vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Run CI jobs in a container chosen by the runner

7da9111ecabb236d48fc48592cd3d1d45f9afe78 · Keenan Nemetz · 15d ago · parent 474a812d

Run CI jobs in a container chosen by the runner

Each lease gets a disposable checkout and, when --image is set, its own container from that image. The runner keeps the SSH key and trusted Git cache outside the job, so workflow code cannot reach either; older caches are rebuilt because a previous job may have written to them.

The record names the image and runtime, and the queue mirrors them for the run page. Without --image the runner still executes on the host and says so.

server/ssh/runner.go +5−4

@@ -329,10 +329,11 @@ func (s *Server) serveRunner(ch xssh.Channel, user, accountID string) {
	329	329	continue
	330	330	}
	331	331	}
	332		// The machine is a claim from the record, mirrored under the same rule as the
	333		// log and the artifacts: written only while this runner still holds the lease,
	334		// so a runner that was overtaken leaves no claim behind.
	335		if mirrored, err := cfg.Runs.RecordMachine(run.ID, owner, rec.OS, rec.Arch); err != nil {
		332	// The machine and container environment are claims from the record, mirrored
		333	// under the same rule as the log and the artifacts: written only while this
		334	// runner still holds the lease, so a runner that was overtaken leaves no claim
		335	// behind.
		336	if mirrored, err := cfg.Runs.RecordEnvironment(run.ID, owner, rec.OS, rec.Arch, rec.Image, rec.Runtime); err != nil {
	336	337	_ = enc.Encode(runnerReply{Op: "finish", Error: err.Error()})
	337	338	continue
	338	339	} else if !mirrored {