAffinity{
-                            RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
-                                NodeSelectorTerms: []corev1.NodeSelectorTerm{
-                                    {
-                                        MatchExpressions: []corev1.NodeSelectorRequirement{
-                                            {
-                                                Key:      "kubernetes.io/arch",
-                                                Operator: corev1.NodeSelectorOpIn,
-                                                Values:   []string{config.Architecture},
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                            // Optional: Prefer nodes with more resources
-                            PreferredDuringSchedulingIgnoredDuringExecution: []corev1.PreferredSchedulingTerm{
-                                {
-                                    Weight: 100,
-                                    Preference: corev1.NodeSelectorTerm{
-                                        MatchExpressions: []corev1.NodeSelectorRequirement{
-                                            {
-                                                Key:      "node-role.kubernetes.io/runner",
-                                                Operator: corev1.NodeSelectorOpExists,
-                                            },
-                                        },
-                                    },
-                                },
-                            },
-                        },
-                    },
-                    
-                    Containers: []corev1.Container{
-                        {
-                            Name:  "buildah",
-                            Image: "quay.io/buildah/stable:latest",
-                            Command: []string{"/bin/bash", "-c"},
-                            Args: []string{fmt.Sprintf(`
-                                set -e
-                                echo "Starting build process..."
-                                
-                                # Clone or prepare build context
-                                %s
-                                
-                                # Build the image
-                                buildah bud \
-                                    --storage-driver=%s \
-                                    --format=docker \
-                                    --tls-verify=false \
-                                    -t %s/%s:%s \
-                                    -f Dockerfile .
-                                
-                                # Push to registry (if configured)
-                                if [ -n "$REGISTRY_AUTH" ]; then
-                                    echo "$REGISTRY_AUTH" | base64 -d > /tmp/auth.json
-                                    buildah push \
-                                        --authfile /tmp/auth.json \
-                                        --tls-verify=false \
-                                        %s/%s:%s
-                                    rm /tmp/auth.json
-                                fi
-                                
-                                echo "Build completed successfully"
-                            `, 
-                                buildContext,
-                                config.StorageDriver,
-                                config.Registry, workflowID, stepName,
-                                config.Registry, workflowID, stepName,
-                            )},
-                            
-                            SecurityContext: &corev1.SecurityContext{
-                                // Buildah can run rootless!
-                                RunAsUser:  &[]int64{1000}[0],
-                                RunAsGroup: &[]int64{1000}[0],
-                                Capabilities: &corev1.Capabilities{
-                                    Add: []corev1.Capability{
-                                        "SETUID",
-                                        "SETGID",
-                                    },
-                                },
-                            },
-                            
-                            Env: []corev1.EnvVar{
-                                {
-                                    Name:  "STORAGE_DRIVER",
-                                    Value: config.StorageDriver,
-                                },
-                                {
-                                    Name:  "REGISTRY_AUTH",
-                                    Value: config.RegistryAuth,
-                                },
-                                {
-                                    Name:  "BUILDAH_ISOLATION",
-                                    Value: "chroot",
-                                },
-                            },
-                            
-                            Resources: corev1.ResourceRequirements{
-                                Requests: corev1.ResourceList{
-                                    corev1.ResourceCPU:    resource.MustParse("500m"),
-                                    corev1.ResourceMemory: resource.MustParse("1Gi"),
-                                },
-                                Limits: corev1.ResourceList{
-                                    corev1.ResourceCPU:    resource.MustParse("2"),
-                                    corev1.ResourceMemory: resource.MustParse("4Gi"),
-                                },
-                            },
-                            
-                            VolumeMounts: []corev1.VolumeMount{
-                                {
-                                    Name:      "buildah-storage",
-                                    MountPath: "/var/lib/containers",
-                                },
-                            },
-                        },
-                    },
-                    
-                    Volumes: []corev1.Volume{
-                        {
-                            Name: "buildah-storage",
-                            VolumeSource: corev1.VolumeSource{
-                                EmptyDir: &corev1.EmptyDirVolumeSource{
-                                    Medium: corev1.StorageMediumMemory, // Use RAM for speed
-                                },
-                            },
-                        },
-                    },
-                },
-            },
-        },
-    }
-    
-    return rc.clientset.BatchV1().Jobs(rc.namespace).Create(context.TODO(), job, metav1.CreateOptions{})
-}
-```
-
-## **Supporting Multiple Build Tools with Strategy Pattern**
-
-Since you mentioned supporting alternative images later, here's an extensible approach:
-
-```go
-type BuilderStrategy interface {
-    CreateJob(workflowID, stepName string, config BuildConfig) *batchv1.Job
-    GetImage() string
-    GetSecurityContext() *corev1.SecurityContext
-}
-
-type BuildahStrategy struct{}
-type KanikoStrategy struct{}
-type DockerStrategy struct{}
-
-func (b *BuildahStrategy) GetSecurityContext() *corev1.SecurityContext {
-    return &corev1.SecurityContext{
-        RunAsUser:  &[]int64{1000}[0],
-        RunAsGroup: &[]int64{1000}[0],
-        Capabilities: &corev1.Capabilities{
-            Add: []corev1.Capability{"SETUID", "SETGID"},
-        },
-    }
-}
-
-func (k *KanikoStrategy) GetSecurityContext() *corev1.SecurityContext {
-    return &corev1.SecurityContext{
-        RunAsUser:  &[]int64{0}[0], // Kaniko needs root but doesn't need privileged
-    }
-}
-
-// Factory pattern for builder selection
-func GetBuilderStrategy(builderType string) BuilderStrategy {
-    switch builderType {
-    case "kaniko":
-        return &KanikoStrategy{}
-    case "docker":
-        return &DockerStrategy{}
-    default:
-        return &BuildahStrategy{} // Default to Buildah
-    }
-}
-```
-
-## **Advanced NodeAffinity Example**
-
-Here's a more sophisticated nodeAffinity setup that showcases why it's superior for complex requirements:
-
-```go
-Affinity: &corev1.Affinity{
-    NodeAffinity: &corev1.NodeAffinity{
-        RequiredDuringSchedulingIgnoredDuringExecution: &corev1.NodeSelector{
-            NodeSelectorTerms: []corev1.NodeSelectorTerm{
