2026-10-12T12:22:39.9900908Z ##[group]Run actions/checkout@v5
2026-10-12T12:22:39.9900949Z with:
2026-10-12T12:22:39.9900962Z   allow-unsafe-pr-checkout: false
2026-10-12T12:22:39.9900976Z   clean: true
2026-10-12T12:22:39.9900985Z   fetch-depth: 1
2026-10-12T12:22:39.9900996Z   fetch-tags: false
2026-10-12T12:22:39.9901006Z   filter: 
2026-10-12T12:22:39.9901016Z   github-server-url: 
2026-10-12T12:22:39.9901026Z   lfs: false
2026-10-12T12:22:39.9901037Z   path: 
2026-10-12T12:22:39.9901048Z   persist-credentials: true
2026-10-12T12:22:39.9901059Z   ref: 
2026-10-12T12:22:39.9901071Z   repository: flagon-io/g1t
2026-10-12T12:22:39.9901082Z   set-safe-directory: true
2026-10-12T12:22:39.9901091Z   show-progress: true
2026-10-12T12:22:39.9901101Z   sparse-checkout: 
2026-10-12T12:22:39.9901110Z   sparse-checkout-cone-mode: true
2026-10-12T12:22:39.9901120Z   ssh-key: 
2026-10-12T12:22:39.9901130Z   ssh-known-hosts: 
2026-10-12T12:22:39.9901256Z   ssh-strict: true
2026-10-12T12:22:39.9901265Z   ssh-user: git
2026-10-12T12:22:39.9901275Z   submodules: false
2026-10-12T12:22:39.9901325Z   token: ***
2026-10-12T12:22:39.9901335Z env:
2026-10-12T12:22:39.9901405Z   CLOUDFLARE_ACCOUNT_ID: 1e6f2cffa3f445920836e8ebe446bb58
2026-10-12T12:22:39.9901417Z   WRANGLER_SEND_METRICS: false
2026-10-12T12:22:39.9901427Z ##[endgroup]
2026-10-12T12:22:40.9456815Z Syncing repository: flagon-io/g1t
2026-10-12T12:22:41.1315013Z ##[group]Getting Git version info
2026-10-12T12:22:41.1315159Z Working directory is '/home/runner/work/repo'
2026-10-12T12:22:41.1315196Z [command]/usr/bin/git version
2026-10-12T12:22:41.1315220Z git version 2.39.5
2026-10-12T12:22:41.1315289Z ##[endgroup]
2026-10-12T12:22:41.1315914Z Temporarily overriding HOME='/home/runner/_temp/111efafc-b7f8-4677-886e-0941dd38825a' before making global git config changes
2026-10-12T12:22:41.1316009Z Adding repository directory to the temporary git global config as a safe directory
2026-10-12T12:22:41.1316100Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/repo
2026-10-12T12:22:41.1316155Z Deleting the contents of '/home/runner/work/repo'
2026-10-12T12:22:41.1316179Z ##[group]Initializing the repository
2026-10-12T12:22:41.1316211Z [command]/usr/bin/git init /home/runner/work/repo
2026-10-12T12:22:41.1316293Z hint: Using 'master' as the name for the initial branch. This default branch name
2026-10-12T12:22:41.1316371Z hint: is subject to change. To configure the initial branch name to use in all
2026-10-12T12:22:41.1316449Z hint: of your new repositories, which will suppress this warning, call:
2026-10-12T12:22:41.1316465Z hint: 
2026-10-12T12:22:41.1316491Z hint: 	git config --global init.defaultBranch <name>
2026-10-12T12:22:41.1316504Z hint: 
2026-10-12T12:22:41.1316568Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
2026-10-12T12:22:41.1316642Z hint: 'development'. The just-created branch can be renamed via this command:
2026-10-12T12:22:41.1316656Z hint: 
2026-10-12T12:22:41.1316670Z hint: 	git branch -m <name>
2026-10-12T12:22:41.1316726Z Initialized empty Git repository in /home/runner/work/repo/.git/
2026-10-12T12:22:41.1316814Z [command]/usr/bin/git remote add origin https://g1t.sh/flagon-io/g1t
2026-10-12T12:22:41.1317037Z ##[endgroup]
2026-10-12T12:22:41.1317069Z ##[group]Disabling automatic garbage collection
2026-10-12T12:22:41.1317091Z [command]/usr/bin/git config --local gc.auto 0
2026-10-12T12:22:41.1317115Z ##[endgroup]
2026-10-12T12:22:41.1317132Z ##[group]Setting up auth
2026-10-12T12:22:41.1317195Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
2026-10-12T12:22:41.1317335Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
2026-10-12T12:22:41.2572175Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/g1t\.sh\/\.extraheader
2026-10-12T12:22:41.2654298Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/g1t\.sh\/\.extraheader' && git config --local --unset-all 'http.https://g1t.sh/.extraheader' || :"
2026-10-12T12:22:41.3212548Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
2026-10-12T12:22:41.3254883Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
2026-10-12T12:22:41.3643918Z [command]/usr/bin/git config --local http.https://g1t.sh/.extraheader AUTHORIZATION: basic ***
2026-10-12T12:22:41.3697128Z ##[endgroup]
2026-10-12T12:22:41.3697245Z ##[group]Fetching the repository
2026-10-12T12:22:41.3714915Z [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +c8e1680a6c3f096bc36c42130426479f9a59d725:refs/tags/desktop-v0.3.2
2026-10-12T12:22:42.8126358Z From https://g1t.sh/flagon-io/g1t
2026-10-12T12:22:42.8126557Z  * [new ref]         c8e1680a6c3f096bc36c42130426479f9a59d725 -> desktop-v0.3.2
2026-10-12T12:22:42.8184320Z ##[endgroup]
2026-10-12T12:22:42.8185795Z ##[group]Determining the checkout info
2026-10-12T12:22:42.8187968Z ##[endgroup]
2026-10-12T12:22:42.8199531Z [command]/usr/bin/git sparse-checkout disable
2026-10-12T12:22:42.8259846Z [command]/usr/bin/git config --local --unset-all extensions.worktreeConfig
2026-10-12T12:22:42.8300084Z ##[group]Checking out the ref
2026-10-12T12:22:42.8312868Z [command]/usr/bin/git checkout --progress --force refs/tags/desktop-v0.3.2
2026-10-12T12:22:43.2598026Z Note: switching to 'refs/tags/desktop-v0.3.2'.
