v1.0.0

The first public release of pitlane: self-hosted GitHub Actions runners on one Linux host, built for start latency.

It is the runner stack behind the askalf projects' CI. The queue wait of the jobs it ran over the last 24 hours is live at pitlane.askalf.org.

What is in it

• A manifest, not hand-registered runners. runners.manifest lists every row: its scope (one repository, an organization or a shared pool), its tier and the account it runs as. gha-runners-apply.sh reconciles the host against it: systemd slices, template units, per-row drop-ins, directories and the pinned runner release.
• Three tiers. Read rows read code and post reviews, exec rows run repository code, and build rows run your own deploys as root behind a guard that refuses any job its allow list does not name.
• Scale to zero. gha-ondemand watches each repository's queued self-hosted jobs, starts a stopped row whose labels cover one (just-in-time configuration, so a row registers for exactly one job), and parks a row that sat idle.
• Pools and caps. A shared pool of rows registers, at each start, for the repository of the job routed to it.
• Isolation. Each row runs as its own account with its own tool cache, and only a lane's rows can read that lane's keys. A canary probes what a job can actually read.
• CPU shape. A row is pinned to a window of CPUs, so test runners and compilers size their worker pools to that window instead of the whole host.
• A supervisor. It watches for stuck jobs, version drift and disk or memory pressure, and records how every job ended.
• box-ci. A second way to run a repository's workflows on the host, with act, at each commit, posting the verdict as commit statuses.
• Showcase. A line on every job's run page with its own queue wait, and a live badge.

Getting started

pitlane needs a Linux host with systemd, bash and Node.js 22, and a GitHub App (or a fine-grained token) for each repository or organization it serves. Start from runners/examples/, check your config with node runners/runner-config.mjs path/to/your/config, then follow runners/README.md.

Tests

node --test runners/*.test.mjs canary/*.test.mjs box-ci/*.test.mjs

The tests run the shell scripts against stubs, with no network and no root.

Security

Report a vulnerability privately, as SECURITY.md describes, never in a public issue.

Verify

The release carries the source tarball of this tag, attested keyless through GitHub OIDC (Sigstore):

gh attestation verify pitlane-1.0.0.tar.gz --owner askalf