[Unit]
Description=CI Transient Fault Auto-Retry
After=network.target

[Service]
Type=oneshot
# 安全设置
ProtectSystem=strict
ReadWritePaths=/opt/act-runner-docker/ci-retry-state /var/log
PrivateTmp=true
NoNewPrivileges=true

# Token 从环境文件加载（不要用明文写在 unit 里）
EnvironmentFile=/opt/act-runner-docker/ci-retry-state/env
ExecStart=/opt/act-runner-docker/ci-retry-state/ci_transient_retry.sh