2026-10-12T12:22:44.3447489Z 
2026-10-12T12:22:44.5115819Z You are in 'detached HEAD' state. You can look around, make experimental
2026-10-12T12:22:44.5115958Z changes and commit them, and you can discard any commits you make in this
2026-10-12T12:22:44.5116041Z state without impacting any branches by switching back to a branch.
2026-10-12T12:22:44.5116063Z 
2026-10-12T12:22:44.5116142Z If you want to create a new branch to retain commits you create, you may
2026-10-12T12:22:44.5116207Z do so (now or later) by using -c with the switch command. Example:
2026-10-12T12:22:44.5116226Z 
2026-10-12T12:22:44.5116243Z   git switch -c <new-branch-name>
2026-10-12T12:22:44.5116256Z 
2026-10-12T12:22:44.5116273Z Or undo this operation with:
2026-10-12T12:22:44.5116285Z 
2026-10-12T12:22:44.5116303Z   git switch -
2026-10-12T12:22:44.5116315Z 
2026-10-12T12:22:44.5116388Z Turn off this advice by setting config variable advice.detachedHead to false
2026-10-12T12:22:44.5116410Z 
2026-10-12T12:22:44.5117376Z HEAD is now at c8e1680 The desktop app is 0.3.2, and its runner updates are fast, seen and only ever g1t's. The app now trusts a g1t-runner release only when its manifest's Ed25519 signature, latest.json.sig, checks out against g1t's runner release key, which is built into the app (the public half of RUNNER_RELEASE_PUBLIC_KEY, kept in runner/native.rs, where development builds have it too; G1T_RUNNER_RELEASE_KEY overrides it for a g1t with its own key), as the runner already did with its own updates. A manifest with no signature, or one that doesn't check out, is refused and nothing in it is used: the runner keeps the version it has and says "Update refused: not signed by g1t", or, with no runner installed yet, "Not running: the runner's release isn't signed by g1t", each with why and what to do. It looks every hour rather than every six, on a thread of its own so the runner is looked after meanwhile, and what it finds waits, downloaded and checked, until each kind of job is idle, then goes in kind by kind, never cutting a job short: Linux jobs take the release's image (sandbox update) as soon as they have no job, while Windows jobs, whose runner is the program itself, are stopped after their job (sandbox down --only windows --drain), the program is replaced and they start again, the other kind running on throughout; a runner in Docker or on the computer stops between jobs and starts on the new one. The program there is moved aside rather than overwritten, so a status the app is asking at that moment can't stop it. Each kind of job's card in Settings shows its runner version, when the app last looked ("Checked 12 min ago") and a newer one waiting ("0.3.2 ready, installs after this job", "Installing 0.3.2"), and "Check for runner updates" beside the computer's name looks at once and installs what it finds, even with "Download updates by themselves" off, which otherwise stops the hourly look. The desktop report carries the same (snake_case: the diagnosis's update, with checked_at, ready and note, and each kind's update), so the Runners page's Desktops cards show it, "Checked" with how long ago, and this computer's row has the button too. All the words are diagnosis.rs's. The desktop guide says how updates work, what each card shows, the new troubleshooting rows and where the release key lives. Tests cover the signature with a key pair of their own and with release 0.3.0's manifest and signature as g1t.sh published them, kept byte for byte (.gitattributes), the wording, the cards and the report.
2026-10-12T12:22:44.5117818Z ##[endgroup]
2026-10-12T12:22:44.5119804Z [command]/usr/bin/git log -1 --format=%H
2026-10-12T12:22:44.5120024Z c8e1680a6c3f096bc36c42130426479f9a59d725
