runnerless↗

Implemented in ci-toolkit

Publish CI artifact folders and binary bundles

Some build outputs are a set: a binary bundle, its checksum and a manifest. Publishing only one file breaks the handoff to reviewers or release jobs. ci-toolkit’s folder publisher keeps named files together while preserving an individual size, digest and resolver link for every file.

Supported in the private ci-toolkit GitHub App. Runnerless itself is in early development; signing up does not enable this feature.

How it works

01 /

Declare the files the build is allowed to publish

The buildbuddy.workflow-artifacts@v1 source accepts named patterns with media types and byte limits. A folder automation can target open pull requests, the default branch or both. Default-branch publication additionally verifies the commit’s relationship to that branch and the invocation’s matching branch evidence.

02 /

Stream transfers outside the webhook window

Folder jobs run through the queued cron/operator work path. Files stream from BuildBuddy to R2 without buffering complete bodies in the Worker. Expected length and SHA-256 are supplied to storage, and a rejected object is removed. This allows large transfers without pretending that binary publication is a one-second check.

03 /

Bound the lifetime and retained sets

Use retention to set the lifetime, and keep_default_branch_sets to retain only a configured number of default-branch sets. PR sets supersede the previous head. The comment’s file_table lists filenames, sizes and short digests, each linked through the commit resolver.

A concrete example

Supported action fragment; full automation also needs trigger, source and comment

# Fragment inside a folder publication action
uses: toolkit.public-folder@v1
with:
  source: gpu-files
  security_profile: untrusted-data
  retention: 14d
  keep_default_branch_sets: 5

Know the boundary

Current limits

The current implementation rejects default branches containing a slash. Overlapping patterns across publishers can resolve to the first publisher, and retained-set ordering uses publication time. A failed rerun can leave an earlier same-head set available. These are current limitations, not guarantees of release provenance.

Common questions

Are binary files rendered inside the browser?

The untrusted-data profile forces attachment downloads with sanitized filenames and declared media types.

Can I keep only a few default-branch builds?

Yes. keep_default_branch_sets accepts 1–20 when a default_branch target is declared, alongside the time-based retention setting.

Runnerless / early access

Want this in
your workflow?

Get early access ↗

Register interest and tell us what slows your CI down. The optional follow-up questions come after your email is saved.