v0.4.3 bdc41cd

2026-10-13

5a16c3drefactor(executor): compile the hashFiles regexps once GPG Verifiedbrice
c9a800afix(executor): hashFiles skips FIFOs instead of hanging on them GPG Verifiedbrice
7d09fafbuild: drop the old ermite-actions entries from go.sum GPG Verifiedbrice
527f9ebfeat(executor): implement hashFiles() GPG Verifiedbrice
e88c60ffeat(executor): report template errors like GitHub, with the Json.NET message GPG Verifiedbrice
305254efeat(executor): expose the job token as secrets.GITHUB_TOKEN, masked in the log GPG Verifiedbrice
79df483fix(executor): trim the evaluated job name GPG Verifiedbrice
37766e4fix(executor): evaluate display names with github.job empty like GitHub GPG Verifiedbrice

2026-10-12

3418cfaMerge pull request 'feat(executor): print the GITHUB_TOKEN permissions GitHub grants' (#6) from feat/token-permissions-display into main merge SSH Unverifiedbnema
bdd5903refactor(executor): review fixes for the token permissions display GPG Verifiedbrice
9a7971cfeat(executor): print the GITHUB_TOKEN permissions GitHub grants GPG Verifiedbrice
0cc0cf3Merge pull request 'feat(runner): match github-hosted runner output and contexts' (#5) from feat/runner-parity into main merge SSH Unverifiedbnema
117121adocs(executor): say why the token permissions group is omitted when permissions is set, and test it GPG Verifiedbrice
e0a17adfix(executor): evaluate the job name with the server's contexts and check the matrix before trusting job-index GPG Verifiedbrice
9845c39fix(executor): insert the github keys added by the runner at their sorted place GPG Verifiedbrice
e1538ebfeat(executor): match the github-hosted Set up job log and name the job like GitHub GPG Verifiedbrice
40f1da3fix(executor): give a job without a matrix a null matrix context GPG Verifiedbrice
f9d254afix(executor): set github.action before the step env is evaluated GPG Verifiedbrice
76ad031feat(executor): create the artifacts and artifacts_list file commands GPG Verifiedbrice
61fc6eefeat(host): make runner.environment configurable, github-hosted by default GPG Verifiedbrice
81b458dMerge pull request 'fix(host): call RunnerService under ermite's /-/api path' (#4) from fix/api-path into main merge SSH Unverifiedbnema
0642256test(host): check the API path for base URLs with a prefix and a trailing slash GPG Verifiedbrice
2785ef1fix(host): call RunnerService under ermite's /-/api path GPG Verifiedbrice
16c0ee5Merge pull request 'fix(runner): root-only paths verified on a KVM host' (#3) from fix/igor-root-paths into main merge SSH Unverifiedbnema
579bcb3fix(vm): kill VMM processes through a pidfd after re-checking their identity GPG Verifiedbrice
b72d29ffix(vm): scope an unjailed Firecracker by its --api-sock GPG Verifiedbrice
fd4fcdbdocs: the state directory and its parents must be root-owned GPG Verifiedbrice
5272434test(container): table test for Podman detection in Info GPG Verifiedbrice
25328fcfix(vm): identify the jailed VMM by its root inode, not readlink GPG Verifiedbrice
982af7cfix(vm): refuse an unsafe jailer chroot base GPG Verifiedbrice
bbd315bfix(vm): check every socket path against sun_path, in both jailer modes GPG Verifiedbrice
4f13c7afix(dnsfwd): IP_FREEBIND only for a podman daemon GPG Verifiedbrice
7ddb5dafix(vm): scope the VMM scan to our jail base; share the marker set GPG Verifiedbrice
4bce7e0docs: what the root-only paths showed on a real KVM host GPG Verifiedbrice
83e4171fix(dnsfwd): bind the gateway address with IP_FREEBIND GPG Verifiedbrice
35b40b2test(integration): close the probe driver before the container scenario GPG Verifiedbrice
ea0a5eetest(integration): an empty jail/<exec name> directory is not a leftover GPG Verifiedbrice
2bb0741fix(vm): recognise the Firecracker the jailer execs into its chroot GPG Verifiedbrice
ea344adfix(vm): refuse a state directory whose jailed API socket path exceeds sun_path GPG Verifiedbrice
ed21f4ffix(vm): create the jailer chroot base directory GPG Verifiedbrice
e917abeMerge pull request 'feat(runner): executor, host loop and job frames' (#2) from feat/executor into main merge SSH Unverifiedbnema
b0c2e21ci: fetch the private bnema.dev/ermite* modules through the runner's Forgejo route GPG Verifiedbrice
b60a661fix: lowercase the host name in the loopback check; point the orphan cleanup comments to JobExtension.cs:891-939; drop a stale comment in proc.go GPG Verifiedbrice
799f55cfix(host): AppendNow warns when the log offset may be stale after a send cut short (GO-005) GPG Verifiedbrice
ca9abadfix(host): bound the report by ShutdownReport once the runner's shutdown channel is closed, not CompleteDeadline (GO-004) GPG Verifiedbrice
abd0a01fix(executor): write the step script through the RUNNER_TEMP root, exclusively, instead of an absolute path (GO-002) GPG Verifiedbrice
f9fc798fix(executor): chown the file created by createExcl through its open handle, not by name after the close (GO-003) GPG Verifiedbrice
63269d4fix(unit): drop PrivateTmp, ProtectHome, ProtectKernelModules and ProtectKernelLogs, which hide the loop mounts of container mode from Docker; test that the unit sets no option creating a mount namespace (GO-001) GPG Verifiedbrice
3f47b6ddocs: leave UMask out of the unit and say why (G5) GPG Verifiedbrice
01928f4docs: systemd unit with hardening and the list of what is absent, register with systemd-run and stdin, logs under journald, stop budget (G5, G6) GPG Verifiedbrice

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 4

Tags 11

↑↓ moveenter openesc close