v0.1.10 preview

v0.1.10 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.10. The capability version is 12.

Job containers use Docker network none by default.
worker --network bridge opts in to egress. Service containers start
only with that opt-in. A host that upgrades onto a tree where the
job network defaults to none adds --network bridge on that
host's unit when jobs need egress. Cargo and pip need it. The
repository unit omits the flag.

A job container is created with --security-opt no-new-privileges
and --cap-drop ALL. Passwordless sudo is off unless the worker is
started with --passwordless-sudo.

A bash or sh run script quotes each expression. An expression in
eval or in a shell -c command is refused. A pull request that
changes a workflow file is refused. A missing pull request author
association is refused.

Every engine call uses the Docker context named default unless
worker --docker-context or ROOKRUNNER_DOCKER_CONTEXT names one.
An inherited DOCKER_CONTEXT or DOCKER_HOST does not select the
engine.

A host copy of the worker unit must set NoNewPrivileges=yes.
The repository unit sets that directive. A copy that omits it is
reported by systemd as NoNewPrivileges=no and must be set to yes.

The acceptance platform is Linux x86_64. Other platforms are not
claimed. The acceptance interpreter is Python 3.12. The package
requires Python 3.11 or newer.

PyYAML 6.0.3 is installed with the wheel and is not vendored.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The worker has no listen socket. The one write grant the planner
accepts is id-token: write. Every other write stays rejected.

A poll pass keeps going when an older claimed run has no readable
snapshot. That run is skipped and later runs still post.

Passwordless sudo still drops every capability. It then keeps
SETUID, SETGID, AUDIT_WRITE, CHOWN, DAC_OVERRIDE,
DAC_READ_SEARCH, and FOWNER. Root in that job can chown and
chmod the apt partial directories, unlink a file in a mode-0700
directory owned by another user, and stat a mode-0700 workspace
owned by the job user. A job without that opt-in still sets
no-new-privileges and adds no capabilities.

Job privileges are off by default. A worker started with
worker --job-privileges keeps --cap-drop ALL for its job
containers and adds only CAP_SYS_CHROOT, plus a seccomp profile
that allows personality on top of the Docker default profile.
That allowance is restricted to the values setarch needs: 0,
262144, and 0xffffffff. The profile ships as
seccomp-personality.json and now matches the current Docker
default profile. The prior profile had no clone3 entry, so a
job container on a --job-privileges worker could fail during
container setup on current Linux Docker. The regenerated
profile allows clone3 with CAP_SYS_ADMIN and returns
ENOSYS (38) without it, and adds no pivot_root allowance.
The personality allowance stays restricted to the values
setarch needs, with no unconditional entry. The flag composes
with --passwordless-sudo. A step running as the job user gets
the personality allowance directly. chroot takes effect
for steps running as root, for example under
--passwordless-sudo. That serves a chroot smoke step and a
bench step that runs Callgrind under setarch. Without the
flag, the job container arguments are unchanged. The
capability version stays 12.

Rookrunner can act as an OIDC issuer for jobs. Signing keys are RSA
files of at least 2048 bits under oidc/ in the key directory.
oidc publish writes the discovery document and the public key set
for the issuer host. Only the public key members are written.

A per-job token endpoint runs only when the worker is started with
worker --oidc-issuer. That flag is off by default, and startup
refuses when the active signing key is missing, unreadable, or
below 2048 bits. A job must grant id-token: write. The run must
be trusted: a fork, an override run, and a run the secret allowlist
does not match receive no token. A same-repository pull request
also needs worker --oidc-pull-request. A job that passes gets
ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN
in every step, and trades them for a token that lives for five
minutes. A job that does not pass runs without them, and the
refusal is audited. Jobs that use a token need --network bridge.
Each mint and each refusal is one line in oidc-audit.jsonl,
without the token.

A pre-commit hook rejects an unformatted staged Python file under
src/ or tests/. scripts/install-hooks.sh points a clone at
the hook.

The project license is the MIT License.

The App private key is not in the artifact.