shithub Public

Watch 1 Fork 0 Star 0
markdown · 3558 bytes Raw Blame History

Actions

shithub Actions runs CI workflows from .shithub/workflows/*.yml. The workflow format intentionally follows the parts of GitHub Actions that are useful for ordinary repository CI, while keeping the runner surface small enough to secure.

Minimal workflow

name: smoke
on: [push, workflow_dispatch]
jobs:
  hello:
    runs-on: ubuntu-latest
    env:
      RUN_ID: ${{ shithub.run_id }}
    steps:
      - run: echo "hello from shithub actions"
      - run: test -n "$RUN_ID"

Commit that file as .shithub/workflows/smoke.yml and push to the repository. The run appears under the repository's Actions tab and its job also appears as a check run on matching pull requests.

What works today

  • push, pull_request, schedule, and workflow_dispatch triggers
  • actions/checkout@v4 for repository checkout
  • run: steps executed in the operator-configured runner image
  • runs-on: label matching against registered runners
  • workflow, job, and step env:
  • ${{ secrets.NAME }}, ${{ vars.NAME }}, ${{ env.NAME }}, and ${{ shithub.* }} expressions
  • needs:, if:, timeout-minutes:, and concurrency groups
  • live step logs, cancel, re-run, check-run sync, and the Actions Atom feed

runs-on: ubuntu-latest is a runner label, not a promise that shithub downloads a hosted Ubuntu image for you. The site operator decides which image a matching runner uses. On shithub.sh, use the labels published by the instance operator.

Current limit

The runner executes actions/checkout@v4 and run: steps. Checkout accepts the default shallow fetch and with.fetch-depth; use fetch-depth: 0 when a workflow needs full history:

steps:
  - uses: actions/checkout@v4
    with:
      fetch-depth: "0"
  - run: git describe --tags --always

The parser also accepts these artifact aliases:

  • shithub/upload-artifact@v1
  • shithub/download-artifact@v1

The runner does not execute artifact aliases yet. A workflow containing those artifact uses: steps will fail until artifact execution lands. Checkout inputs such as path, submodules, LFS, and persisted credentials are not implemented yet.

Expressions

Use the shithub namespace:

env:
  REF: ${{ shithub.ref }}
  SHA: ${{ shithub.sha }}
  RUN_ID: ${{ shithub.run_id }}

The github.* namespace is accepted as a compatibility alias for the fields shithub exposes, but new workflows should use shithub.*.

Event payload values such as ${{ shithub.event.pull_request.title }} are treated as untrusted. The runner passes them through temporary environment bindings instead of splicing them directly into shell command text.

Secrets and variables

Repository and organization settings expose Actions secrets and variables. Secrets are encrypted at rest and are redacted from logs. Variables are plaintext configuration and are suitable for non-secret values such as tool versions or feature flags.

Repo-scoped values shadow organization-scoped values with the same name.

Migrating from GitHub Actions

Most simple CI files need three edits:

  1. Move the workflow file from .github/workflows/ to .shithub/workflows/.
  2. Keep actions/checkout@v4, but replace marketplace and artifact uses: actions with equivalent run: commands for now.
  3. Confirm runs-on: matches a label registered by your shithub operator.

Marketplace actions, Docker actions, composite actions, hosted runner images, matrix expansion, service containers, submodules, LFS, and artifact transfer are not part of the current v1 runner.

View source
1 # Actions
2
3 shithub Actions runs CI workflows from `.shithub/workflows/*.yml`.
4 The workflow format intentionally follows the parts of GitHub Actions that are
5 useful for ordinary repository CI, while keeping the runner surface small enough
6 to secure.
7
8 ## Minimal workflow
9
10 ```yaml
11 name: smoke
12 on: [push, workflow_dispatch]
13 jobs:
14 hello:
15 runs-on: ubuntu-latest
16 env:
17 RUN_ID: ${{ shithub.run_id }}
18 steps:
19 - run: echo "hello from shithub actions"
20 - run: test -n "$RUN_ID"
21 ```
22
23 Commit that file as `.shithub/workflows/smoke.yml` and push to the repository.
24 The run appears under the repository's Actions tab and its job also appears as
25 a check run on matching pull requests.
26
27 ## What works today
28
29 - `push`, `pull_request`, `schedule`, and `workflow_dispatch` triggers
30 - `actions/checkout@v4` for repository checkout
31 - `run:` steps executed in the operator-configured runner image
32 - `runs-on:` label matching against registered runners
33 - workflow, job, and step `env:`
34 - `${{ secrets.NAME }}`, `${{ vars.NAME }}`, `${{ env.NAME }}`, and
35 `${{ shithub.* }}` expressions
36 - `needs:`, `if:`, `timeout-minutes:`, and concurrency groups
37 - live step logs, cancel, re-run, check-run sync, and the Actions Atom feed
38
39 `runs-on: ubuntu-latest` is a runner label, not a promise that shithub downloads
40 a hosted Ubuntu image for you. The site operator decides which image a matching
41 runner uses. On shithub.sh, use the labels published by the instance operator.
42
43 ## Current limit
44
45 The runner executes `actions/checkout@v4` and `run:` steps. Checkout accepts
46 the default shallow fetch and `with.fetch-depth`; use `fetch-depth: 0` when a
47 workflow needs full history:
48
49 ```yaml
50 steps:
51 - uses: actions/checkout@v4
52 with:
53 fetch-depth: "0"
54 - run: git describe --tags --always
55 ```
56
57 The parser also accepts these artifact aliases:
58
59 - `shithub/upload-artifact@v1`
60 - `shithub/download-artifact@v1`
61
62 The runner does not execute artifact aliases yet. A workflow containing those
63 artifact `uses:` steps will fail until artifact execution lands. Checkout
64 inputs such as `path`, submodules, LFS, and persisted credentials are not
65 implemented yet.
66
67 ## Expressions
68
69 Use the shithub namespace:
70
71 ```yaml
72 env:
73 REF: ${{ shithub.ref }}
74 SHA: ${{ shithub.sha }}
75 RUN_ID: ${{ shithub.run_id }}
76 ```
77
78 The `github.*` namespace is accepted as a compatibility alias for the fields
79 shithub exposes, but new workflows should use `shithub.*`.
80
81 Event payload values such as `${{ shithub.event.pull_request.title }}` are
82 treated as untrusted. The runner passes them through temporary environment
83 bindings instead of splicing them directly into shell command text.
84
85 ## Secrets and variables
86
87 Repository and organization settings expose Actions secrets and variables.
88 Secrets are encrypted at rest and are redacted from logs. Variables are
89 plaintext configuration and are suitable for non-secret values such as tool
90 versions or feature flags.
91
92 Repo-scoped values shadow organization-scoped values with the same name.
93
94 ## Migrating from GitHub Actions
95
96 Most simple CI files need three edits:
97
98 1. Move the workflow file from `.github/workflows/` to `.shithub/workflows/`.
99 2. Keep `actions/checkout@v4`, but replace marketplace and artifact `uses:`
100 actions with equivalent `run:` commands for now.
101 3. Confirm `runs-on:` matches a label registered by your shithub operator.
102
103 Marketplace actions, Docker actions, composite actions, hosted runner images,
104 matrix expansion, service containers, submodules, LFS, and artifact transfer
105 are not part of the current v1 runner.