v0.1.16 preview

v0.1.16 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.16. The capability version is 12.

The poller retries once with a distinct, stable key when a repeated
submission returns an earlier storage-full setup refusal.
actions/upload-artifact accepts and records retention-days as an
integer from 1 to 90. The worker does not enforce that value as an
artifact expiration policy.

Resource-scheduling decision proposals and a private managed-capacity
cost and design study are included. These remain proposals, without
an implemented scheduler or managed service.

The experimental GitHub runner registration and webhook-intake module
is disabled by default. ROOKRUNNER_EXPERIMENTAL_GITHUB_RUNNERS=1
opts in to the Python API prototype. It has no CLI command or HTTP
listener and does not execute jobs.

CI also checks documentation for links to unpublished packages and dead
external links.

The wheel and the source tarball can be built from this tree. They
are not published. This change does not create a tag.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.15 preview

v0.1.15 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.15. The capability version is 12.

The poller can recover pending commit statuses from worker snapshots and
retains completed submission keys while pruning finished records. Remote
worker calls now use the worker timeout plus a startup margin. Idempotency
conflicts identify differing request fields without exposing values, and
the workflow-change exception is limited to one owner-approved pull request
head SHA.

The repository also includes a runnable, read-only local web dashboard
option for comparison with the terminal dashboard. It is a design option,
not a managed service.

The wheel and the source tarball can be built from this tree. They
are not published. This change does not create a tag.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.14 preview

v0.1.14 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.14. The capability version is 12.

A poll pass records an error for one run and carries on with the other
runs. Final commit-status posts are retried with backoff. A new
reconcile subcommand re-posts final results for runs whose status may
still show pending.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.13 preview

v0.1.13 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.13. The capability version is 12.

In App-key mode, a refused pull request's trust status and a sign-off
status carry their reason as the commit status description. A failure
such as the workflow-edit gate now says why it refused. Run statuses
and the CLI poster are unchanged.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.12 preview

v0.1.12 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.12. The capability version is 12.

Refused pull request runs post their refusal status before a worker
is selected. Worker readiness reports an unavailable runner image as
not ready. The worker socket timeout is configurable.

Check records written before a run's progress are accepted. Poll
state tracks disk usage incrementally instead of walking the whole
state directory on every submit and prune.

Failed poll submissions retry with a distinct idempotent key. Setup
failures map to neutral checks. A merge refused because the base
branch moved posts an error status, and a merge is built on the
moved base.

Writers may change workflows under the PR workflow flag. A configured
job that the workflow at a commit does not define is skipped instead
of failing the run.

The terminal dashboard keeps raw rows aligned. Stored run logs
display as terminal data: carriage returns and control bytes no
longer drive the terminal.

Design and investigation documents for managed runners, scheduling,
shared caches, capacity, and the CI dashboard are added. They
describe proposals, not shipped behavior.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.11 preview

v0.1.11 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.11. The capability version is 12.

Job containers use Docker network none by default.
worker --network bridge opts in to egress. Service containers start
only with that opt-in. A host that upgrades onto a tree where the
job network defaults to none adds --network bridge on that
host's unit when jobs need egress. Cargo and pip need it. The
repository unit omits the flag.

A job container is created with --security-opt no-new-privileges
and --cap-drop ALL. Passwordless sudo is off unless the worker is
started with --passwordless-sudo.

A bash or sh run script quotes each expression. An expression in
eval or in a shell -c command is refused. A pull request that
changes a workflow file is refused. A missing pull request author
association is refused.

Every engine call uses the Docker context named default unless
worker --docker-context or ROOKRUNNER_DOCKER_CONTEXT names one.
An inherited DOCKER_CONTEXT or DOCKER_HOST does not select the
engine.

A host copy of the worker unit must set NoNewPrivileges=yes.
The repository unit sets that directive. A copy that omits it is
reported by systemd as NoNewPrivileges=no and must be set to yes.

The acceptance platform is Linux x86_64. Other platforms are not
claimed. The acceptance interpreter is Python 3.12. The package
requires Python 3.11 or newer.

