Commit 315847fa78

315847fa7864df2e1f29700ee5bb856a637dce8b

parent: 00578a96a1

Verified · cmc ci/build: success ci/test: success

cmc <hello@cleberg.net> · 2026-09-09 23:13 UTC

CHANGELOG: v1.17.0
CHANGELOG.org +63
@@ -4,6 +4,69 @@ Versioning follows semver from v0.1.0. Database migrations run
44automatically on daemon start; upgrade notes appear per release when
55anything beyond "replace the binary and restart" is needed.
66
7* v1.17.0 — 2026-09-09
8
9CI without the operator's compute: a runner anyone installs and
10attaches to their own repositories, and the server rule that makes
11that safe. The rest of the #184 list besides.
12
13** CI
14
15- A runner key claims builds only for the repositories it is attached
16 to. =repo runner add <owner/name> < key.pub= attaches one; a key the
17 server has not seen lands on the caller's account with scope
18 =runner=. =repo runner list= shows each attached key with its last
19 poll and the build it holds; =repo runner remove <fingerprint>=
20 detaches it. All three on the settings page. A runner-scoped key
21 with nothing attached claims nothing, whoever owns it; a full-scope
22 admin key still claims any repository. =runner log= and =runner
23 done= refuse a build outside the key's attachments. #184
24- Closed: any account could add a runner-scoped key, and =runner next=
25 with no arguments handed it the oldest pending build on the
26 instance, secrets included.
27- =runner next --untrusted=: without it a merge request head from a
28 fork is never claimed. The runner passes it when started with
29 =-untrusted=; the bay1 unit does, because it isolates in podman.
30- =gitbay-runner init= generates a key under =~/.config/gitbay-runner/=,
31 writes =config.toml= beside it, and prints the public key with the
32 command that attaches it. The runner reads that file when present
33 and flags override it. =-identity=, defaulting to the generated key,
34 makes ssh and git use the runner's own key and no other. Homebrew:
35 =brew install krz/tap/gitbay-runner=, then =brew services start
36 krz/tap/gitbay-runner=. Releases ship =gitbay-runner= binaries.
37- =admin runners= heads its output with the queue: builds pending now,
38 and over the last day the builds claimed, the wait to claim (average
39 and worst) and the builds the reaper ended instead of a runner
40 reporting them. Rows are per key, with the fingerprint and the
41 repositories the key may claim. Migration 0049. #184
42- Stop tests for the runner's drain: a signal mid-step, the drop-in's
43 =KillMode= and =TimeoutStopSec=, and a transient systemd user unit
44 where one exists. #179
45- The CI wiki page carries every push shape against every job kind and
46 what dedupe, path filters, schedules and the reaper make of it, with
47 a test per row. #176, #177
48
49** Importing
50
51- =import-issues --api-base= reads Forgejo instances: paging by =limit=,
52 oldest first, comments read once, attribution and pull heads taken
53 from the API base rather than github.com. #191
54
55** Documentation
56
57- Users: "Your own runner". Admin, Threat-Model, CI, FAQ and Parity
58 follow the attachment rule.
59
60** Upgrading
61
62Replace the binaries and reinstall the CLI. Migration 0050 (runner
63attachments; the runner heartbeat table is rekeyed by key and
64emptied), applied on start. One behaviour change: a runner polling
65with a key of scope =runner= claims nothing until a repository admin
66attaches it with =repo runner add=. Do that right after the restart.
67A full-scope admin key is unaffected. Merge request heads from forks
68are built only by a runner started with =-untrusted=.
69
770* v1.16.0 — 2026-09-08
871
972What stops a stranger from moving here: the repository plumbing and