runnerless↗

Implemented in ci-toolkit

Publish CI artifact folders and binary bundles

Some build outputs are a set: a binary bundle, its checksum and a manifest. Publishing only one file breaks the handoff to reviewers or release jobs. ci-toolkit’s folder publisher keeps named files together while preserving an individual size, digest and resolver link for every file.

Supported in the private ci-toolkit GitHub App. Runnerless itself is in early development; signing up does not enable this feature.

How it works

01 /

Declare the files the build is allowed to publish

The buildbuddy.workflow-artifacts@v1 source accepts named patterns with media types and byte limits. A folder automation can target open pull requests, the default branch or both. Default-branch publication additionally verifies the commit’s relationship to that branch and the invocation’s matching branch evidence.

02 /

Stream transfers outside the webhook window

Folder jobs run through the queued cron/operator work path. Files stream from BuildBuddy to R2 without buffering complete bodies in the Worker. Expected length and SHA-256 are supplied to storage, and a rejected object is removed. This allows large transfers without pretending that binary publication is a one-second check.

03 /

Bound the lifetime and retained sets

Use retention to set the lifetime, and keep_default_branch_sets to retain only a configured number of default-branch sets. PR sets supersede the previous head. The comment’s file_table lists filenames, sizes and short digests, each linked through the commit resolver.

A concrete example

Supported action fragment; full automation also needs trigger, source and comment

# Fragment inside a folder publication action
uses: toolkit.public-folder@v1
with:
  source: gpu-files
  security_profile: untrusted-data
  retention: 14d
  keep_default_branch_sets: 5

Availability and limits

Current limits

The current implementation rejects default branches containing a slash. Overlapping patterns across publishers can resolve to the first publisher, and retained-set ordering uses publication time. A failed rerun can leave an earlier same-head set available. These are current limitations, not guarantees of release provenance.

Common questions

Are binary files rendered inside the browser?

The untrusted-data profile forces attachment downloads with sanitized filenames and declared media types.

Can I keep only a few default-branch builds?

Yes. keep_default_branch_sets accepts 1–20 when a default_branch target is declared, alongside the time-based retention setting.

Credential handling during publication

Verifying an artifact’s origin does not establish that its contents are free of secrets. Read about accidental CI secret leaks and how modern CI protects secrets for the exposure paths, existing controls, and planned isolation model. Why your publishing service should pull artifacts explains the benefit of fetching and verifying build output in the publisher.

Runnerless / early access

Interested in this workflow?

Get early access ↗

Register interest and tell us what slows your CI down. The optional follow-up questions come after your email is saved.