JIT Runner Kit v0.3.1

Cost-control and bootstrap hardening

• Reuses one shared Hetzner pool host for 45 minutes, reducing minimum-hour lifecycle churn between nearby releases.
• Keeps the hard one-host-per-pool invariant with at most two isolated disposable runner/DinD pairs.
• Uses a short-lived public-only bootstrap SSH-key object so Hetzner does not generate or email a root password for scale-to-zero hosts.
• Retains resources across ambiguous provider outcomes and cleans the bootstrap key only after provider-observed server-create completion.
• Extends inventory and orphan cleanup coverage to pool SSH-key objects.

Verified live on Cloudflare Worker revision b6bc7ddd-be96-4e9a-8823-9259bc09fa6d: AtlasRepo Scout run 33022130760 succeeded on runner jit-98354819072; independent peak inventory showed exactly one pool server and zero legacy resources; the runner record was removed after completion; no Hetzner password email was generated.

JIT Runner Kit v0.3.0

Cloudflare-controlled, scale-to-zero shared-host runners

v0.3.0 promotes the provider-agnostic Cloudflare controller from an inert canary to a verified pre-1.0 production-pilot path. A repository-scoped GitHub App, Cloudflare Queue and Durable Object now coordinate a temporary Hetzner pool that scales from zero to one host and runs at most two disposable runner/DinD pairs.

Highlights

• one temporary burst host can serve adjacent trusted jobs, then returns to zero after the idle window;
• every job receives its own disposable runner container, DinD daemon, workspace, network, and one-time JIT configuration;
• repository, branch, event, workflow, label, runner-group, and GitHub-side identity are revalidated before JIT issuance;
• Primary IPv4 readiness polling, retry classification, ambiguous create recovery, and independent provider cleanup are hardened;
• the immutable runner image includes Docker CLI/Compose, GitHub CLI, PHP CLI, Python, ShellCheck, and native build tools;
• the new production cutover runbook covers one-job workflow migration, DinD networking, exact-SHA evidence, cost controls, and scale-to-zero verification;
• delayed exact-SHA PushEvents must not be converted into timer-based manual duplicate releases.

The original ephemeral VM adapter and polling controller remain explicit compatibility fallbacks. Existing installations should repeat success, failure, cancellation, two-job isolation, retry/DLQ, TTL, and final empty-inventory gates before production use.

See the production cutover runbook, Cloudflare controller guide, and custom runner image guide.

Full Changelog: v0.2.0...v0.3.0

JIT Runner Kit v0.2.0

JIT Runner Kit v0.2.0 turns the serverless controller roadmap into a controlled-canary implementation while keeping the proven GitHub control-job mode available.

Highlights

• Provider-agnostic job, lease, compute, runner, bootstrap, clock, and telemetry core.
• Cloudflare Workers adapter with GitHub App workflow_job webhooks, Queues/DLQ, a SQLite Durable Object, alarms, and Cron reconciliation.
• Direct Hetzner Cloud API adapter with deny-inbound, SSH-free VMs and a one-time bootstrap exchange.
• Private organization runner-group boundary restricted to exact branch- or SHA-pinned trusted workflows.
• Atomic provisioning and cleanup state, capacity leases, attempt fencing, ambiguous-create recovery, and two-path cleanup.
• Inert Wrangler and GitHub App templates plus an offline fail-closed deployment preflight.
• 37 mocked conformance tests, OpenTofu validation, CLI checks, and a Wrangler dry-run bundle gate.

Important boundary

The existing GitHub control-job mode remains the recommended production path. The Cloudflare mode is code- and configuration-ready for a dedicated live canary, but it has not completed live-cloud conformance and must not be treated as production-ready. No Cloudflare account was accessed and no Cloudflare resources were created for this release.

See the Cloudflare controller canary guide before connecting any provider account.

Full changelog: v0.1.0...v0.2.0

JIT Runner Kit v0.1.0

First public pilot release of JIT Runner Kit.

Highlights:

• one GitHub Actions job per ephemeral Hetzner VM
• GitHub control-job adapter plus compatibility polling controller
• rollback-safe OpenTofu/Terraform provisioning and independent TTL cleanup
• ordered Hetzner location fallbacks for transient capacity pressure
• custom packages, PHP CLI, Bash/Zsh/Fish, and custom-image guidance
• provider-agnostic serverless architecture with Cloudflare as the first planned controller adapter

Real-cloud evidence includes successful, intentionally failed, and cancelled workloads. Each path completed cleanup, and the final managed-resource inventory reported zero servers, firewalls, Primary IPv4s, and SSH keys.

This is a pre-1.0 controlled-pilot release. Read SECURITY.md and pin production use to the immutable tag or commit SHA.