Panopt/Panopt-Coin
Watch
1
0
Fork
You've already forked Panopt-Coin
 0
Code Issues 11 Pull requests Projects Releases Packages Wiki Activity Actions

Set up isolated Forgejo validation runner #11

New issue
Open
opened 2026-10-19 04:24:04 +00:00 by nmchenry · 1 comment
nmchenry commented 2026-10-19 04:24:04 +00:00
Owner
Copy link

Forgejo is the primary working forge, but it currently has no registered Actions runner. Add automated validation only after a runner is isolated from the live coin and Forgejo Docker services.

  • Choose a dedicated runner host or comparably isolated environment with enough resources for the checks.
  • Register the runner to the Panopt repository or organization, not the whole Forgejo instance.
  • Keep the live host Docker socket, wallet keys, chain volumes, production credentials, and deployment network unavailable to job containers.
  • Pin runner, job images, and third-party actions; avoid untrusted pull-request code with write credentials.
  • Add a Forgejo workflow for the relevant commands in LOCAL-VALIDATION.md.
  • Demonstrate a successful run and document resource limits, failure handling, and how to update or disable the runner.

Panopt-Core Forgejo Actions stays disabled while its inherited workflow files remain. GitHub Actions stays disabled on both repositories. Forgejo runner security guidance.

Forgejo is the primary working forge, but it currently has no registered Actions runner. Add automated validation only after a runner is isolated from the live coin and Forgejo Docker services. - [ ] Choose a dedicated runner host or comparably isolated environment with enough resources for the checks. - [x] Register the runner to the Panopt repository or organization, not the whole Forgejo instance. - [ ] Keep the live host Docker socket, wallet keys, chain volumes, production credentials, and deployment network unavailable to job containers. - [ ] Pin runner, job images, and third-party actions; avoid untrusted pull-request code with write credentials. - [x] Add a Forgejo workflow for the relevant commands in [LOCAL-VALIDATION.md](https://git.panoptsecurity.com/Panopt/Panopt-Coin/src/branch/main/docs/LOCAL-VALIDATION.md). - [x] Demonstrate a successful run and document resource limits, failure handling, and how to update or disable the runner. Panopt-Core Forgejo Actions stays disabled while its inherited workflow files remain. GitHub Actions stays disabled on both repositories. [Forgejo runner security guidance](https://forgejo.org/docs/v16.0/admin/actions/security/).
nmchenry commented 2026-10-19 10:11:03 +00:00
Author
Owner
Copy link

Progress on 2026-10-19: repository-scoped panopt-coin-isolated runner is online. The runner and nested Docker images are digest-pinned; the Go job image is pinned; Forgejo traffic uses HTTPS. Job containers have no host Docker socket or wallet/chain mounts, and resource limits and operator procedures are documented in ops/forgejo-runner/README.md. Initial run #1 and hardened run #2 both passed race tests, vet, and two binary builds. The live nodes and public site remained healthy.

This issue stays open: Docker-in-Docker is privileged on the same physical host as the live nodes, and job containers still have normal LAN reachability. Move CI to a dedicated host or VM and restrict egress before treating untrusted contributions as safe. Python integration/model and Docker deployment checks also remain outside this workflow.

Progress on 2026-10-19: repository-scoped `panopt-coin-isolated` runner is online. The runner and nested Docker images are digest-pinned; the Go job image is pinned; Forgejo traffic uses HTTPS. Job containers have no host Docker socket or wallet/chain mounts, and resource limits and operator procedures are documented in `ops/forgejo-runner/README.md`. [Initial run #1](https://git.panoptsecurity.com/Panopt/Panopt-Coin/actions/runs/1) and [hardened run #2](https://git.panoptsecurity.com/Panopt/Panopt-Coin/actions/runs/2) both passed race tests, vet, and two binary builds. The live nodes and public site remained healthy. This issue stays open: Docker-in-Docker is privileged on the same physical host as the live nodes, and job containers still have normal LAN reachability. Move CI to a dedicated host or VM and restrict egress before treating untrusted contributions as safe. Python integration/model and Docker deployment checks also remain outside this workflow.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Panopt/Panopt-Coin#11
No description provided.