-                {
-                    MatchExpressions: []corev1.NodeSelectorRequirement{
-                        {
-                            Key:      "kubernetes.io/arch",
-                            Operator: corev1.NodeSelectorOpIn,
-                            Values:   []string{"amd64", "arm64"}, // Either architecture
-                        },
-                        {
-                            Key:      "node.kubernetes.io/instance-type",
-                            Operator: corev1.NodeSelectorOpNotIn,
-                            Values:   []string{"t2.micro", "t2.small"}, // Exclude small instances
-                        },
-                    },
-                },
-            },
-        },
-        PreferredDuringSchedulingIgnoredDuringExecution: []corev1.PreferredSchedulingTerm{
-            {
-                Weight: 100,
-                Preference: corev1.NodeSelectorTerm{
-                    MatchExpressions: []corev1.NodeSelectorRequirement{
-                        {
-                            Key:      "kubernetes.io/arch",
-                            Operator: corev1.NodeSelectorOpIn,
-                            Values:   []string{config.PreferredArch}, // Prefer specific arch
-                        },
-                    },
-                },
-            },
-            {
-                Weight: 50,
-                Preference: corev1.NodeSelectorTerm{
-                    MatchExpressions: []corev1.NodeSelectorRequirement{
-                        {
-                            Key:      "workload-type",
-                            Operator: corev1.NodeSelectorOpIn,
-                            Values:   []string{"build-optimized"},
-                        },
-                    },
-                },
-            },
-        },
-    },
-}
-```
-
-**Buildah** is an excellent choice for your runner controller because it:
-- Runs without root privileges (better security) [^5][^3]
-- Doesn't require a daemon
-- Has lower resource overhead
-- Supports multiple storage drivers
-- Works well in Kubernetes environments
-
-The combination of Buildah with nodeAffinity gives you a secure, flexible runner system that can intelligently place workloads across your cluster.
-
-
-_References_:
-[^1]: [Mastering Node Placement in Kubernetes: Node Selectors vs. Node Affinity](https://medium.com/@rahulbansod519/mastering-node-placement-in-kubernetes-node-selectors-vs-node-affinity-f6a24cda0ddd)
-[^2]: [Node Selector vs Node Affinity in Kubernetes - Medium](https://medium.com/@reach2shristi.81/node-selector-vs-node-affinity-in-kubernetes-3292e9552aa0)
-[^3]: [Buildah and Podman Relationship | buildah.io](https://buildah.io/blogs/2018/10/31/podman-buildah-relationship.html)
-[^4]: [Kubernetes: Node Selector and Node Affinity | by Claire Lee | Medium](https://yuminlee2.medium.com/kubernetes-node-selector-and-node-affinity-ecb3a4d69165)
-[^5]: [Building a Buildah container image for Kubernetes](https://buildah.io/blogs/2018/03/01/building-buildah-container-image-for-kubernetes.html)
-
-> @ 2025-11-03 05:43:40 UTC
->
-> How does GitHub handle isolation? I believe each step in a job is the same runner, but different jobs are isolated? This code appears to make a single step into a job? Is there shared context between steps? Ie environment variables, cached files etc?
-
-<details><summary>Thinking</summary>
-
-The user is asking about GitHub's isolation model and noticing that my code creates a separate Kubernetes Job for each step, which is different from how GitHub Actions works. They're right - GitHub Actions runs all steps in a job on the same runner with shared context, while different jobs are isolated. Let me explain this architecture and provide updated code that better mimics GitHub's model.
-
-</details>
-
-Excellent observation! You're absolutely right - **GitHub Actions runs all steps within a job on the same runner**, sharing context between steps. Your current code creates separate Kubernetes Jobs for each step, which breaks this model. Let me explain GitHub's architecture and provide a better implementation.
-
-## **GitHub Actions Isolation Model**
-
-### **How GitHub Actually Works:**
-- **Job Level**: Each job gets its own runner (isolated environment) [^1]
-- **Step Level**: All steps within a job execute sequentially on the same runner [^1]
-- **Shared Context**: Steps share:
-  - Filesystem/workspace
-  - Environment variables 
-  - Docker volumes [^4]
-  - Network context
-  - Installed tools/dependencies
-
-### **Isolation Boundaries:**
-- **Between Jobs**: Complete isolation (different runners/pods)
-- **Between Steps**: No isolation (same container/environment)
-- **Between Workflows**: Complete isolation
-
-## **Corrected Implementation: Job = Pod, Steps = Sequential Commands**
-
-Here's a redesigned approach that properly mimics GitHub's model:
-
-```go
-package operator
-
-import (
-    "context"
-    "encoding/json"
-    "fmt"
-    "strings"
-    batchv1 "k8s.io/api/batch/v1"
-    corev1 "k8s.io/api/core/v1"
-    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-type WorkflowJob struct {
-    ID           string
-    Name         string
-    Steps        []Step
-    Architecture string
-    Environment  map[string]string
-}
-
-type Step struct {
-    Name    string
-    Command string
-    Env     map[string]string
-    Uses    string // For action references
-}
-
-func (rc *RunnerController) CreateJobRunner(job WorkflowJob) (*batchv1.Job, error) {
-    // Build a single script that executes all steps sequentially
-    runnerScript := rc.buildRunnerScript(job.Steps, job.Environment)
-    
-    k8sJob := &batchv1.Job{
-        ObjectMeta: metav1.ObjectMeta{
-            Name:      fmt.Sprintf("runner-job-%s", job.ID),
-            Namespace: rc.namespace,
-            Labels: map[string]string{
-                "workflow-id": job.ID,
-                "job-name":    job.Name,
-                "type":        "github-runner",
-            },
-        },
-        Spec: batchv1.JobSpec{
-            BackoffLimit: &[]int32{0}[0], // No retries for workflow jobs
-            Template: corev1.PodTemplateSpec{
-                Spec: corev1.PodSpec{
-                    RestartPolicy: corev1.RestartPolicyNever,
-                    
-                    // Single init container to set up workspace
-                    InitContainers: []corev1.Container{
-                        {
-                            Name:  "setup-workspace",
-                            Image: "alpine/git:latest",
-                            Command: []string{"/bin/sh", "-c"},
-                            Args: []string{`
-                                # Clone repository or set up workspace
-                                git clone ${REPO_URL} /workspace || true
-                                cd /workspace
-                                git checkout ${GITHUB_SHA:-main}
-                            `},
-                            VolumeMounts: []corev1.VolumeMount{
-                                {
-                                    Name:      "workspace",
-                                    MountPath: "/workspace",
-                                },
-                            },
-                        },
-                    },
-                    
-                    // Main runner container executes ALL steps
-                    Containers: []corev1.Container{
-                        {
-                            Name:  "runner",
-                            Image: "quay.io/buildah/stable:latest", 
-                            Command: []string{"/bin/bash", "-c"},
-                            Args:    []string{runnerScript},
-                            
-                            WorkingDir: "/workspace",
-                            
-                            Env: rc.buildEnvironment(job),
-                            
-                            VolumeMounts: []corev1.VolumeMount{
-                                {
-                                    Name:      "workspace",
-                                    MountPath: "/workspace",
-                                },
-                                {