PyYAML 6.0.3 is installed with the wheel and is not vendored.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The worker has no listen socket. The one write grant the planner
accepts is id-token: write. Every other write stays rejected.

A poll pass keeps going when an older claimed run has no readable
snapshot. That run is skipped and later runs still post.

Passwordless sudo still drops every capability. It then keeps
SETUID, SETGID, AUDIT_WRITE, CHOWN, DAC_OVERRIDE,
and FOWNER. DAC_READ_SEARCH is no longer kept; the apt, unlink,
and workspace flows from 0.1.7 still work. A job without that
opt-in still sets no-new-privileges and adds no capabilities.

The worker enforces the per-job disk budget during the run. A
submission that would exceed the budget is refused, and a running
job that breaches the budget is stopped. The breach is latched on
the lease for the run, and the budget watch runs past startup until
the container is confirmed stopped.

A per-job OIDC token mint fails closed when its audit record cannot
be written: no token is issued unless the mint is recorded in
oidc-audit.jsonl. Each mint and each refusal stays one line in
that file, without the token.

Secret and token eligibility comes only from the authenticated
actor, never the commit author. A pull request run withholds actor
eligibility, so a fork, an override run, and a run the secret
allowlist does not match receive no secret and no token.

A low-severity hardening batch is included: state files are
owner-only, an empty or missing run database fails closed instead
of resetting, an unreachable engine is reported as not-ready, a
full disk during capture reports storage exhaustion, deeply nested
input is refused with a structured error naming the limit, the
status page answers under a bounded budget, and the worker service
file bounds its start loop with delayed restarts.

Job privileges are off by default. A worker started with
worker --job-privileges keeps --cap-drop ALL for its job
containers and adds only CAP_SYS_CHROOT, plus a seccomp profile
that allows personality on top of the Docker default profile.
That allowance is restricted to the values setarch needs: 0,
262144, and 0xffffffff. The profile ships as
seccomp-personality.json and now matches the current Docker
default profile. The prior profile had no clone3 entry, so a
job container on a --job-privileges worker could fail during
container setup on current Linux Docker. The regenerated
profile allows clone3 with CAP_SYS_ADMIN and returns
ENOSYS (38) without it, and adds no pivot_root allowance.
The personality allowance stays restricted to the values
setarch needs, with no unconditional entry. The flag composes
with --passwordless-sudo. A step running as the job user gets
the personality allowance directly. chroot takes effect
for steps running as root, for example under
--passwordless-sudo. That serves a chroot smoke step and a
bench step that runs Callgrind under setarch. Without the
flag, the job container arguments are unchanged. The
capability version stays 12.

Rookrunner can act as an OIDC issuer for jobs. Signing keys are RSA
files of at least 2048 bits under oidc/ in the key directory.
oidc publish writes the discovery document and the public key set
for the issuer host. Only the public key members are written.

A per-job token endpoint runs only when the worker is started with
worker --oidc-issuer. That flag is off by default, and startup
refuses when the active signing key is missing, unreadable, or
below 2048 bits. A job must grant id-token: write. The run must
be trusted: a fork, an override run, and a run the secret allowlist
does not match receive no token. A same-repository pull request
also needs worker --oidc-pull-request. A job that passes gets
ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN
in every step, and trades them for a token that lives for five
minutes. A job that does not pass runs without them, and the
refusal is audited. Jobs that use a token need --network bridge.
Each mint and each refusal is one line in oidc-audit.jsonl,
without the token.

A pre-commit hook rejects an unformatted staged Python file under
src/ or tests/. scripts/install-hooks.sh points a clone at
the hook.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.10 preview

v0.1.10 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.10. The capability version is 12.

Job containers use Docker network none by default.
worker --network bridge opts in to egress. Service containers start
only with that opt-in. A host that upgrades onto a tree where the
job network defaults to none adds --network bridge on that
host's unit when jobs need egress. Cargo and pip need it. The
repository unit omits the flag.

