ampoule/ampoule
2
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
An experimental runner for Forgejo actions
21 commits 1 branch 0 tags 805 KiB
  • Rust 100%
Find a file
Exact
Pi Coding Agent 96d8c97f8c
 Spec: struct audit for secret logging prevention 
Add table of structs containing secrets with manual Debug implementations:
- Task: redact secrets, vars
- JobContext: only log key names from base_env
- ExecRequest: only log key names from env

#[derive(Debug)] not allowed on these types.

Addresses review comment #492.
2026-06-23 22:15:41 +00:00
docs/plans Spec: struct audit for secret logging prevention 2026-06-23 22:15:41 +00:00
src Implement cancellation safety 2026-06-22 23:39:51 +00:00
.gitignore Complete Phase 1: core infrastructure and crate layout 2026-06-21 21:45:00 +00:00
AGENTS.md Config and check improvements 2026-06-22 23:38:03 +00:00
ampoule-threat-model.md Add threat model and harden phase plans with security mitigations 2026-06-21 22:06:01 +00:00
Cargo.lock Implement cancellation safety 2026-06-22 23:39:51 +00:00
Cargo.toml Complete Phase 1: core infrastructure and crate layout 2026-06-21 21:45:00 +00:00
config.toml.example Config and check improvements 2026-06-22 23:38:03 +00:00
DIFFERENTIAL_REVIEW_2026-06-21.md Add threat model and harden phase plans with security mitigations 2026-06-21 22:06:01 +00:00
README.md Update general metadata, style alignments, and Forgejo status-down APIs 2026-06-21 18:51:09 +00:00

README.md

Ampoule — Forgejo Actions Runner

Ampoule is a Forgejo Actions runner that executes each job inside an ephemeral, isolated environment. The initial backend uses Firecracker microVMs; the architecture supports alternative backends (cloud VMs, etc.) through a pluggable executor interface.

Introduction

Forgejo is a software forge, like GitHub and GitLab. It contains Forgejo Actions, which is modeled closely on GitHub Actions, but not entirely the same.

A Runner is a tool that takes job definitions from an Actions workflow and executes them.

Motivation

Since a job is essentially just some random executable code, inherently it cannot be trusted. Therefore it needs to be isolated. To combat that, this project provides a runner that creates a lightweight virtual machine to run this code in.

Naming

The project is named ampoule — a hermetically sealed, single-use glass container used in medicine and chemistry. The metaphor fits: each job gets a clean, sealed environment that is discarded after use. The name has no association with any specific technology or vendor, which is intentional given that the executor backend is designed to be swappable.