v0.6.1

Each runner's TMPDIR is no longer a dot-led directory.

Redirecting TMPDIR away from the shared /var/folders temp is deliberate and stays: a job that leaks into the shared temp cannot be swept safely. Naming the target .tmp was incidental, and it silently breaks any tool applying dotfile-ignore rules to an absolute path rooted at os.tmpdir(). It fails by ignoring everything rather than erroring, which is how it went unnoticed through a machine-contention investigation and a timeout raised more than fourfold.

runpool clean sweeps both names, so an install predating this does not orphan its old directory, and retires the legacy one once empty.

Existing installs need runpool rewrite-agents; the environment lives in the launch agent and takes effect when the runners next restart.

v0.6.0

Closes the findings from a full security and code review (#8 to #14).

The public-repository control now sits at whichever layer owns it. At repository scope it is RunPool's, because GitHub has no per-repository equivalent: registration refuses by default, refuses again when visibility cannot be resolved rather than assuming safe, and takes an explicit --allow-public override. At organisation scope it is GitHub's: RunPool reads allows_public_repositories from the default runner group and warns only when it has been turned on, rather than duplicating a control that already defaults correctly.

Also fixed: pool names are validated at register, closing a malformed-JSON path, a directory-traversal path and a word-splitting bug together. The config is created 0600 because it may hold a webhook secret. The runner download fails on HTTP errors, lands atomically and verifies its published SHA256. The scheduler tick takes a lock so a slow poll cannot overlap the next run.

New: SECURITY.md states the threat model plainly and owns the two deliberate differences from GitHub's hardening guidance.

v0.5.0

stats stops trying to analyse and describes instead. Its own analysis produced a confidently wrong answer about runner counts, so the reasoning moved to where it belongs and the command now reports what jobs cost and points at the data.

• contrib/telemetry-join.sh joins recorded telemetry to GitHub, adding the queue times the job hook cannot see. That is the figure that answers whether a pool is too small.
• contrib/demo-status.sh answers status with invented pools, for screenshots and for developing against the JSON without runners or a GitHub account.
• Fixed: shrinking a pool raced the scheduler into standing every pool down (#6).
• Docs: the contention threshold depends on pool size, which the default does not account for.

v0.4.0

status --json now reports machine load, core count and the contention threshold, so a caller does not have to recompute a configurable value and disagree with the tool.

Adds menu-bar icon variants.

v0.3.0

status --json --local skips the GitHub query for callers that refresh on a timer. The JSON now also reports log and telemetry paths, and each pool's watched repositories.

Adds the runpool icon.

v0.2.1

Fixes the notifier: config values were never exported, so a notifier running as a child process could not read its own configuration and failed on every call.

v0.2.0

Opt-in job telemetry and runpool stats, so the right runner count for a machine can be measured rather than assumed. Also wires the job-completed hook, which was missing, so job duration is observable at all.

v0.1.1

Fixes configuration precedence: the environment now overrides the config file, then the config file overrides the defaults.

v0.1.0

First release.

On-demand self-hosted GitHub Actions runner pools for macOS. Pools wake when jobs queue and stand down when idle.