A job container is created with --security-opt no-new-privileges
and --cap-drop ALL. Passwordless sudo is off unless the worker is
started with --passwordless-sudo.

A bash or sh run script quotes each expression. An expression in
eval or in a shell -c command is refused. A pull request that
changes a workflow file is refused. A missing pull request author
association is refused.

Every engine call uses the Docker context named default unless
worker --docker-context or ROOKRUNNER_DOCKER_CONTEXT names one.
An inherited DOCKER_CONTEXT or DOCKER_HOST does not select the
engine.

A host copy of the worker unit must set NoNewPrivileges=yes.
The repository unit sets that directive. A copy that omits it is
reported by systemd as NoNewPrivileges=no and must be set to yes.

The acceptance platform is Linux x86_64. Other platforms are not
claimed. The acceptance interpreter is Python 3.12. The package
requires Python 3.11 or newer.

PyYAML 6.0.3 is installed with the wheel and is not vendored.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The worker has no listen socket. The one write grant the planner
accepts is id-token: write. Every other write stays rejected.

A poll pass keeps going when an older claimed run has no readable
snapshot. That run is skipped and later runs still post.

Passwordless sudo still drops every capability. It then keeps
SETUID, SETGID, AUDIT_WRITE, CHOWN, DAC_OVERRIDE,
DAC_READ_SEARCH, and FOWNER. Root in that job can chown and
chmod the apt partial directories, unlink a file in a mode-0700
directory owned by another user, and stat a mode-0700 workspace
owned by the job user. A job without that opt-in still sets
no-new-privileges and adds no capabilities.

Job privileges are off by default. A worker started with
worker --job-privileges keeps --cap-drop ALL for its job
containers and adds only CAP_SYS_CHROOT, plus a seccomp profile
that allows personality on top of the Docker default profile.
That allowance is restricted to the values setarch needs: 0,
262144, and 0xffffffff. The profile ships as
seccomp-personality.json and now matches the current Docker
default profile. The prior profile had no clone3 entry, so a
job container on a --job-privileges worker could fail during
container setup on current Linux Docker. The regenerated
profile allows clone3 with CAP_SYS_ADMIN and returns
ENOSYS (38) without it, and adds no pivot_root allowance.
The personality allowance stays restricted to the values
setarch needs, with no unconditional entry. The flag composes
with --passwordless-sudo. A step running as the job user gets
the personality allowance directly. chroot takes effect
for steps running as root, for example under
--passwordless-sudo. That serves a chroot smoke step and a
bench step that runs Callgrind under setarch. Without the
flag, the job container arguments are unchanged. The
capability version stays 12.

Rookrunner can act as an OIDC issuer for jobs. Signing keys are RSA
files of at least 2048 bits under oidc/ in the key directory.
oidc publish writes the discovery document and the public key set
for the issuer host. Only the public key members are written.

A per-job token endpoint runs only when the worker is started with
worker --oidc-issuer. That flag is off by default, and startup
refuses when the active signing key is missing, unreadable, or
below 2048 bits. A job must grant id-token: write. The run must
be trusted: a fork, an override run, and a run the secret allowlist
does not match receive no token. A same-repository pull request
also needs worker --oidc-pull-request. A job that passes gets
ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN
in every step, and trades them for a token that lives for five
minutes. A job that does not pass runs without them, and the
refusal is audited. Jobs that use a token need --network bridge.
Each mint and each refusal is one line in oidc-audit.jsonl,
without the token.

A pre-commit hook rejects an unformatted staged Python file under
src/ or tests/. scripts/install-hooks.sh points a clone at
the hook.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.9 preview

v0.1.9 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.9. The capability version is 12.

Job containers use Docker network none by default.
worker --network bridge opts in to egress. Service containers start
only with that opt-in. A host that upgrades onto a tree where the
job network defaults to none adds --network bridge on that
host's unit when jobs need egress. Cargo and pip need it. The
repository unit omits the flag.

A job container is created with --security-opt no-new-privileges
and --cap-drop ALL. Passwordless sudo is off unless the worker is
started with --passwordless-sudo.

