At the moment, the only way to pass the secret Gitea token to the
runner CLI is directly through a CLI parameter. That's an issue on a
multi-user system where the CLI parameters are world-readable through
/proc/PID/cmdline. On a Linux system, there's sadly no way to hide the
cmdline parameters.
We usually go around this limitation by storing the secrets in a file
and protect it through tight ACL rules. Adding a way to inject the
secret token via a file during the register command.
As a nice side-effect, this improves the systemd integration by
allowing us to directly use the LoadCredential mechanism.
techknowlogick