nixos/github-runners: add noDefaultLabels option

Add option `noDefaultLabels` which controls the `--no-default-labels`
switch passed to the configure script.

nixos/modules/services/continuous-integration/github-runner/options.nix

@@ -112,7 +112,8 @@ with lib;
   extraLabels = mkOption {
     type = types.listOf types.str;
     description = mdDoc ''
-      Extra labels in addition to the default (`["self-hosted", "Linux", "X64"]`).
+      Extra labels in addition to the default.
+      Requires a non-empty list if the `noDefaultLabels` option is used.
 
       Changing this option triggers a new runner registration.
     '';
@@ -120,6 +121,16 @@ with lib;
     default = [ ];
   };
 
+  noDefaultLabels = mkOption {
+    type = types.bool;
+    description = mdDoc ''
+      Disables adding the default labels. Also see the `extraLabels` option.
+
+      Changing this option triggers a new runner registration.
+    '';
+    default = false;
+  };
+
   replace = mkOption {
     type = types.bool;
     description = mdDoc ''

nixos/modules/services/continuous-integration/github-runner/service.nix

@@ -76,7 +76,16 @@ in
 
             ${lines}
           '';
-          runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg;
+          runnerRegistrationConfig = getAttrs [
+            "ephemeral"
+            "extraLabels"
+            "name"
+            "noDefaultLabels"
+            "runnerGroup"
+            "tokenFile"
+            "url"
+            "workDir"
+          ] cfg;
           newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
           currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
           newConfigTokenPath = "$STATE_DIRECTORY/.new-token";
@@ -142,6 +151,7 @@ in
                 ${optionalString cfg.replace "--replace"}
                 ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
                 ${optionalString cfg.ephemeral "--ephemeral"}
+                ${optionalString cfg.noDefaultLabels "--no-default-labels"}
               )
               # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
               # if it is not a PAT, we assume it contains a registration token and use the --token option

nixos/modules/services/continuous-integration/github-runners.nix

@@ -39,6 +39,13 @@ in
   };
 
   config = {
+    assertions = flatten (
+      flip mapAttrsToList config.services.github-runners (name: cfg: map (mkIf cfg.enable) [{
+        assertion = !cfg.noDefaultLabels || (cfg.extraLabels != [ ]);
+        message = "`services.github-runners.${name}`: The `extraLabels` option is mandatory if `noDefaultLabels` is set";
+      }])
+    );
+
     systemd.services = flip mapAttrs' cfg (n: v:
       let
         svcName = "github-runner-${n}";