Commit 315847fa78
Verified · cmc ci/build: success ci/test: success
CHANGELOG.org +63
| @@ -4,6 +4,69 @@ Versioning follows semver from v0.1.0. Database migrations run | ||
| 4 | 4 | automatically on daemon start; upgrade notes appear per release when |
| 5 | 5 | anything beyond "replace the binary and restart" is needed. |
| 6 | 6 | |
| 7 | * v1.17.0 — 2026-09-09 | |
| 8 | ||
| 9 | CI without the operator's compute: a runner anyone installs and | |
| 10 | attaches to their own repositories, and the server rule that makes | |
| 11 | that safe. The rest of the #184 list besides. | |
| 12 | ||
| 13 | ** CI | |
| 14 | ||
| 15 | - A runner key claims builds only for the repositories it is attached | |
| 16 | to. =repo runner add <owner/name> < key.pub= attaches one; a key the | |
| 17 | server has not seen lands on the caller's account with scope | |
| 18 | =runner=. =repo runner list= shows each attached key with its last | |
| 19 | poll and the build it holds; =repo runner remove <fingerprint>= | |
| 20 | detaches it. All three on the settings page. A runner-scoped key | |
| 21 | with nothing attached claims nothing, whoever owns it; a full-scope | |
| 22 | admin key still claims any repository. =runner log= and =runner | |
| 23 | done= refuse a build outside the key's attachments. #184 | |
| 24 | - Closed: any account could add a runner-scoped key, and =runner next= | |
| 25 | with no arguments handed it the oldest pending build on the | |
| 26 | instance, secrets included. | |
| 27 | - =runner next --untrusted=: without it a merge request head from a | |
| 28 | fork is never claimed. The runner passes it when started with | |
| 29 | =-untrusted=; the bay1 unit does, because it isolates in podman. | |
| 30 | - =gitbay-runner init= generates a key under =~/.config/gitbay-runner/=, | |
| 31 | writes =config.toml= beside it, and prints the public key with the | |
| 32 | command that attaches it. The runner reads that file when present | |
| 33 | and flags override it. =-identity=, defaulting to the generated key, | |
| 34 | makes ssh and git use the runner's own key and no other. Homebrew: | |
| 35 | =brew install krz/tap/gitbay-runner=, then =brew services start | |
| 36 | krz/tap/gitbay-runner=. Releases ship =gitbay-runner= binaries. | |
| 37 | - =admin runners= heads its output with the queue: builds pending now, | |
| 38 | and over the last day the builds claimed, the wait to claim (average | |
| 39 | and worst) and the builds the reaper ended instead of a runner | |
| 40 | reporting them. Rows are per key, with the fingerprint and the | |
| 41 | repositories the key may claim. Migration 0049. #184 | |
| 42 | - Stop tests for the runner's drain: a signal mid-step, the drop-in's | |
| 43 | =KillMode= and =TimeoutStopSec=, and a transient systemd user unit | |
| 44 | where one exists. #179 | |
| 45 | - The CI wiki page carries every push shape against every job kind and | |
| 46 | what dedupe, path filters, schedules and the reaper make of it, with | |
| 47 | a test per row. #176, #177 | |
| 48 | ||
| 49 | ** Importing | |
| 50 | ||
| 51 | - =import-issues --api-base= reads Forgejo instances: paging by =limit=, | |
| 52 | oldest first, comments read once, attribution and pull heads taken | |
| 53 | from the API base rather than github.com. #191 | |
| 54 | ||
| 55 | ** Documentation | |
| 56 | ||
| 57 | - Users: "Your own runner". Admin, Threat-Model, CI, FAQ and Parity | |
| 58 | follow the attachment rule. | |
| 59 | ||
| 60 | ** Upgrading | |
| 61 | ||
| 62 | Replace the binaries and reinstall the CLI. Migration 0050 (runner | |
| 63 | attachments; the runner heartbeat table is rekeyed by key and | |
| 64 | emptied), applied on start. One behaviour change: a runner polling | |
| 65 | with a key of scope =runner= claims nothing until a repository admin | |
| 66 | attaches it with =repo runner add=. Do that right after the restart. | |
| 67 | A full-scope admin key is unaffected. Merge request heads from forks | |
| 68 | are built only by a runner started with =-untrusted=. | |
| 69 | ||
| 7 | 70 | * v1.16.0 — 2026-09-08 |
| 8 | 71 | |
| 9 | 72 | What stops a stranger from moving here: the repository plumbing and |