atlas
0302b29ca4
swarm-ci-runner: give the registration token only to the register step ...
The runner got its registration token through an `EnvironmentFile`
(`TOKEN=…`), so the daemon carried it for its whole life, and for a
`host` label act_runner copies its environment into every job step:
any workflow could read a token that registers runners on the forge.
The host unit now writes the bare token, and the runner unit loads it
with `LoadCredential=`. The upstream pre-start step, which registered
from `$TOKEN`, is replaced by one register step that reads the token
from `$CREDENTIALS_DIRECTORY` and runs `act_runner register` only when
`.runner` is missing, with the instance URL, name, labels and config
file upstream used. The precond now also removes `.runner` when its
labels differ from the configured ones, which upstream's step covered.
A changed token alone no longer re-registers.
Host jobs can still read `.runner` itself (#4979 ).
Closes #4974
2026-10-05 16:06:52 +02:00
forge: external forge accounts live in swarm bao; the agent fetches them itself
2026-10-01 18:05:33 +02:00
github swarm bao: address argus review on #4892
2026-10-02 17:54:45 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
hive-agent: the swarm queue connection is required; retry, then exit
2026-10-04 22:24:51 +02:00
module-eval: pin a claude agent's subagent store identity
2026-10-03 01:34:01 +02:00
agents: chown work/ recursively only on owner mismatch
2026-10-05 13:01:14 +02:00
matrix: drop the per-hive appservice and its unused token
2026-10-05 07:48:17 +02:00
swarm-controller: revoke matrix admin from former operators
2026-10-05 12:39:02 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
swarm-ci-runner: run the forge CI runner as a swarm service
2026-10-05 13:55:37 +02:00
swarm-ci-runner: give the registration token only to the register step
2026-10-05 16:06:52 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
nix: finish the current-behaviour comment sweep in touched files
2026-10-05 09:58:57 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
nix: comments state current behaviour, not history
2026-10-05 09:58:50 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
forgejo: actionsFromSelf defaults to whether this host runs the swarm-controller
2026-10-05 13:55:37 +02:00
0302b29ca4