-                                    Name:      "step-outputs",
-                                    MountPath: "/tmp/step-outputs",
-                                },
-                                {
-                                    Name:      "github-env",
-                                    MountPath: "/tmp/github",
-                                },
-                                {
-                                    Name:      "buildah-storage",
-                                    MountPath: "/var/lib/containers",
-                                },
-                            },
-                            
-                            SecurityContext: &corev1.SecurityContext{
-                                RunAsUser:  &[]int64{1000}[0],
-                                RunAsGroup: &[]int64{1000}[0],
-                            },
-                        },
-                    },
-                    
-                    Volumes: []corev1.Volume{
-                        {
-                            Name: "workspace",
-                            VolumeSource: corev1.VolumeSource{
-                                EmptyDir: &corev1.EmptyDirVolumeSource{},
-                            },
-                        },
-                        {
-                            Name: "step-outputs",
-                            VolumeSource: corev1.VolumeSource{
-                                EmptyDir: &corev1.EmptyDirVolumeSource{},
-                            },
-                        },
-                        {
-                            Name: "github-env",
-                            VolumeSource: corev1.VolumeSource{
-                                EmptyDir: &corev1.EmptyDirVolumeSource{},
-                            },
-                        },
-                        {
-                            Name: "buildah-storage",
-                            VolumeSource: corev1.VolumeSource{
-                                EmptyDir: &corev1.EmptyDirVolumeSource{
-                                    Medium: corev1.StorageMediumMemory,
-                                },
-                            },
-                        },
-                    },
-                    
-                    NodeSelector: map[string]string{
-                        "kubernetes.io/arch": job.Architecture,
-                    },
-                },
-            },
-        },
-    }
-    
-    return rc.clientset.BatchV1().Jobs(rc.namespace).Create(context.TODO(), k8sJob, metav1.CreateOptions{})
-}
-```
-
-## **Step Execution Script Builder**
-
-This critical function creates a bash script that maintains context between steps:
-
-```go
-func (rc *RunnerController) buildRunnerScript(steps []Step, jobEnv map[string]string) string {
-    var script strings.Builder
-    
-    script.WriteString(`#!/bin/bash
-set -e
-
-# GitHub Actions compatible environment setup
-export GITHUB_ENV=/tmp/github/env
-export GITHUB_PATH=/tmp/github/path
-export GITHUB_OUTPUT=/tmp/github/output
-export GITHUB_STEP_SUMMARY=/tmp/github/step-summary.md
-
-# Initialize files
-touch $GITHUB_ENV $GITHUB_PATH $GITHUB_OUTPUT $GITHUB_STEP_SUMMARY
-
-# Helper functions matching GitHub Actions
-add_to_env() {
-    echo "$1=$2" >> $GITHUB_ENV
-    export $1="$2"
-}
-
-add_to_path() {
-    echo "$1" >> $GITHUB_PATH
-    export PATH="$1:$PATH"
-}
-
-set_output() {
-    echo "$1=$2" >> $GITHUB_OUTPUT
-}
-
-# Function to load environment between steps
-load_github_env() {
-    if [ -f "$GITHUB_ENV" ]; then
-        set -a
-        source $GITHUB_ENV
-        set +a
-    fi
-    if [ -f "$GITHUB_PATH" ]; then
-        while IFS= read -r line; do
-            export PATH="$line:$PATH"
-        done < $GITHUB_PATH
-    fi
-}
-
-`)
-    
-    // Add each step
-    for i, step := range steps {
-        script.WriteString(fmt.Sprintf(`
-echo "==== Starting Step: %s ===="
-load_github_env
-
-# Step %d environment variables
-`, step.Name, i+1))
-        
-        // Add step-specific environment variables
-        for k, v := range step.Env {
-            script.WriteString(fmt.Sprintf("export %s='%s'\n", k, v))
-        }
-        
-        // Execute step command
-        script.WriteString(fmt.Sprintf(`
-# Execute step
-(
-    %s
-) || {
-    echo "Step '%s' failed with exit code $?"
-    exit 1
-}
-
-echo "==== Completed Step: %s ===="
-`, step.Command, step.Name, step.Name))
-    }
-    
-    return script.String()
-}
-```
-
-## **Shared Context Implementation**
-
-Here's how to properly share context between steps like GitHub Actions does [^2][^3]:
-
-```go
-type StepOutput struct {
-    StepName string
-    Outputs  map[string]string
-}
-
-// Enhanced step structure with outputs
-type EnhancedStep struct {
-    Step
-    ID      string // For referencing outputs
-    Outputs []string // Expected output keys
-}
-
-func (rc *RunnerController) buildEnhancedRunnerScript(steps []EnhancedStep) string {
-    var script strings.Builder
-    
-    // ... (previous setup code) ...
-    
-    for i, step := range steps {
-        script.WriteString(fmt.Sprintf(`
-# Step: %s (id: %s)
-STEP_OUTPUT_FILE="/tmp/step-outputs/%s.json"
-
-# Run step and capture outputs
-(
-    %s
-    
-    # Save step outputs if any were set
-    if [ -f "$GITHUB_OUTPUT" ]; then
-        # Parse and save outputs for this step
-        python3 -c "
-import json
-outputs = {}
-with open('$GITHUB_OUTPUT', 'r') as f:
-    for line in f:
-        if '=' in line:
-            key, value = line.strip().split('=', 1)
-            outputs[key] = value
-with open('$STEP_OUTPUT_FILE', 'w') as f:
-    json.dump(outputs, f)
-"
-    fi
-)
-
-# Make outputs available as environment variables for next steps
-if [ -f "$STEP_OUTPUT_FILE" ]; then
-    export STEP_%s_OUTPUTS=$(cat $STEP_OUTPUT_FILE)
-fi
-`, step.Name, step.ID, step.ID, step.Command, strings.ToUpper(step.ID)))
-    }
-    
-    return script.String()
-}
-```
-
-## **Multi-Container Pattern for Complex Workflows**
-
-For workflows that need services (like databases), use a multi-container pod:
-
-```go
-// For jobs that need service containers (like GitHub Actions services)
-func (rc *RunnerController) CreateJobWithServices(job WorkflowJob, services []ServiceContainer) (*batchv1.Job, error) {
-    containers := []corev1.Container{
-        // Main runner container
-        {
-            Name: "runner",
-            // ... (as before)
-        },
-    }
-    
-    // Add service containers that run alongside the main runner
-    for _, svc := range services {
-        containers = append(containers, corev1.Container{
-            Name:  svc.Name,
-            Image: svc.Image,
-            Env:   convertToEnvVar(svc.Environment),
-            Ports: svc.Ports,
-            // Services run for the lifetime of the job
-            Command: svc.Command,
-        })
-    }
-    
-    // Update pod spec with all containers
-    // ... 
-}
-```
-
-## **Key Differences from Original Implementation**
-
-| Aspect | GitHub Actions Model | Your Original Code | Corrected Approach |
-|--------|---------------------|-------------------|-------------------|
-| **Job Mapping** | Job = Runner Instance | Step = K8s Job | Job = K8s Job/Pod |
-| **Step Execution** | Sequential in same environment | Separate pods | Sequential in same container |
-| **Filesystem** | Shared across steps | Isolated per step | Shared via volumes |
-| **Environment Variables** | Persistent across steps | Isolated | Persistent via GITHUB_ENV |
-| **Docker/Buildah Cache** | Shared in job | Lost between steps | Shared via volume |
-
-This corrected approach properly mimics GitHub Actions' execution model while maintaining the isolation boundaries that make sense in Kubernetes.
-
-
-_References_:
-[^1]: [Understanding GitHub Actions](https://docs.github.com/articles/getting-started-with-github-actions)
-[^2]: [Store information in variables - GitHub Docs](https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables)
-[^3]: [Contexts - GitHub Docs](https://docs.github.com/en/actions/concepts/workflows-and-actions/contexts)
-[^4]: [Workflow syntax for GitHub Actions](https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions)
-
-
----
-
-_Generated by [Kagi Assistant](https://kagi.com/assistant)_

