-- The admin, not the daemon, declares a runner's isolation when minting its registration token.
ALTER TABLE runner_registration_tokens ADD COLUMN isolation TEXT NOT NULL DEFAULT 'container';
-- 1 when the registering admin declared container isolation; only such runners may take fork pull request jobs.
ALTER TABLE runners ADD COLUMN isolation_attested INTEGER NOT NULL DEFAULT 0;

-- Content-addressed cache objects (cache/<repo>/<scope>/<sha256>) may be shared by several entries.
ALTER TABLE action_caches ADD COLUMN content_sha256 TEXT;
CREATE INDEX action_caches_object ON action_caches(r2_key);

-- Self-hosted runner time (free but recorded) and Actions cache storage, consumed by the usage metering workstream.
CREATE TABLE runner_usage_events (
  id TEXT PRIMARY KEY,
  owner_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
  repo_id TEXT REFERENCES repos(id) ON DELETE CASCADE,
  kind TEXT NOT NULL CHECK (kind IN ('self_hosted_runner_ms', 'cache_bytes_stored', 'cache_bytes_freed')),
  quantity INTEGER NOT NULL,
  subject_id TEXT,
  created_at INTEGER NOT NULL
);
CREATE INDEX runner_usage_events_owner ON runner_usage_events(owner_id, created_at);