windy-git/windy-runner-guard-sweep.service at ef96051d6f3610255a574e1679d35d5a601f2ce5 - windy-git - Windy Git

windyadmin/windy-git

Files

Kit OC5 a0dc6f8568 runner-guard: block workflows that hand a self-hosted runner to strangers (Boss 10-01)

R1 pull_request_target; R2 fork pull_request on self-hosted without a same-repo/environment
gate; R3 outsider events (issue_comment, workflow_run, ...) on self-hosted; R0 unparseable.
PR mode in the 5-min sync posts windy-git/runner-guard on open PRs of public sneakyfree repos
that change a workflow (each status once). Nightly sweep (Windy 0 timer) over every public
repo: page + BOARD line on new hits + red windy-job heartbeat.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-01 05:28:37 -04:00

8 lines

293 B

Desktop File

Raw Blame History

 [Unit]
 Description=Nightly runner-guard sweep of every PUBLIC repo's workflows (Windy Git lane)
 [Service]
 Type=oneshot
 ExecStart=/usr/local/bin/windy-job windy-runner-guard-sweep 26h --expect "runner-guard sweep: 0 hit" --owner 13 -- %h/bin/nightly-runner-guard-sweep.sh
 TimeoutStartSec=1200