api/v1alpha1/spindleset_types.go

···
 	// +kubebuilder:validation:Required
 	CommitSHA string `json:"commitSHA"`
 
+	// CloneCommands are the git commands to run in the clone init container.
+	// Generated by tangled.org/core/spindle/steps.BuildCloneCommands().
+	// +optional
+	CloneCommands []string `json:"cloneCommands,omitempty"`
+
+	// SkipClone indicates whether to skip the clone init container entirely.
+	// +optional
+	SkipClone bool `json:"skipClone,omitempty"`
+
 	// Workflows is the list of workflows to execute in this pipeline.
 	// +kubebuilder:validation:MinItems=1
 	Workflows []WorkflowSpec `json:"workflows"`

api/v1alpha1/zz_generated.deepcopy.go

···
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *PipelineRunSpec) DeepCopyInto(out *PipelineRunSpec) {
 	*out = *in
+	if in.CloneCommands != nil {
+		in, out := &in.CloneCommands, &out.CloneCommands
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	if in.Workflows != nil {
 		in, out := &in.Workflows, &out.Workflows
 		*out = make([]WorkflowSpec, len(*in))

cmd/runner/main.go

···
 	"io"
 	"os"
 	"os/exec"
-	"time"
 
+	"tangled.org/core/spindle/models"
 	loomv1alpha1 "tangled.org/evan.jarrett.net/loom/api/v1alpha1"
 )
 
