Skip to content
Sign up

flagon-io/g1t

public
0
68 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Compare diffs from where the two branches last agreed, as a pull request would1// node --test scripts/runner-release.test.mjs
2import assert from "node:assert/strict";
3import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
4import { tmpdir } from "node:os";
5import { join } from "node:path";
6import { test } from "node:test";
7import { createPrivateKey } from "node:crypto";
8
9import { TARGETS, keygen, manifest, sha256, signBytes, verifyBytes, version } from "./runner-release.mjs";
Merge the runner sandbox: g1t-runner sandbox up makes a person's own computer a self-hosted runner that nothing a job runs can get out of. Linux jobs run in a Linux VM of the runner's own (a WSL 2 distribution with no host mounts, interop or Docker socket on Windows; vfkit on macOS; Sysbox, or QEMU and KVM, on Linux), each in a fresh container under Sysbox inside it; on Windows 11 Pro and up, Windows jobs each run in a Windows Sandbox discarded after the job. Runners report their isolation, and the Runners page shows it.10import { sandboxFiles, section } from "./sandbox-image.mjs";
Compare diffs from where the two branches last agreed, as a pull request would11
12test("a release is signed with the private key and checked with the raw public key", () => {
13 const keys = keygen();
14 assert.equal(Buffer.from(keys.public, "base64").length, 32);
15 const key = createPrivateKey({ key: Buffer.from(keys.private, "base64"), format: "der", type: "pkcs8" });
16 const bytes = Buffer.from('{"version":"0.2.0","files":{}}');
17 const signature = signBytes(bytes, key);
18 assert.equal(Buffer.from(signature, "base64").length, 64);
19 assert.ok(verifyBytes(bytes, signature, keys.public));
20 assert.ok(!verifyBytes(Buffer.from('{"version":"9.9.9","files":{}}'), signature, keys.public));
21 assert.ok(!verifyBytes(bytes, signature, keygen().public));
22});
23
24test("the manifest names each binary that was built, with its SHA-256", () => {
25 const dir = mkdtempSync(join(tmpdir(), "runner-release-"));
26 try {
27 writeFileSync(join(dir, TARGETS["linux-x64"].file), "linux");
28 writeFileSync(join(dir, TARGETS["windows-x64"].file), "windows");
The runner no longer runs g1t's own agents. Cloud and self-hosted runners now do what a forge's runner does: Actions jobs, required checks, merge checks and merge-queue test runs, deployments, dependency bumps and backups. Everything that started Claude Code in a sandbox on an issue or pull request is gone, with its prompts, model access, mentions, delegation, plans, reviews, revisions and the workspace agents' computers.29 const m = manifest(dir, "0.2.0");
Compare diffs from where the two branches last agreed, as a pull request would30 assert.equal(m.version, "0.2.0");
The runner no longer runs g1t's own agents. Cloud and self-hosted runners now do what a forge's runner does: Actions jobs, required checks, merge checks and merge-queue test runs, deployments, dependency bumps and backups. Everything that started Claude Code in a sandbox on an issue or pull request is gone, with its prompts, model access, mentions, delegation, plans, reviews, revisions and the workspace agents' computers.31 assert.equal("agent_image" in m, false);
Compare diffs from where the two branches last agreed, as a pull request would32 assert.deepEqual(Object.keys(m.files).sort(), ["linux-x64", "windows-x64"]);
33 assert.equal(m.files["linux-x64"].sha256, sha256(Buffer.from("linux")));
34 assert.equal(m.files["windows-x64"].name, "g1t-runner-windows-x64.exe");
35 } finally {
36 rmSync(dir, { recursive: true, force: true });
37 }
38});
39
40test("platforms are named as the runner names them", () => {
41 assert.deepEqual(Object.keys(TARGETS).sort(), ["linux-arm64", "linux-x64", "macos-arm64", "macos-x64", "windows-x64"]);
42 assert.match(version(), /^\d+\.\d+\.\d+/);
43});
Merge the runner sandbox: g1t-runner sandbox up makes a person's own computer a self-hosted runner that nothing a job runs can get out of. Linux jobs run in a Linux VM of the runner's own (a WSL 2 distribution with no host mounts, interop or Docker socket on Windows; vfkit on macOS; Sysbox, or QEMU and KVM, on Linux), each in a fresh container under Sysbox inside it; on Windows 11 Pro and up, Windows jobs each run in a Windows Sandbox discarded after the job. Runners report their isolation, and the Runners page shows it.44
45test("the sandbox's images join the signed manifest, and one that is missing is refused", async () => {
46 const dir = mkdtempSync(join(tmpdir(), "runner-release-sandbox-"));
47 try {
48 writeFileSync(join(dir, TARGETS["linux-x64"].file), "linux");
49 writeFileSync(join(dir, sandboxFiles("x64")["wsl-x64"]), "rootfs");
50 const s = await section(dir, "g1t.sh/flagon-io/g1t-runner@sha256:ab");
51 assert.deepEqual(Object.keys(s.files), ["wsl-x64"]);
52 assert.equal(s.files["wsl-x64"].sha256, sha256(Buffer.from("rootfs")));
53 assert.equal(s.files["wsl-x64"].size, 6);
54 writeFileSync(join(dir, "sandbox.json"), JSON.stringify(s));
55 const m = manifest(dir, "0.3.0");
56 assert.equal(m.sandbox.runner_image, "g1t.sh/flagon-io/g1t-runner@sha256:ab");
57 assert.equal(m.sandbox.files["wsl-x64"].name, "g1t-sandbox-wsl-x64.tar.gz");
58 writeFileSync(join(dir, "sandbox.json"), JSON.stringify({ runner_image: null, files: { "vm-x64-disk": { name: "gone.raw.gz", sha256: "00" } } }));
59 assert.throws(() => manifest(dir, "0.3.0"), /gone\.raw\.gz/);
60 } finally {
61 rmSync(dir, { recursive: true, force: true });
62 }
63});
64
65test("the sandbox's files are named as the launcher asks for them", () => {
66 // crates/runner/src/selfhosted/launcher: wsl.rs's and vm.rs's image_keys().
67 assert.deepEqual(Object.keys(sandboxFiles("arm64")), ["wsl-arm64", "vm-arm64-kernel", "vm-arm64-initrd", "vm-arm64-disk"]);
68});

This file's history is long; its oldest lines are credited to the oldest commit read.