OwnCI v0.2.0

This release fixes commands and hints that sent you in circles, hardens how tokens and labels are handled, and adds progress output to setup.

Install

curl -fsSL https://sparshlabs.com/ownci/install.sh | sh

The script checks the archive against SHA256SUMS and installs ownci into ~/.local/bin.
Set OWNCI_VERSION=v0.2.0 to pin this version. The archives carry GitHub build-provenance
attestations: gh attestation verify ownci_v0.2.0_linux_<arch>.tar.gz --repo ashfaqc137/ownci.

To upgrade, install the new binary, then run ownci stop and ownci start. The runner registration is kept.

Changed behaviour

• start re-checks the repository's visibility when a GitHub token is available. It refuses to
  run if the repository has become public since setup, unless setup was run with --allow-public-repo. status --remote warns about it too.
• Hosted-runner labels are refused by setup --labels: ubuntu-*, windows-* and macos-*.
  A runs-on: ubuntu-latest can no longer reach your machine through a label you added.
• An invalid --repo or --name exits with code 2 (a usage error) instead of 1.
  setup also rejects stray arguments.
• The registration token is passed to the runner through its environment
  (ACTIONS_RUNNER_INPUT_TOKEN), not its command line, where other users on the machine could read it.
  GITHUB_TOKEN and GH_TOKEN are removed from the runner's environment.

Fixed

• Hints that failed: about ten error hints said ownci setup --force, which always failed
  with "--repo is required". setup now uses the configured repository when --repo is left out.
• setup --force now replaces an outdated runner. If the runner could not update itself
  (version_deprecated), the advice to run setup --force used to loop forever. Now
  setup --force replaces any runner older than the one OwnCI pins. If the download fails,
  the registration is kept.
• start no longer kills unrelated processes. The cleanup of leftover runner processes
  killed any process that had a runner file among its first two arguments, such as an
  editor with .env open. It now matches only runner binaries and runner scripts.
• Ctrl-C during start's preparation is a clean stop.
• stop waits 75 s by default in container-runner mode.
• GitHub's secondary rate limits are reported as rate limits.

Hardening

• The cleanup hook:
  • records a failure when the work directory is not the one it expects;
  • removes a symlinked _temp or _PipelineMapping;
  • pulls its digest-pinned image if it is missing.
• Host mode:
  • refuses a data directory containing : or ,;
  • setup lists the Docker socket among the isolation notes.

Improved

• setup shows progress. On a terminal:

  • a live line for the 217 MB runner download (percent, MB, speed);
  • a spinner for extracting, registering, installing the isolation settings and pulling the image.

  Piped output gets plain progress lines instead.

• install.sh:

  • prints how to add the install directory to PATH for good, not just for the current shell;
  • accepts OWNCI_VERSION=latest.

• Docs and website:

  • The README, docs/ and the website now match the code.
  • New section: Let only maintainers decide where jobs run.
  • Team labels are now dev-<username>.

OwnCI v0.1.1

A small fix release: ownci uninstall now cleans up after an install that was never set up.

Install

curl -fsSL https://sparshlabs.com/ownci/install.sh | sh

The script checks the archive against SHA256SUMS and installs ownci into ~/.local/bin.
Set OWNCI_VERSION=v0.1.1 to pin this version. The archives carry GitHub build-provenance
attestations: gh attestation verify ownci_v0.1.1_linux_<arch>.tar.gz --repo ashfaqc137/ownci.

Fixed

• ownci uninstall --purge with no runner set up (installed, maybe ran doctor or status,
  never setup) printed "Nothing to uninstall" and kept the data directory. It now removes it,
  with the same safety rules as before: only a directory with OwnCI's marker, only OwnCI's own
  files, and anything else is kept and listed.
• Leftover logs and state of a runner whose directory was deleted by hand no longer block the
  purge. A runner that still holds its lock is left alone.
• status, logs and stop no longer create a missing data directory, so ownci status after
  a purge does not bring it back.
• After a purge, the summary prints the command to remove the ownci binary itself. OwnCI never
  deletes its own binary.

To remove OwnCI completely: ownci uninstall --unregister --purge, then rm ~/.local/bin/ownci.

OwnCI v0.1.0

The first release of OwnCI: a small CLI that turns your Linux or WSL2 machine into a
GitHub Actions self-hosted runner for one repository, where every job runs inside a
Docker container. OwnCI does not implement CI itself. It downloads, verifies, registers,
supervises and cleans up the official actions/runner.

Install

curl -fsSL https://sparshlabs.com/ownci/install.sh | sh

The script checks the archive against SHA256SUMS and installs ownci into ~/.local/bin.
Set OWNCI_VERSION=v0.1.0 to pin this version, or OWNCI_INSTALL_DIR to install elsewhere.
To install by hand, download ownci_v0.1.0_linux_<arch>.tar.gz and SHA256SUMS below, then:

sha256sum -c --ignore-missing SHA256SUMS
tar -xzf ownci_v0.1.0_linux_<arch>.tar.gz && install -m 0755 ownci ~/.local/bin/ownci

The archives carry GitHub build-provenance attestations:
gh attestation verify ownci_v0.1.0_linux_<arch>.tar.gz --repo ashfaqc137/ownci.

Then run ownci doctor and ownci setup --repo owner/name. The
README has the full guide.

What's in it

• setup, start, stop, status, logs, doctor, uninstall and version.
• Host mode (the default): the runner runs on your machine. Jobs must declare
  container:, and jobs without one are rejected.
• Container-runner mode (setup --mode container-runner): the runner itself runs in a
  digest-pinned ghcr.io/actions/actions-runner container, recreated for every job, so
  unchanged workflows without container: work too.
• The pinned runner (2.338.0) is checksum-verified before extraction.
• After every job a hook wipes the workspace, _actions and _tool in a throwaway,
  network-less container.
• Public repositories are refused unless you pass --allow-public-repo.
• Your GitHub token is never stored, and tokens are redacted from the logs.
• Several repositories can run side by side, one data directory per repository. Per-developer
  labels let one workflow file serve a whole team.

Platforms

Platform	Status
WSL2 + Docker Desktop, amd64	Tested end to end against real GitHub (acceptance record)
Native Linux (Docker Engine), amd64	Shipped, expected to work, not tested yet
Linux / WSL2, arm64	Shipped, expected to work, not tested yet
Windows	Use the Linux binary inside WSL2. Native Windows is not supported
macOS	Not supported yet

Known limitations

• Trusted workflows only. The official runner mounts the Docker socket into job
  containers, so a job can control your Docker daemon. The container is a guard against
  accidents, not against hostile code. Read the README's
  Security and trust model.
• In container-runner mode, a job without container: can read the runner's registration
  credentials while it runs.
• Container-runner mode relies on run.sh --once, which the runner marks as deprecated.
• Runner self-update inside the runner container has not been exercised yet, because no
  newer runner release existed during testing.
• After a supervisor is killed with kill -9, the next start can take about a minute to
  reconnect while GitHub expires the old session. status may keep showing that conflict
  as Last error after it recovers.
• One job at a time per data directory. There is no systemd service or start on boot, and
  OwnCI does not install Docker for you.