Update the runner reference pages (#586)

Automated update of the generated runner reference pages from gitea/runner (main for the develop docs, the newest stable tag for every documented series), opened by the "update runner reference" scheduled workflow.

<!-- cloudflare-preview --> Preview: https://pr-586.docs-gitea-com.pages.dev

Reviewed-on: https://gitea.com/gitea/docs/pulls/586
Reviewed-by: Lunny Xiao <[email protected]>
Co-authored-by: Gitea Bot <[email protected]>

runner-docs/reference/config-example.md

@@ -15,12 +15,13 @@ loaded.
 ```yaml
 # Every option with its default value, all commented out. Read this file, do not copy it.
 # `./gitea-runner config init` writes a config file to copy the lines you change into.
+# Values may read the runner's environment as ${NAME}, an unset NAME fails the load. $${NAME} is a literal ${NAME}.
 
 # Logging for the runner process itself (messages printed to stderr), plus the copy of
 # each task's log kept under log.job. Neither controls how workflow step output is streamed
 # to the Gitea UI; tune that with runner.log_report_* below.
 log:
-  # logrus severity: trace, debug, info, warn, error, fatal, panic.
+  # Severity: trace, debug, info, warn, error. fatal and panic are accepted and mean error.
   # trace and debug turn on caller/file:line in log lines. Default if omitted: info.
   #level: info
   # Write a copy of each task's log to dir as <start time>-task-<id>.log, so a job's output
@@ -55,6 +56,9 @@ runner:
   #shutdown_timeout: 0s
   # Whether skip verifying the TLS certificate of the Gitea instance.
   #insecure: false
+  # PEM client certificate and key for a Gitea instance that requires mutual TLS.
+  #client_cert_file: /etc/gitea-runner/client.crt
+  #client_key_file: /etc/gitea-runner/client.key
   # The timeout for fetching the job from the Gitea instance.
   # Values above the 60s RPC timeout are capped to it.
   #fetch_timeout: 5s
@@ -98,6 +102,11 @@ runner:
   # and github_mirror is not empty. In this case,
   # it replaces https://github.com with the value here, which is useful for some special network environments.
   #github_mirror: ''
+  # Extra HTTP headers for runner API requests to Gitea, e.g. reverse proxy authentication.
+  # Not used for action clones, artifacts, job summaries or jobs. Runner headers take precedence.
+  # Dropped on redirects to another hostname, or to HTTP if the instance URL uses HTTPS.
+  #extra_headers:
+  #  X-Proxy-Token: 'example'
   # When true (the default), fetch only the requested ref of an action repository (e.g. actions/checkout@v4) at depth 1 instead of cloning every branch's full history.
   # Set to false to clone the full history.
   #action_shallow_clone: true
@@ -232,6 +241,7 @@ container:
   # created by the runner. Omit the entire block to use Docker's defaults. An auto-created
   # network is labelled com.gitea.runner.uuid=<this runner's uuid>, which is how the idle
   # cleanup tells its own leftovers apart from those of other runners on the same daemon.
+  # It also takes the `mtu` set in the Docker daemon config.
   #network_create_options:
   #  enable_ipv4: true # Omit to use Docker's default (IPv4 enabled). Set false to disable IPv4.
   #  enable_ipv6: false # Omit to use Docker's default (IPv6 disabled). Enabling it requires dockerd started with --ipv6.
@@ -252,14 +262,15 @@ container:
   # If it's empty, /workspace will be used.
   # Purely numeric subdirectories under this path are reserved for task workspaces and may be removed by idle cleanup.
   #workdir_parent:
-  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/bmatcuk/doublestar#patterns
-  # `*` matches within a single path segment, `**` also matches across path separators.
-  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
-  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # Volumes and bind mounts containers may mount, as globs (https://github.com/bmatcuk/doublestar#patterns).
+  # `*` matches within a path segment, `**` across segments. Empty allows none. tmpfs mounts are always allowed.
+  # A `:ro` suffix allows only read-only mounts, unless an entry without it matches too.
+  # For example, to allow the `data` volume and all json files in `/src`, and `/etc/ssl/certs` only read-only:
   # valid_volumes:
   #   - data
   #   - /src/*.json
-  # If you want to allow any volume, please use the following configuration:
+  #   - /etc/ssl/certs:ro
+  # To allow any volume:
   # valid_volumes:
   #   - '**'
   #valid_volumes: []
@@ -289,6 +300,9 @@ container:
   # How long a job waits for a service container that declares a healthcheck to become
   # healthy. A negative value (e.g. -1s) starts the steps without waiting.
   #service_ready_timeout: 5m
+  # Remove the containers, networks and volumes a job creates through its Docker proxy when
+  # the job ends. Set to false when jobs deploy services to the runner's Docker daemon.
+  #sweep: true
 
 host:
   # The parent directory of a job's working directory.