cachekit-core 0.7.0

LZ4 compression, xxHash3 integrity, AES-256-GCM encryption for byte payloads
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

name: Runner Guard

# Drift protection (LAB-3501): every job in this repo must run on a GitHub-hosted
# runner. This job fails the workflow if any `runs-on` or matrix `os:`/`runner:`
# value in .github/workflows/ is not a hosted label — an allow-list, so a NEW
# self-hosted label nobody has named yet still fails.
#
# This is protection against MAINTAINER drift on trusted branches only. It is NOT a
# fork-PR control: a fork runs its own copy of this file and can delete the guard;
# the control for that lives in repository and org runner settings, outside this file.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  assert-hosted-runners:
    name: Assert all runners are GitHub-hosted
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Self-test the guard, then scan every workflow
        run: |
          python3 .github/scripts/assert_hosted_runners.py --selftest
          python3 .github/scripts/assert_hosted_runners.py