-// LogEvent represents a structured log event emitted by the runner.
-type LogEvent struct {
-	Kind         string `json:"kind"`                // "control" or "data"
-	Event        string `json:"event,omitempty"`     // "start", "end" (for control events)
-	StepID       int    `json:"step_id"`             // 0-based step index
-	StepName     string `json:"step_name,omitempty"` // Step name
-	WorkflowName string `json:"workflow_name"`       // Workflow name for log separation
-	Stream       string `json:"stream,omitempty"`    // "stdout" or "stderr" (for data events)
-	Content      string `json:"content,omitempty"`   // Log line content (for data events)
-	ExitCode     *int   `json:"exit_code,omitempty"` // Exit code (for control/end events)
-	Timestamp    string `json:"timestamp"`           // ISO 8601 timestamp
+// simpleStep implements the models.Step interface
+type simpleStep struct {
+	name    string
+	command string
+}
+
+func (s *simpleStep) Name() string {
+	return s.name
+}
+
+func (s *simpleStep) Command() string {
+	return s.command
+}
+
+func (s *simpleStep) Kind() models.StepKind {
+	return models.StepKindUser
 }
 
 func main() {
···
 	// Execute each step
 	ctx := context.Background()
 	for i, step := range workflow.Steps {
-		if err := executeStep(ctx, i, step, workflow.Name); err != nil {
+		if err := executeStep(ctx, i, step); err != nil {
 			return fmt.Errorf("step %d (%s) failed: %w", i, step.Name, err)
 		}
 	}
···
 	return nil
 }
 
-func executeStep(ctx context.Context, stepID int, step loomv1alpha1.WorkflowStep, workflowName string) error {
+func executeStep(ctx context.Context, stepID int, step loomv1alpha1.WorkflowStep) error {
+	// Create a simple step for logging
+	simpleStep := &simpleStep{
+		name:    step.Name,
+		command: step.Command,
+	}
+
 	// Emit step start event
-	emitControlEvent(stepID, step.Name, workflowName, "start", nil)
+	emitControlEvent(stepID, simpleStep, models.StepStatusStart)
 
 	// Set step-specific environment variables
 	if step.Environment != nil {
···
 
 	// Start the command
 	if err := cmd.Start(); err != nil {
-		exitCode := 1
-		emitControlEvent(stepID, step.Name, workflowName, "end", &exitCode)
+		emitControlEvent(stepID, simpleStep, models.StepStatusEnd)
 		return fmt.Errorf("failed to start command: %w", err)
 	}
 
 	// Stream stdout and stderr concurrently
 	done := make(chan error, 2)
-	go streamOutput(stdout, stepID, workflowName, "stdout", done)
-	go streamOutput(stderr, stepID, workflowName, "stderr", done)
+	go streamOutput(stdout, stepID, "stdout", done)
+	go streamOutput(stderr, stepID, "stderr", done)
 
 	// Wait for both streams to complete
 	for i := 0; i < 2; i++ {
···
 	}
 
 	// Emit step end event
-	emitControlEvent(stepID, step.Name, workflowName, "end", &exitCode)
+	emitControlEvent(stepID, simpleStep, models.StepStatusEnd)
 
 	if exitCode != 0 {
 		return fmt.Errorf("command exited with code %d", exitCode)
···
 	return nil
 }
 
-func streamOutput(reader io.Reader, stepID int, workflowName, stream string, done chan<- error) {
+func streamOutput(reader io.Reader, stepID int, stream string, done chan<- error) {
 	scanner := bufio.NewScanner(reader)
 	// Increase buffer size for long lines
 	buf := make([]byte, 0, 64*1024)
···
 
 	for scanner.Scan() {
 		line := scanner.Text()
-		emitDataEvent(stepID, workflowName, stream, line)
+		emitDataEvent(stepID, stream, line)
 	}
 
 	done <- scanner.Err()
 }
 
-func emitControlEvent(stepID int, stepName, workflowName, event string, exitCode *int) {
-	ev := LogEvent{
-		Kind:         "control",
-		Event:        event,
-		StepID:       stepID,
-		StepName:     stepName,
-		WorkflowName: workflowName,
-		ExitCode:     exitCode,
-		Timestamp:    time.Now().UTC().Format(time.RFC3339Nano),
-	}
-	emitJSON(ev)
+func emitControlEvent(stepID int, step models.Step, status models.StepStatus) {
+	logLine := models.NewControlLogLine(stepID, step, status)
+	emitJSON(logLine)
 }
 
-func emitDataEvent(stepID int, workflowName, stream, content string) {
-	ev := LogEvent{
-		Kind:         "data",
-		StepID:       stepID,
-		WorkflowName: workflowName,
-		Stream:       stream,
-		Content:      content,
-		Timestamp:    time.Now().UTC().Format(time.RFC3339Nano),
-	}
-	emitJSON(ev)
+func emitDataEvent(stepID int, stream, content string) {
+	logLine := models.NewDataLogLine(stepID, content, stream)
+	emitJSON(logLine)
 }
 
-func emitJSON(event LogEvent) {
-	data, err := json.Marshal(event)
+func emitJSON(logLine models.LogLine) {
+	data, err := json.Marshal(logLine)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "ERROR: failed to marshal JSON: %v\n", err)
 		return

config/crd/bases/loom.j5t.io_spindlesets.yaml

···
                   PipelineRun contains pipeline-specific information for this pipeline execution.
                   This SpindleSet is ephemeral and represents a single pipeline run.
                 properties:
+                  cloneCommands:
+                    description: |-
+                      CloneCommands are the git commands to run in the clone init container.
+                      Generated by tangled.org/core/spindle/steps.BuildCloneCommands().
+                    items:
+                      type: string
+                    type: array
                   commitSHA:
                     description: CommitSHA is the Git commit to checkout.
                     type: string
···
                   repoURL:
                     description: RepoURL is the Git repository URL to clone.
                     type: string
+                  skipClone:
+                    description: SkipClone indicates whether to skip the clone init
+                      container entirely.
+                    type: boolean
                   workflows:
                     description: Workflows is the list of workflows to execute in
                       this pipeline.

go.mod

···
 )
 
