{"id":23058832,"url":"https://github.com/helloimalemur/phantomci","last_synced_at":"2025-07-16T20:37:13.580Z","repository":{"id":281110876,"uuid":"933968452","full_name":"helloimalemur/phantomci","owner":"helloimalemur","description":"Secure Headless Self-Hosted Runner","archived":false,"fork":false,"pushed_at":"2025-06-14T22:49:52.000Z","size":262,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-06-26T07:41:40.649Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/helloimalemur.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-02-17T03:50:11.000Z","updated_at":"2025-06-14T22:49:55.000Z","dependencies_parsed_at":"2025-03-26T04:31:39.796Z","dependency_job_id":"95b3b51e-ed6d-427d-97ca-c73f589c2654","html_url":"https://github.com/helloimalemur/phantomci","commit_stats":null,"previous_names":["helloimalemur/phantomci"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/helloimalemur/phantomci","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/helloimalemur%2Fphantomci","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/helloimalemur%2Fphantomci/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/helloimalemur%2Fphantomci/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/helloimalemur%2Fphantomci/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/helloimalemur","download_url":"https://codeload.github.com/helloimalemur/phantomci/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/helloimalemur%2Fphantomci/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265538795,"owners_count":23784660,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ci","cicd","git-runner","git-scm","self-hosted","self-hosted-runner"],"created_at":"2024-12-16T02:17:46.957Z","updated_at":"2025-07-16T20:37:13.559Z","avatar_url":"https://github.com/helloimalemur.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🐱 `phantom_ci`\n### ⚙️ Secure, Headless, Self-Hosted CI Runner\n\u003e ✅ Zero unnecessary outbound connections  \n\u003e 📤 Output to stdout by default (with optional webhooks)  \n\u003e 🔒 Built for minimal trust surfaces\n\n---\n\n## 🧠 Summary\n\n**`phantom_ci`** is a fully self-hosted CI runner that detects changes in Git repositories and executes pipeline steps defined in a `workflow.toml` file.  \nAll execution happens **locally**, as the user who runs `phantom_ci`. No external services are contacted unless explicitly configured.\n\nThis project was built with **isolation and security** in mind — specifically to prevent granting inbound or outbound access to unowned servers.\n\n---\n\n## 🚫 Common CI Tradeoffs vs `phantom_ci`\n\n| Approach                                          | Tradeoff                                           |\n|--------------------------------------------------|----------------------------------------------------|\n| GitHub Actions / SaaS Runners                    | Inbound access from GitHub into your servers       |\n| GitHub’s Self-Hosted Runners                     | Outbound access to GitHub's infra                  |\n| 3rd-party Runners                                | Implicit outbound connections or exposed APIs      |\n| ✅ `phantom_ci`                                   | **No inbound or outbound access required**         |\n\n---\n\n## 🛡️ Security Posture\n\n- Workflows are only run from a **locally configured branch** (`target_branch`)\n- Branch execution config is stored **outside the repo**, reducing tampering risk\n- CLI-based only — no API, no sockets, no network listeners\n- Workflow steps are executed via `std::process::Command` with optional sandboxing\n\nDefault `target_branch` is `\"master\"` — configure this explicitly and enforce restrictions via Git to avoid unauthorized command execution.\n\n---\n\n## 📦 Example: `$REPO_ROOT/workflow/master.toml`\n\n```toml\n[0] # step index must be numeric and define execution order\nrun = \"pwd\"\n\n[1]\nrun = \"make build\"\n\n[2]\nrun = \"make deploy\"\n```\n\n---\n\n## 📁 Repo Configuration\n\nMonitored repositories are defined in:\n\n```text\n~/.config/phantom_ci/Repo.toml\n```\n\n```toml\n[sys-compare]\npath = \"https://github.com/helloimalemur/sys-compare\"\ntarget_branch = \"master\"\n\n[elktool]\npath = \"https://github.com/helloimalemur/ELKTool\"\ntarget_branch = \"master\"\n\n[elktool2] # section headers must be unique\npath = \"git@github.com:helloimalemur/ELKTool\" # SSH recommended\ntarget_branch = \"test-branch\" # ensure the branch exists\n```\n\n---\n\n## 🔔 Webhook Notifications (Optional)\n\nTo enable Discord webhook notifications, create a `.env` file at:\n\n```text\n~/.config/phantom_ci/.env\n```\n\n```env\nDISCORD_WEBHOOK_URL=\"https://discord.com/api/webhooks/...\"\n```\n\nAdditional options for verbosity and payload formatting are planned.\n\n---\n\n## 🚀 Installation\n\nRequires [Rust](https://www.rust-lang.org/tools/install):\n\n```bash\ncargo install phantom_ci\n```\n\n---\n\n## ⚙️ Usage\n\n```bash\n# Run normally\nphantom_ci\n\n# Add repo via HTTPS\nphantom_ci add https://github.com/your/repo\n\n# Add repo via SSH (recommended)\nphantom_ci add git@github.com:your/repo\n\n# Install systemd service\nphantom_ci configure service\n```\n\n---\n\n## 💡 Workflow Configuration\n\nCreate a `workflow.toml` at the root of any monitored repo.  \nSteps are executed in numeric key order.\n\n---\n\n## 💣 Development \u0026 Contribution\n\nContributions welcome — PRs encouraged!\n\n```bash\ncargo clippy -- -D clippy::all\ncargo fmt -- --check\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhelloimalemur%2Fphantomci","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhelloimalemur%2Fphantomci","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhelloimalemur%2Fphantomci/lists"}