Repository navigation
Conversation
Self-hosted runners keep rustup in the runner user's Cargo home without always putting it on PATH, share one rustup home between the runners on a machine, and may resolve bash to something other than Git Bash on Windows. Find or install rustup, retry toolchain installs that race, and put Git Bash first on Windows so the setup works there as it did on hosted images.
The xipkit org runs all CI on its own runners rather than GitHub-hosted images. Fork pull requests are skipped since they must not run code on persistent org machines.
Self-hosted runners keep their workspaces between jobs, so a nightly corpus or checker log would otherwise stay on disk until that runner next checks out the repository. Both are already saved to the cache or uploaded as artifacts.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: a238b39988
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | ||
| runs-on: [self-hosted, Linux, X64, xipkit] |
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
A lower-privileged collaborator who can push a branch in this repository can trigger this pull_request job before their code is reviewed. The job now runs on a self-hosted machine, checks out that branch, and invokes PR-controlled ./scripts/cargo; a payload can therefore alter the runner user's files. The setup also reuses $HOME/.cargo/bin/rustup, so on the persistent/shared-home configuration assumed by this change, the payload can replace rustup and execute again in later trusted push or scheduled jobs. The same-repository predicate blocks forks, and the read-only/non-persisted token limits repository access, but neither protects the host. Use GitHub-hosted or single-job ephemeral runners for every PR, reserving persistent runners for trusted post-merge events.
Useful? React with 👍 / 👎.
|
Closing: vibescript is public, and the self-hosted runners only serve private repos, so it stays on GitHub-hosted runners. The branch is kept in case the fuzz cleanup or Rust setup fixes are worth landing separately. |
The xipkit org runs all CI on its own self-hosted runners, so CI and fuzz jobs move off GitHub-hosted images. The shared Rust setup now finds rustup on those machines, and fuzz jobs clean up their corpora since runner workspaces persist.
Scheduled and manually dispatched fuzz runs (one hour per target) only run after merge, so only the pull request variant is exercised here.
Blocked: this repo is public and the org's runner group does not allow public repositories, so every job stays queued until that setting changes or the repo goes private.