Skip to content

v0.1.7 preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 19:30
· 117 commits to main since this release
v0.1.7
This tag was signed with the committer’s verified signature.
mb2090 MB2090
SSH Key Fingerprint: mQnUJO/U7i4+cmuIvBHrBAUmC/3u+M1r0pue2bakV3Q
Verified
Learn about vigilant mode.
ddd79e3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.1.7 preview

This artifact is a preview. It is not a claim of GitHub Actions
equivalence.

The version string is 0.1.7. The capability version is 12.

Job containers use Docker network none by default.
worker --network bridge opts in to egress. Service containers start
only with that opt-in. A host that upgrades onto a tree where the
job network defaults to none adds --network bridge on that
host's unit when jobs need egress. Cargo and pip need it. The
repository unit omits the flag.

A job container is created with --security-opt no-new-privileges
and --cap-drop ALL. Passwordless sudo is off unless the worker is
started with --passwordless-sudo.

A bash or sh run script quotes each expression. An expression in
eval or in a shell -c command is refused. A pull request that
changes a workflow file is refused. A missing pull request author
association is refused.

Every engine call uses the Docker context named default unless
worker --docker-context or ROOKRUNNER_DOCKER_CONTEXT names one.
An inherited DOCKER_CONTEXT or DOCKER_HOST does not select the
engine.

A host copy of the worker unit must set NoNewPrivileges=yes.
The repository unit sets that directive. A copy that omits it is
reported by systemd as NoNewPrivileges=no and must be set to yes.

The acceptance platform is Linux x86_64. Other platforms are not
claimed. The acceptance interpreter is Python 3.12. The package
requires Python 3.11 or newer.

PyYAML 6.0.3 is installed with the wheel and is not vendored.

The wheel and the source tarball can be built from this tree. They
are not published. This file does not create a tag.

The worker has no listen socket. Write permissions stay rejected.

A poll pass keeps going when an older claimed run has no readable
snapshot. That run is skipped and later runs still post.

Passwordless sudo still drops every capability. It then keeps
SETUID, SETGID, AUDIT_WRITE, CHOWN, DAC_OVERRIDE,
DAC_READ_SEARCH, and FOWNER. Root in that job can chown and
chmod the apt partial directories, unlink a file in a mode-0700
directory owned by another user, and stat a mode-0700 workspace
owned by the job user. A job without that opt-in still sets
no-new-privileges and adds no capabilities.

The project license is the MIT License.

The App private key is not in the artifact.

Assets 5
Loading