 // Use our custom version of tangled until its upstreamed
-replace tangled.org/core => tangled.org/evan.jarrett.net/core v1.9.1-alpha.0.20251109203816-d73c73e8728b
+replace tangled.org/core => tangled.org/evan.jarrett.net/core v1.9.1-alpha.0.20251111023958-287f7ea82ba6

go.sum

···
 sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
-tangled.org/evan.jarrett.net/core v1.9.1-alpha.0.20251109203816-d73c73e8728b h1:m30BNzXLTO/V7tyh9levCuavrjgxH0KD5Y6lvX3S69s=
-tangled.org/evan.jarrett.net/core v1.9.1-alpha.0.20251109203816-d73c73e8728b/go.mod h1:CUO6beA36K/Cwt0u2yrO5CG+L7+LzAc6zi6WudwO7qs=
+tangled.org/evan.jarrett.net/core v1.9.1-alpha.0.20251111023958-287f7ea82ba6 h1:0vac5SqnzXzZi2HBZskjdUFdJflXTMMS9TM7mwttXeA=
+tangled.org/evan.jarrett.net/core v1.9.1-alpha.0.20251111023958-287f7ea82ba6/go.mod h1:CUO6beA36K/Cwt0u2yrO5CG+L7+LzAc6zi6WudwO7qs=

internal/controller/spindleset_controller.go

···
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
 	loomv1alpha1 "tangled.org/evan.jarrett.net/loom/api/v1alpha1"
-	"tangled.org/evan.jarrett.net/loom/pkg/jobbuilder"
+	"tangled.org/evan.jarrett.net/loom/internal/jobbuilder"
 )
 
 // SpindleSetReconciler reconciles a SpindleSet object
···
 			WorkflowSpec:   workflowSpec, // Pass full workflow spec to runner
 			RepoURL:        pipelineRun.RepoURL,
 			CommitSHA:      pipelineRun.CommitSHA,
+			CloneCommands:  pipelineRun.CloneCommands,
+			SkipClone:      pipelineRun.SkipClone,
 			Secrets:        nil, // TODO: Handle secrets
 			Template:       spindleSet.Spec.Template,
 			Namespace:      spindleSet.Namespace,

internal/controller/spindleset_controller_test.go

···
 						Name:      resourceName,
 						Namespace: "default",
 					},
-					// TODO(user): Specify other spec details if needed.
+					Spec: loomv1alpha1.SpindleSetSpec{
+						Template: loomv1alpha1.SpindleTemplate{},
+						PipelineRun: &loomv1alpha1.PipelineRunSpec{
+							PipelineID: "test-pipeline-123",
+							Knot:       "knot.example.com",
+							RepoURL:    "https://knot.example.com/did:plc:test/repo",
+							CommitSHA:  "abc123",
+							Workflows: []loomv1alpha1.WorkflowSpec{
+								{
+									Name:         "test-workflow",
+									Image:        "alpine:latest",
+									Architecture: "amd64",
+									Steps: []loomv1alpha1.WorkflowStep{
+										{
+											Name:    "test-step",
+											Command: "echo 'hello'",
+										},
+									},
+								},
+							},
+						},
+					},
 				}
 				Expect(k8sClient.Create(ctx, resource)).To(Succeed())
 			}

internal/engine/kubernetes_engine.go

···
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/spindle/models"
 	"tangled.org/core/spindle/secrets"
+	"tangled.org/core/spindle/steps"
 
 	loomv1alpha1 "tangled.org/evan.jarrett.net/loom/api/v1alpha1"
 )
···
 
 	// Store the parsed spec in Data field for later use
 	workflowData := map[string]interface{}{
-		"spec":        spec,
-		"triggerRepo": tpl.TriggerMetadata.Repo,
-		"cloneOpts":   twf.Clone,
+		"spec":            spec,
+		"triggerMetadata": tpl.TriggerMetadata,
+		"cloneOpts":       twf.Clone,
 	}
 
 	workflow := &models.Workflow{
···
 		return fmt.Errorf("workflow spec not found in data")
 	}
 
-	triggerRepo, ok := workflowData["triggerRepo"].(*tangled.Pipeline_TriggerRepo)
+	triggerMetadata, ok := workflowData["triggerMetadata"].(*tangled.Pipeline_TriggerMetadata)
+	if !ok {
+		return fmt.Errorf("trigger metadata not found in data")
+	}
+
+	cloneOpts, ok := workflowData["cloneOpts"].(*tangled.Pipeline_CloneOpts)
 	if !ok {
-		return fmt.Errorf("trigger repo not found in data")
+		return fmt.Errorf("clone options not found in data")
+	}
+
+	// Use shared clone command builder to extract commit SHA and build repo URL
+	// Note: We're not using the actual commands here, just extracting the metadata
+	// The Job builder will regenerate the commands for the init container
+	cloneConfig := steps.CloneConfig{
+		Workflow: tangled.Pipeline_Workflow{
+			Clone: cloneOpts,
+		},
+		TriggerMetadata: *triggerMetadata,
+		DevMode:         false, // TODO: Make this configurable
+		WorkspaceDir:    "/tangled/workspace",
 	}
 
-	// Determine commit SHA based on trigger type
-	// For now, assume we're handling push events with NewSha
-	// TODO: Handle other trigger types (PR, manual)
-	commitSHA := "" // Need to extract from trigger metadata
+	cloneCommands, err := steps.BuildCloneCommands(cloneConfig)
+	if err != nil {
+		return fmt.Errorf("failed to build clone commands: %w", err)
+	}
 
-	// Build repository clone URL
-	repoURL := fmt.Sprintf("https://%s/%s/%s", triggerRepo.Knot, triggerRepo.Did, triggerRepo.Repo)
+	commitSHA := cloneCommands.CommitSHA
+	repoURL := cloneCommands.RepoURL
 
