Commit ac22431b2b

ac22431b2bf54fa4bf5c593ac9f7f4e16c6ad502

parent: 7da0d08800

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-09 03:48 UTC

wiki: Admin says a runner key claims only its attachments

The scope, claim-order and admin runners paragraphs still described the
old rule: an unscoped runner claiming any repository, -repos as the only
boundary, and the column as the -repos the key asked for.

Ref #184
.gitbay/wiki/Admin.org +20 −18
@@ -363,13 +363,14 @@ below are per service, not per build, so raising =-jobs= divides them
363363rather than multiplying the host's load.
364364
365365=admin runners= shows which account each runner polls as, and what each
366is scoped to. A runner with no scope claims builds for *any*
367repository, which on an instance with open registration means running a
368stranger's steps; scope one with =-repos owner/name=. An admin key
369still works for the protocol during a rotation. A merge request head
370from a fork is built in the target repository as untrusted: the claim
371carries no secrets. Same-repository heads were built by their branch
372push and are not built again.
366may claim. A runner key claims builds only for the repositories it is
367attached to: with none attached it claims nothing, and =-repos= may only
368narrow within them. An admin's full-scope key claims any repository —
369that is what =-repos= was for — and still works for the protocol during
370a rotation. A merge request head from a fork is built in the target
371repository as untrusted: the claim carries no secrets, and only a runner
372started with =-untrusted= takes it. Same-repository heads were built by
373their branch push and are not built again.
373374
374375=make deploy-runner= also installs
375376=deploy/gitbay-runner.override.conf= as a systemd drop-in: =Nice=10=,
@@ -386,12 +387,11 @@ v1 runs steps directly on the host — no containers — so treat the
386387runner machine as executing whatever your users push. Install the
387388toolchains your builds need on it.
388389
389A runner claims the oldest pending build in the queue, whichever
390repository it belongs to. =-repos= narrows that to named repositories,
391which is what makes a runner outside the server practical — one on a
392machine that should build a single project, or that holds credentials for
393one deployment, no longer picks up a build belonging to someone else. With
394open registration that someone need not be anyone you know.
390A runner claims the oldest pending build among the repositories its key
391is attached to — for an admin key, the oldest in the instance. =-repos=
392narrows within that set, which is what makes a runner outside the server
393practical: one on a machine that should build a single project, or that
394holds credentials for one deployment, stays on it.
395395
396396#+begin_src sh
397397gitbay-runner -remote git@gitbay.org -repos krz/site,krz/docs \
@@ -410,11 +410,13 @@ repositories among them. =-untrusted= makes a runner claim merge
410410request heads from forks; the bay1 unit sets it because it isolates in
411411podman. A runner without it builds trusted commits only.
412412
413=gitbay dashboard= and =ssh git@<host> admin runners= list every account
414that has polled as a runner: when it last polled, the =-repos= scope it
415asked for, and the build it holds. =admin runners= also heads the list
416with the queue: builds pending now, and over the last day how many were
417claimed, how long they waited to be claimed (average and worst), and
413=gitbay dashboard= and =ssh git@<host> admin runners= list every key
414that has polled as a runner: the account, the key's fingerprint, when it
415last polled, the repositories it may claim — its attachments for a runner
416key, the =-repos= it asked for or =any= for an admin key — and the build
417it holds. =admin runners= also heads the list with the queue: builds
418pending now, and over the last day how many were claimed, how long they
419waited to be claimed (average and worst), and
418420how many the reaper ended instead of a runner reporting them. A build a runner claimed and never
419421reported is failed by the scheduler's minute tick, whether or not any
420422runner is still alive: within about two minutes of its log stream ending