Skip to content

Board - workwingman-ci-runner

Ticket-style board for this repo. Prefix: WWCIR. Live artifact URL: deferred (this repo has no hosted board yet; update this line when one exists).

In review

  • WWCIR-2 - Org-level runner registration migration (docs/ORG-MIGRATION.md): IMPLEMENTED on branch org-migration (2026-07-08), pushed, NOT merged. Optional Org config key switches every runner-scoped call to POST /orgs/{org}/actions/runners/... (same App JWT -> installation-token flow); per-repo mode unchanged and still the default. Also landed the design note's hardening: backoff + jitter on all GitHub API calls + watchdog-loop failure backoff, stale-runner sweep (offline ww-<pc>-* past threshold), bounded Linux runner count (MaxRunners, hard cap 4), home-ci label in org mode, RunnerGroup support, RUNNER_URL in the container entrypoint, org-aware Runner-Status/Stop. Tests: tests/OrgMigration.Tests.ps1 (mocked, no sleeps), 105 passing, 87.7% module coverage (floor 70%). Remaining before Done: merge + the USER deploy checklist in docs/ORG-MIGRATION.md (App org permission "Self-hosted runners: R/W", org install on andrewjonesdev-tools, per-PC Org/InstallationId config, watchdog re-registration).

Done

  • WWCIR-1 - Ship-gate migration: bring repo to house doc/test/CI standard. Added TESTING.md, tests/GitHubApp.Tests.ps1, tests/Repo.Tests.ps1, tests/Invoke-CI.ps1, .github/workflows/ci.yml (test/churn/security/ secret-gate/e2e-note), docs/technical/ARCHITECTURE.md, docs/technical/SECURITY.md, docs/plain/README.md, docs/MAKING-OF.md, this board, and docs/ORG-MIGRATION.md (design note only). No runtime behavior changed. Gates: secret grep clean, Codex review clean/hardened, 38+ Pester tests passing, ~81% coverage on GitHubApp.psm1 (floor 70%). Committed locally; no remote push (org migration pending - see docs/ORG-MIGRATION.md).

Backlog

  • WWCIR-3 - Set the real RUNNER_SHA256 in docker/Dockerfile.linux and -RunnerSha256 in skill/scripts/Install-WindowsRunner.ps1 (currently placeholder values that skip checksum verification with a warning). Blocked on: none - just needs the real published checksums for the pinned RUNNER_VERSION at ship time.
  • WWCIR-4 - Once a real GitHub App exists (blocked-on-user-action per README), replace the e2e-note CI placeholder with a real registration round trip against a test installation, closing the E2E gap documented in TESTING.md.
  • WWCIR-5 - docker run in Watchdog-Linux.ps1 may eventually need -v /var/run/docker.sock:... (docker-outside-of-docker) if WorkWingman's sast/secrets/dast jobs move onto this pool - see the "Things to check when migrating" section of docs/WORKFLOW-CHANGES.md for the tradeoff.
  • WWCIR-6 - skill/scripts/Provision-Key.ps1 -ToCredentialManager passes the PEM to cmdkey /pass:$pemText, which puts key material in that process's command-line arguments for the duration of the call (visible to anything reading Win32_Process.CommandLine on this host in that window). Flagged by the Codex security review (2026-07-08, see docs/technical/SECURITY.md). Not fixed this pass (no runtime-behavior changes in scope) - future pass should use a stdin-safe or argument-list invocation that doesn't appear in process listings.