René's URL Explorer Experiment

Title: feat(provider): install retained runner provider by intel352 · Pull Request #53 · GoCodeAlone/workflow-plugin-github · GitHub

Open Graph Title: feat(provider): install retained runner provider by intel352 · Pull Request #53 · GoCodeAlone/workflow-plugin-github

X Title: feat(provider): install retained runner provider by intel352 · Pull Request #53 · GoCodeAlone/workflow-plugin-github

Description: Summary ship a plugin-owned Linux retained lifecycle for github-runner-provider beside an already registered compute agent add crash-safe install, refresh, recovery, status, and separate uninstall with user systemd, rootless Podman, TLS, strict typed state, maintenance fencing, and identity preservation package the provider plus executable config schema/example on Linux, macOS, and Windows while retaining Linux-only lifecycle semantics Design See docs/plans/2026-07-13-retained-runner-provider-lifecycle-design.md. Implementation Plan See docs/plans/2026-07-13-retained-runner-provider-lifecycle.md. Scope Manifest PR Count: 1 Tasks: 5 Status: plugin slice complete; global STG Task 8 follows release PR row: Plugin-owned retained runner-provider lifecycle, Tasks 1-5, codex/provider-retained-installer-20260713 Changes versioned readiness probe and provider release version injection typed config, active state, journals, lifecycle audit queue, durable filesystem operations, ownership checks, and cross-process locks immutable-ID Podman candidate/stable activation, owned cleanup, same-digest runtime repair, rollback, and autonomous refresh user-systemd install/reinstall/status/recover/uninstall, credential isolation, local TLS, exact maintenance identity, and retained worker continuity release README, strict JSON schema/example, six-target archive packaging, and patched Go/TLS/HTTP/transitive SDK versions TDD And Review Evidence RED -> GREEN -> revert/restore proofs cover same-digest image loss and fence restart, outer/inner provider-effect agreement, cancellation-safe probe cleanup, aggregate systemd deadlines, durable path authority, failed repair cleanup, and committed recovery seven post-rewrite adversarial rounds are recorded in the plan review; final verdict is SHIP-IT Copilot round 1 required one DNS-label invariant for TLS SANs, Podman aliases, derived probe names, and the shipped schema; eight runtime/schema assertions fail with the fix reverted and pass when restored Copilot round 2 required one absolute/canonical/C0+DEL-free path invariant for all retained paths and the probe CA argument; eleven assertions fail with the fix reverted and pass when restored Copilot round 3 removed raw positional input from unknown-command diagnostics and preserved response-read I/O causes without response content; both focused tests fail with the fixes reverted and pass when restored Copilot round 4 made retained subcommand diagnostics symmetric and replaced following lock/audit creation with Unix no-follow and Windows reparse-point opens; deterministic raced-symlink tests fail without the boundary and pass when restored Copilot round 5 rejected the broad absolute-path schema because it accepted noncanonical values that runtime rejected; the replacement uses explicit canonical segments, and release-schema tests reject duplicate separators, dot/parent segments, and trailing separators the five-round limit ended external review with a rewrite rather than a sixth Copilot request; the post-rewrite adversarial self-review reran every bug class and reached SHIP-IT each post-Copilot adversarial self-review reran the scope-compliance and full bug-class scan with a SHIP-IT verdict fixable govulncheck findings were removed with Go 1.26.5, x/net 0.55.0, x/sys 0.45.0, and Kinesis 1.43.5 five inherited Docker advisories remain with no fixed module release; this provider path does not call the affected archive/copy/AuthZ APIs, and SDK decoupling remains a dependency-light extraction follow-up Verification GOWORK=off go test -race ./... -count=1 GOWORK=off go vet ./... GOWORK=off go mod tidy -diff GOWORK=off golangci-lint run --new-from-rev=origin/main ./... -> 0 issues goreleaser check provider cross-build: Linux, macOS, Windows on amd64 and arm64, plus FreeBSD amd64 fail-closed portability GORELEASER_RENDER_DIR=.goreleaser-rendered-local goreleaser release --snapshot --clean all six archives contain provider, README, contracts, schema, and example; every generated SHA-256 checksum verifies parent locked-plan scope check -> PASS Runtime Launch Transcript Build: $ GORELEASER_RENDER_DIR=.goreleaser-rendered-local goreleaser release --snapshot --clean release succeeded Launch: $ github-runner-provider version 1.0.31-SNAPSHOT-925fc24 $ GITHUB_RUNNER_PROVIDER_GITHUB_TOKEN= \ GITHUB_RUNNER_PROVIDER_TOKEN= \ github-runner-provider 127.0.0.1:18091 health={"status":"ok"} readiness={"status":"ok"} starting github-runner-provider addr=127.0.0.1:18091 tls=false The packaged Darwin binary also returns the explicit retained provider lifecycle is unsupported on darwin error. The full user-systemd/Podman apply is intentionally performed on the retained Linux STG host after this provider release, followed by STG-dispatched workload/proof/artifact validation. Failure-signature scrape: clean. Doc-reconciliation: clean.

Open Graph Description: Summary ship a plugin-owned Linux retained lifecycle for github-runner-provider beside an already registered compute agent add crash-safe install, refresh, recovery, status, and separate uninstall...

X Description: Summary ship a plugin-owned Linux retained lifecycle for github-runner-provider beside an already registered compute agent add crash-safe install, refresh, recovery, status, and separate uninstall...

Opengraph URL: https://github.com/GoCodeAlone/workflow-plugin-github/pull/53

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width