2026-10-12T12:25:21.6008759Z ##[group]Run actions/checkout@v5
2026-10-12T12:25:21.6008794Z with:
2026-10-12T12:25:21.6008806Z   allow-unsafe-pr-checkout: false
2026-10-12T12:25:21.6008817Z   clean: true
2026-10-12T12:25:21.6008826Z   fetch-depth: 1
2026-10-12T12:25:21.6008836Z   fetch-tags: false
2026-10-12T12:25:21.6008845Z   filter: 
2026-10-12T12:25:21.6008853Z   github-server-url: 
2026-10-12T12:25:21.6008862Z   lfs: false
2026-10-12T12:25:21.6008871Z   path: 
2026-10-12T12:25:21.6008881Z   persist-credentials: true
2026-10-12T12:25:21.6008890Z   ref: 
2026-10-12T12:25:21.6008898Z   repository: flagon-io/g1t
2026-10-12T12:25:21.6008906Z   set-safe-directory: true
2026-10-12T12:25:21.6008915Z   show-progress: true
2026-10-12T12:25:21.6008923Z   sparse-checkout: 
2026-10-12T12:25:21.6008932Z   sparse-checkout-cone-mode: true
2026-10-12T12:25:21.6008940Z   ssh-key: 
2026-10-12T12:25:21.6008948Z   ssh-known-hosts: 
2026-10-12T12:25:21.6008958Z   ssh-strict: true
2026-10-12T12:25:21.6008966Z   ssh-user: git
2026-10-12T12:25:21.6008975Z   submodules: false
2026-10-12T12:25:21.6009018Z   token: ***
2026-10-12T12:25:21.6009027Z env:
2026-10-12T12:25:21.6009080Z   CLOUDFLARE_ACCOUNT_ID: 1e6f2cffa3f445920836e8ebe446bb58
2026-10-12T12:25:21.6009089Z   WRANGLER_SEND_METRICS: false
2026-10-12T12:25:21.6009098Z ##[endgroup]
2026-10-12T12:25:21.9769588Z Syncing repository: flagon-io/g1t
2026-10-12T12:25:21.9769650Z ##[group]Getting Git version info
2026-10-12T12:25:21.9769685Z Working directory is '/home/runner/work/repo'
2026-10-12T12:25:21.9788978Z [command]/usr/bin/git version
2026-10-12T12:25:21.9882415Z git version 2.39.5
2026-10-12T12:25:21.9897143Z ##[endgroup]
2026-10-12T12:25:21.9909294Z Temporarily overriding HOME='/home/runner/_temp/003c6544-adf9-4d4b-b0c7-7b86e839fa90' before making global git config changes
2026-10-12T12:25:21.9909699Z Adding repository directory to the temporary git global config as a safe directory
2026-10-12T12:25:21.9913230Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/repo
2026-10-12T12:25:21.9949321Z Deleting the contents of '/home/runner/work/repo'
2026-10-12T12:25:21.9952841Z ##[group]Initializing the repository
2026-10-12T12:25:21.9956056Z [command]/usr/bin/git init /home/runner/work/repo
2026-10-12T12:25:22.0022345Z hint: Using 'master' as the name for the initial branch. This default branch name
2026-10-12T12:25:22.0022449Z hint: is subject to change. To configure the initial branch name to use in all
2026-10-12T12:25:22.0022506Z hint: of your new repositories, which will suppress this warning, call:
2026-10-12T12:25:22.0022527Z hint: 
2026-10-12T12:25:22.0022546Z hint: 	git config --global init.defaultBranch <name>
2026-10-12T12:25:22.0022561Z hint: 
2026-10-12T12:25:22.0022604Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
2026-10-12T12:25:22.0022645Z hint: 'development'. The just-created branch can be renamed via this command:
2026-10-12T12:25:22.0022658Z hint: 
2026-10-12T12:25:22.0022678Z hint: 	git branch -m <name>
2026-10-12T12:25:22.0030373Z Initialized empty Git repository in /home/runner/work/repo/.git/
2026-10-12T12:25:22.0039571Z [command]/usr/bin/git remote add origin https://g1t.sh/flagon-io/g1t
2026-10-12T12:25:22.0073730Z ##[endgroup]
2026-10-12T12:25:22.0073833Z ##[group]Disabling automatic garbage collection
2026-10-12T12:25:22.0078424Z [command]/usr/bin/git config --local gc.auto 0
2026-10-12T12:25:22.0108639Z ##[endgroup]
2026-10-12T12:25:22.0108724Z ##[group]Setting up auth
2026-10-12T12:25:22.0115721Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
2026-10-12T12:25:22.0146263Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
2026-10-12T12:25:22.0576516Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/g1t\.sh\/\.extraheader
2026-10-12T12:25:22.0607467Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/g1t\.sh\/\.extraheader' && git config --local --unset-all 'http.https://g1t.sh/.extraheader' || :"
2026-10-12T12:25:22.0931623Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
2026-10-12T12:25:22.0964041Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
2026-10-12T12:25:22.1236129Z [command]/usr/bin/git config --local http.https://g1t.sh/.extraheader AUTHORIZATION: basic ***
2026-10-12T12:25:22.1276850Z ##[endgroup]
2026-10-12T12:25:22.1276967Z ##[group]Fetching the repository
2026-10-12T12:25:22.1283398Z [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +c8e1680a6c3f096bc36c42130426479f9a59d725:refs/tags/desktop-v0.3.2
2026-10-12T12:25:23.2591976Z From https://g1t.sh/flagon-io/g1t
2026-10-12T12:25:23.2592162Z  * [new ref]         c8e1680a6c3f096bc36c42130426479f9a59d725 -> desktop-v0.3.2
2026-10-12T12:25:23.2616021Z ##[endgroup]
2026-10-12T12:25:23.2616125Z ##[group]Determining the checkout info
2026-10-12T12:25:23.2618340Z ##[endgroup]
2026-10-12T12:25:23.2624126Z [command]/usr/bin/git sparse-checkout disable
2026-10-12T12:25:23.2666313Z [command]/usr/bin/git config --local --unset-all extensions.worktreeConfig
2026-10-12T12:25:23.2695457Z ##[group]Checking out the ref
2026-10-12T12:25:23.2701750Z [command]/usr/bin/git checkout --progress --force refs/tags/desktop-v0.3.2
2026-10-12T12:25:23.5052458Z Note: switching to 'refs/tags/desktop-v0.3.2'.