 	// Store knot for status reporting
-	e.currentKnot = triggerRepo.Knot
+	e.currentKnot = triggerMetadata.Repo.Knot
 
 	// Generate SpindleSet name: spindle-{workflowName}-{pipelineID}
 	// Sanitize workflow name (remove .yaml/.yml, replace dots)
···
 		Spec: loomv1alpha1.SpindleSetSpec{
 			Template: e.template,
 			PipelineRun: &loomv1alpha1.PipelineRunSpec{
-				PipelineID: wid.PipelineId.Rkey,
-				Knot:       e.currentKnot,
-				RepoURL:    repoURL,
-				CommitSHA:  commitSHA,
-				Workflows:  []loomv1alpha1.WorkflowSpec{spec}, // Single workflow per SpindleSet
+				PipelineID:    wid.PipelineId.Rkey,
+				Knot:          e.currentKnot,
+				RepoURL:       repoURL,
+				CommitSHA:     commitSHA,
+				CloneCommands: cloneCommands.All,
+				SkipClone:     cloneCommands.Skip,
+				Workflows:     []loomv1alpha1.WorkflowSpec{spec}, // Single workflow per SpindleSet
 			},
 		},
 	}
···
 	return nil
 }
 
-// LogEvent represents a structured log event from the runner binary
-type LogEvent struct {
-	Kind         string `json:"kind"`                // "control" or "data"
-	Event        string `json:"event,omitempty"`     // "start", "end" (for control events)
-	StepID       int    `json:"step_id"`             // 0-based step index
-	StepName     string `json:"step_name,omitempty"` // Step name
-	WorkflowName string `json:"workflow_name"`       // Workflow name for log separation
-	Stream       string `json:"stream,omitempty"`    // "stdout" or "stderr" (for data events)
-	Content      string `json:"content,omitempty"`   // Log line content (for data events)
-	ExitCode     *int   `json:"exit_code,omitempty"` // Exit code (for control/end events)
-	Timestamp    string `json:"timestamp"`           // ISO 8601 timestamp
-}
-
 // getOrCreateLogStream gets an existing log stream or creates a new one for step 0
 func (e *KubernetesEngine) getOrCreateLogStream(ctx context.Context, wid models.WorkflowId, job *batchv1.Job) (*workflowLogStream, error) {
 	widKey := wid.String()
···
 	for scanner.Scan() {
 		line := scanner.Text()
 
-		// Try to parse as JSON event
-		var event LogEvent
-		if err := json.Unmarshal([]byte(line), &event); err != nil {
+		// Try to parse as models.LogLine from the runner binary
+		var logLine models.LogLine
+		if err := json.Unmarshal([]byte(line), &logLine); err != nil {
 			// Not JSON or parse error - skip
 			continue
 		}
 
 		// Validate step index
-		if event.StepID < 0 || event.StepID >= len(workflow.Steps) {
+		if logLine.StepId < 0 || logLine.StepId >= len(workflow.Steps) {
 			continue
 		}
 
 		// Only process events for the current step
-		if event.StepID != stepID {
+		if logLine.StepId != stepID {
 			// Got event for a different step - this shouldn't happen in sequential execution
 			// but log it and continue
 			continue
 		}
 
-		switch event.Kind {
-		case "control":
+		switch logLine.Kind {
+		case models.LogKindControl:
 			// Use control events from runner for flow control only
 			// Don't write them - the core spindle engine writes control events
-			if event.Event == "end" {
+			if logLine.StepStatus == models.StepStatusEnd {
 				// Step is done, return
 				return nil
 			}
 			// For "start" events, just continue reading
 
-		case "data":
+		case models.LogKindData:
 			// Log output from step
-			if event.Stream == "" {
-				event.Stream = "stdout" // Default to stdout
+			if logLine.Stream == "" {
+				logLine.Stream = "stdout" // Default to stdout
 			}
-			dataWriter := wfLogger.DataWriter(event.StepID, event.Stream)
-			dataWriter.Write([]byte(event.Content + "\n"))
+			dataWriter := wfLogger.DataWriter(logLine.StepId, logLine.Stream)
+			dataWriter.Write([]byte(logLine.Content + "\n"))
 		}
 	}
 

pkg/jobbuilder/job_template.go internal/jobbuilder/job_template.go

···
 	loomv1alpha1 "tangled.org/evan.jarrett.net/loom/api/v1alpha1"
 )
 
+// WorkflowStep represents a single step in a workflow.
+type WorkflowStep struct {
+	Name    string
+	Command string
+	Env     map[string]string
+}
+
 // WorkflowConfig contains all the information needed to create a spindle Job.
 type WorkflowConfig struct {
 	// WorkflowName is the name of the workflow (used in Job name and labels)
···
 
 	// CommitSHA is the git commit to checkout
 	CommitSHA string
+
+	// CloneCommands are the git commands to run in the init container
+	// Generated by steps.BuildCloneCommands()
+	CloneCommands []string
+
+	// SkipClone indicates whether to skip the clone init container entirely
+	SkipClone bool
 
 	// Secrets contains auth tokens or other secrets needed
 	Secrets []string
···
 								},
 							},
 						},
-						{
-							Name:    "clone-repo",
-							Image:   "alpine/git:latest",
-							Command: []string{"/bin/sh", "-c"},
-							SecurityContext: &corev1.SecurityContext{
-								AllowPrivilegeEscalation: &[]bool{false}[0],
-								Capabilities: &corev1.Capabilities{
-									Drop: []corev1.Capability{"ALL"},
-								},
-							},
-							Args: []string{
-								fmt.Sprintf(`
-set -e
-echo "Cloning repository..."
-git clone %s /tangled/workspace || {
-    echo "Failed to clone repository"
-    exit 1
-}
-cd /tangled/workspace
-echo "Checking out commit %s..."
-git checkout %s || {
-    echo "Failed to checkout commit"
-    exit 1
-}
-echo "Repository ready"
-`, config.RepoURL, config.CommitSHA, config.CommitSHA),
-							},
-							VolumeMounts: []corev1.VolumeMount{
-								{
-									Name:      "workspace",
-									MountPath: "/tangled/workspace",
-								},
-							},
-						},
+						buildCloneInitContainer(config),
 					},
 