A bash or sh run script quotes each expression. An expression in
eval or in a shell -c command is refused. A pull request that
changes a workflow file is refused. A missing pull request author
association is refused.

Every engine call uses the Docker context named default unless
worker --docker-context or ROOKRUNNER_DOCKER_CONTEXT names one.
An inherited DOCKER_CONTEXT or DOCKER_HOST does not select the
engine.

A host copy of the worker unit must set NoNewPrivileges=yes.
The repository unit sets that directive. A copy that omits it is
reported by systemd as NoNewPrivileges=no and must be set to yes.

The acceptance platform is Linux x86_64. Other platforms are not
claimed. The acceptance interpreter is Python 3.12. The package
requires Python 3.11 or newer.

PyYAML 6.0.3 is installed with the wheel and is not vendored.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The worker has no listen socket. The one write grant the planner
accepts is id-token: write. Every other write stays rejected.

A poll pass keeps going when an older claimed run has no readable
snapshot. That run is skipped and later runs still post.

Passwordless sudo still drops every capability. It then keeps
SETUID, SETGID, AUDIT_WRITE, CHOWN, DAC_OVERRIDE,
DAC_READ_SEARCH, and FOWNER. Root in that job can chown and
chmod the apt partial directories, unlink a file in a mode-0700
directory owned by another user, and stat a mode-0700 workspace
owned by the job user. A job without that opt-in still sets
no-new-privileges and adds no capabilities.

Job privileges are off by default. A worker started with
worker --job-privileges keeps --cap-drop ALL for its job
containers and adds only CAP_SYS_CHROOT, plus a seccomp profile
that allows personality on top of the Docker default profile.
That allowance is restricted to the values setarch needs: 0,
262144, and 0xffffffff. The profile ships as
seccomp-personality.json. The flag composes with
--passwordless-sudo. A step running as the job user gets the
personality allowance directly. chroot takes effect for
steps running as root, for example under --passwordless-sudo.
That serves a chroot smoke step and a bench step that runs
Callgrind under setarch. Without the flag, the job container
arguments are unchanged. The capability version stays 12.

Rookrunner can act as an OIDC issuer for jobs. Signing keys are RSA
files of at least 2048 bits under oidc/ in the key directory.
oidc publish writes the discovery document and the public key set
for the issuer host. Only the public key members are written.

A per-job token endpoint runs only when the worker is started with
worker --oidc-issuer. That flag is off by default, and startup
refuses when the active signing key is missing, unreadable, or
below 2048 bits. A job must grant id-token: write. The run must
be trusted: a fork, an override run, and a run the secret allowlist
does not match receive no token. A same-repository pull request
also needs worker --oidc-pull-request. A job that passes gets
ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN
in every step, and trades them for a token that lives for five
minutes. A job that does not pass runs without them, and the
refusal is audited. Jobs that use a token need --network bridge.
Each mint and each refusal is one line in oidc-audit.jsonl,
without the token.

A pre-commit hook rejects an unformatted staged Python file under
src/ or tests/. scripts/install-hooks.sh points a clone at
the hook.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.8 preview

v0.1.8 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.8. The capability version is 12.

Job containers use Docker network none by default.
worker --network bridge opts in to egress. Service containers start
only with that opt-in. A host that upgrades onto a tree where the
job network defaults to none adds --network bridge on that
host's unit when jobs need egress. Cargo and pip need it. The
repository unit omits the flag.

A job container is created with --security-opt no-new-privileges
and --cap-drop ALL. Passwordless sudo is off unless the worker is
started with --passwordless-sudo.

A bash or sh run script quotes each expression. An expression in
eval or in a shell -c command is refused. A pull request that
changes a workflow file is refused. A missing pull request author
association is refused.

Every engine call uses the Docker context named default unless
worker --docker-context or ROOKRUNNER_DOCKER_CONTEXT names one.
An inherited DOCKER_CONTEXT or DOCKER_HOST does not select the
engine.