2026-10-12T12:25:23.5052536Z 
2026-10-12T12:25:23.5052630Z You are in 'detached HEAD' state. You can look around, make experimental
2026-10-12T12:25:23.5052698Z changes and commit them, and you can discard any commits you make in this
2026-10-12T12:25:23.5052759Z state without impacting any branches by switching back to a branch.
2026-10-12T12:25:23.5052771Z 
2026-10-12T12:25:23.5052813Z If you want to create a new branch to retain commits you create, you may
2026-10-12T12:25:23.5052848Z do so (now or later) by using -c with the switch command. Example:
2026-10-12T12:25:23.5052861Z 
2026-10-12T12:25:23.5052888Z   git switch -c <new-branch-name>
2026-10-12T12:25:23.5052901Z 
2026-10-12T12:25:23.5052913Z Or undo this operation with:
2026-10-12T12:25:23.5052923Z 
2026-10-12T12:25:23.5052934Z   git switch -
2026-10-12T12:25:23.5052944Z 
2026-10-12T12:25:23.5052982Z Turn off this advice by setting config variable advice.detachedHead to false
2026-10-12T12:25:23.5052992Z 
2026-10-12T12:25:23.5053488Z HEAD is now at c8e1680 The desktop app is 0.3.2, and its runner updates are fast, seen and only ever g1t's. The app now trusts a g1t-runner release only when its manifest's Ed25519 signature, latest.json.sig, checks out against g1t's runner release key, which is built into the app (the public half of RUNNER_RELEASE_PUBLIC_KEY, kept in runner/native.rs, where development builds have it too; G1T_RUNNER_RELEASE_KEY overrides it for a g1t with its own key), as the runner already did with its own updates. A manifest with no signature, or one that doesn't check out, is refused and nothing in it is used: the runner keeps the version it has and says "Update refused: not signed by g1t", or, with no runner installed yet, "Not running: the runner's release isn't signed by g1t", each with why and what to do. It looks every hour rather than every six, on a thread of its own so the runner is looked after meanwhile, and what it finds waits, downloaded and checked, until each kind of job is idle, then goes in kind by kind, never cutting a job short: Linux jobs take the release's image (sandbox update) as soon as they have no job, while Windows jobs, whose runner is the program itself, are stopped after their job (sandbox down --only windows --drain), the program is replaced and they start again, the other kind running on throughout; a runner in Docker or on the computer stops between jobs and starts on the new one. The program there is moved aside rather than overwritten, so a status the app is asking at that moment can't stop it. Each kind of job's card in Settings shows its runner version, when the app last looked ("Checked 12 min ago") and a newer one waiting ("0.3.2 ready, installs after this job", "Installing 0.3.2"), and "Check for runner updates" beside the computer's name looks at once and installs what it finds, even with "Download updates by themselves" off, which otherwise stops the hourly look. The desktop report carries the same (snake_case: the diagnosis's update, with checked_at, ready and note, and each kind's update), so the Runners page's Desktops cards show it, "Checked" with how long ago, and this computer's row has the button too. All the words are diagnosis.rs's. The desktop guide says how updates work, what each card shows, the new troubleshooting rows and where the release key lives. Tests cover the signature with a key pair of their own and with release 0.3.0's manifest and signature as g1t.sh published them, kept byte for byte (.gitattributes), the wording, the cards and the report.
2026-10-12T12:25:23.5066536Z ##[endgroup]
2026-10-12T12:25:23.5108352Z [command]/usr/bin/git log -1 --format=%H
2026-10-12T12:25:23.5130759Z c8e1680a6c3f096bc36c42130426479f9a59d725