 					// Main container: run loom-runner binary in user's image
···
 
 	return env
 }
+
+// buildCloneInitContainer creates the init container for cloning the git repository.
+// Uses the shared clone command builder from tangled.org/core/spindle/steps.
+func buildCloneInitContainer(config WorkflowConfig) corev1.Container {
+	// If clone is skipped, return an empty container (will be filtered out)
+	if config.SkipClone {
+		return corev1.Container{}
+	}
+
+	// Build the shell script from clone commands
+	// Add set -e for error handling and echo for visibility
+	script := "set -e\n" + strings.Join(config.CloneCommands, "\n") + "\necho \"Repository ready\""
+
+	return corev1.Container{
+		Name:    "clone-repo",
+		Image:   "alpine/git:latest",
+		Command: []string{"/bin/sh", "-c"},
+		SecurityContext: &corev1.SecurityContext{
+			AllowPrivilegeEscalation: &[]bool{false}[0],
+			Capabilities: &corev1.Capabilities{
+				Drop: []corev1.Capability{"ALL"},
+			},
+		},
+		Args: []string{script},
+		VolumeMounts: []corev1.VolumeMount{
+			{
+				Name:      "workspace",
+				MountPath: "/tangled/workspace",
+			},
+		},
+	}
+}

pkg/jobbuilder/script_builder.go

···
-package jobbuilder
-
-import (
-	"fmt"
-	"strings"
-)
-
-// WorkflowStep represents a single step in a workflow.
-type WorkflowStep struct {
-	Name    string
-	Command string
-	Env     map[string]string
-}
-
-// BuildStepExecutionScript generates a bash script that executes all workflow steps sequentially.
-// The script implements GitHub Actions-compatible environment passing between steps.
-func BuildStepExecutionScript(steps []WorkflowStep) string {
-	var script strings.Builder
-
-	// Script header with error handling
-	script.WriteString(`#!/bin/bash
-set -e
-set -o pipefail
-
-`)
-
-	// GitHub Actions-compatible environment setup
-	script.WriteString(`# GitHub Actions-compatible environment setup
-export GITHUB_ENV=/tmp/github/env
-export GITHUB_PATH=/tmp/github/path
-export GITHUB_OUTPUT=/tmp/github/output
-export GITHUB_STEP_SUMMARY=/tmp/github/step-summary.md
-
-# Initialize files
-mkdir -p /tmp/github
-touch $GITHUB_ENV $GITHUB_PATH $GITHUB_OUTPUT $GITHUB_STEP_SUMMARY
-
-# Helper functions for environment passing
-add_to_env() {
-    echo "$1=$2" >> $GITHUB_ENV
-    export "$1"="$2"
-}
-
-add_to_path() {
-    echo "$1" >> $GITHUB_PATH
-    export PATH="$1:$PATH"
-}
-
-set_output() {
-    echo "$1=$2" >> $GITHUB_OUTPUT
-}
-
-# Load environment variables set by previous steps
-load_github_env() {
-    if [ -f "$GITHUB_ENV" ]; then
-        set -a
-        source "$GITHUB_ENV" 2>/dev/null || true
-        set +a
-    fi
-    if [ -f "$GITHUB_PATH" ]; then
-        while IFS= read -r line; do
-            if [ -n "$line" ]; then
-                export PATH="$line:$PATH"
-            fi
-        done < "$GITHUB_PATH"
-    fi
-}
-
-# Timestamp helper
-timestamp() {
-    date -u +"%Y-%m-%dT%H:%M:%S.%3NZ"
-}
-
-`)
-
-	// Generate code for each step
-	for i, step := range steps {
-		script.WriteString(fmt.Sprintf(`
-##############################################################################
-# Step %d: %s
-##############################################################################
-echo ""
-echo "$(timestamp) ===== Starting Step %d: %s ====="
-echo ""
-
-# Load environment from previous steps
-load_github_env
-
-`, i+1, step.Name, i+1, step.Name))
-
-		// Set step-specific environment variables
-		if len(step.Env) > 0 {
-			script.WriteString("# Step-specific environment variables\n")
-			for k, v := range step.Env {
-				// Escape single quotes in the value
-				escapedValue := strings.ReplaceAll(v, "'", "'\\''")
-				script.WriteString(fmt.Sprintf("export %s='%s'\n", k, escapedValue))
-			}
-			script.WriteString("\n")
-		}
-
-		// Execute the step command
-		script.WriteString("# Execute step command\n")
-		script.WriteString("(\n")
-		script.WriteString("    cd /tangled/workspace\n")
-		script.WriteString("    " + step.Command + "\n")
-		script.WriteString(") || {\n")
-		script.WriteString(fmt.Sprintf("    echo \"$(timestamp) Step '%s' failed with exit code $?\"\n", step.Name))
-		script.WriteString("    exit 1\n")
-		script.WriteString("}\n\n")
-
-		script.WriteString(fmt.Sprintf("echo \"$(timestamp) ===== Completed Step %d: %s =====\"\n", i+1, step.Name))
-	}
-
-	// Script footer
-	script.WriteString(`
-echo ""
-echo "$(timestamp) ===== All steps completed successfully ====="
-exit 0
-`)
-
-	return script.String()
-}
-
-// EscapeShellString escapes a string for safe use in shell scripts.
-func EscapeShellString(s string) string {
-	// Replace single quotes with '\''
-	return strings.ReplaceAll(s, "'", "'\\''")
-}