A host copy of the worker unit must set NoNewPrivileges=yes.
The repository unit sets that directive. A copy that omits it is
reported by systemd as NoNewPrivileges=no and must be set to yes.

The acceptance platform is Linux x86_64. Other platforms are not
claimed. The acceptance interpreter is Python 3.12. The package
requires Python 3.11 or newer.

PyYAML 6.0.3 is installed with the wheel and is not vendored.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The worker has no listen socket. The one write grant the planner
accepts is id-token: write. Every other write stays rejected.

A poll pass keeps going when an older claimed run has no readable
snapshot. That run is skipped and later runs still post.

Passwordless sudo still drops every capability. It then keeps
SETUID, SETGID, AUDIT_WRITE, CHOWN, DAC_OVERRIDE,
DAC_READ_SEARCH, and FOWNER. Root in that job can chown and
chmod the apt partial directories, unlink a file in a mode-0700
directory owned by another user, and stat a mode-0700 workspace
owned by the job user. A job without that opt-in still sets
no-new-privileges and adds no capabilities.

Rookrunner can act as an OIDC issuer for jobs. Signing keys are RSA
files of at least 2048 bits under oidc/ in the key directory.
oidc publish writes the discovery document and the public key set
for the issuer host. Only the public key members are written.

A per-job token endpoint runs only when the worker is started with
worker --oidc-issuer. That flag is off by default, and startup
refuses when the active signing key is missing, unreadable, or
below 2048 bits. A job must grant id-token: write. The run must
be trusted: a fork, an override run, and a run the secret allowlist
does not match receive no token. A same-repository pull request
also needs worker --oidc-pull-request. A job that passes gets
ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN
in every step, and trades them for a token that lives for five
minutes. A job that does not pass runs without them, and the
refusal is audited. Jobs that use a token need --network bridge.
Each mint and each refusal is one line in oidc-audit.jsonl,
without the token.

A pre-commit hook rejects an unformatted staged Python file under
src/ or tests/. scripts/install-hooks.sh points a clone at
the hook.

The project license is the MIT License.

The App private key is not in the artifact.

v0.1.7 preview

v0.1.7 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.7. The capability version is 12.

Job containers use Docker network none by default.
worker --network bridge opts in to egress. Service containers start
only with that opt-in. A host that upgrades onto a tree where the
job network defaults to none adds --network bridge on that
host's unit when jobs need egress. Cargo and pip need it. The
repository unit omits the flag.

A job container is created with --security-opt no-new-privileges
and --cap-drop ALL. Passwordless sudo is off unless the worker is
started with --passwordless-sudo.

A bash or sh run script quotes each expression. An expression in
eval or in a shell -c command is refused. A pull request that
changes a workflow file is refused. A missing pull request author
association is refused.

Every engine call uses the Docker context named default unless
worker --docker-context or ROOKRUNNER_DOCKER_CONTEXT names one.
An inherited DOCKER_CONTEXT or DOCKER_HOST does not select the
engine.

A host copy of the worker unit must set NoNewPrivileges=yes.
The repository unit sets that directive. A copy that omits it is
reported by systemd as NoNewPrivileges=no and must be set to yes.

The acceptance platform is Linux x86_64. Other platforms are not
claimed. The acceptance interpreter is Python 3.12. The package
requires Python 3.11 or newer.

PyYAML 6.0.3 is installed with the wheel and is not vendored.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The worker has no listen socket. Write permissions stay rejected.

A poll pass keeps going when an older claimed run has no readable
snapshot. That run is skipped and later runs still post.

Passwordless sudo still drops every capability. It then keeps
SETUID, SETGID, AUDIT_WRITE, CHOWN, DAC_OVERRIDE,
DAC_READ_SEARCH, and FOWNER. Root in that job can chown and
chmod the apt partial directories, unlink a file in a mode-0700
directory owned by another user, and stat a mode-0700 workspace
owned by the job user. A job without that opt-in still sets
no-new-privileges and adds no capabilities.

The project license is the MIT License.

The App private key is not in the artifact.