From 0d7e685b323c7931e529539512d11057ad44bdd1 Mon Sep 17 00:00:00 2001
From: Hop <hop@localhost>
Date: Sat, 11 Jul 2026 19:28:07 -0700
Subject: [PATCH] Enable public Actions with an isolated resource-limited
 runner

Hop-State: A_06FN89T43A6YAKVVRPJ85G8
Hop-Proposal: R_06FN89NC0WV0HY32HS771N8
Hop-Task: T_06FN82XHMVA9Y1SCV577AD8
Hop-Attempt: AT_06FN82XHMS7KSMMM343RTC8
---
 .env.example                                  |  3 +++
 .../prompts/P_06FN82XHMRKPK05WQQZ6AWG.json    | 16 ++++++++++++++
 .../prompts/P_06FN84JQ7WCV59RYRG0FHDR.json    | 16 ++++++++++++++
 .../prompts/P_06FN85RCG5TWDM0VECCEGP8.json    | 16 ++++++++++++++
 .../prompts/P_06FN87CKEDXD3CDEB5CN9RG.json    | 16 ++++++++++++++
 .../prompts/P_06FN88BVQ5VVPM511BE2M08.json    | 17 +++++++++++++++
 compose.yaml                                  | 21 +++++++++++++++++++
 deploy/gitea/public/assets/js/hop-native.js   |  4 +---
 8 files changed, 106 insertions(+), 3 deletions(-)
 create mode 100644 .hop/records/prompts/P_06FN82XHMRKPK05WQQZ6AWG.json
 create mode 100644 .hop/records/prompts/P_06FN84JQ7WCV59RYRG0FHDR.json
 create mode 100644 .hop/records/prompts/P_06FN85RCG5TWDM0VECCEGP8.json
 create mode 100644 .hop/records/prompts/P_06FN87CKEDXD3CDEB5CN9RG.json
 create mode 100644 .hop/records/prompts/P_06FN88BVQ5VVPM511BE2M08.json

diff --git a/.env.example b/.env.example
index 927ff49..58ad8af 100644
--- a/.env.example
+++ b/.env.example
@@ -20,3 +20,6 @@ HOP_HTTP_PORT=8080
 GITEA_DISABLE_SSH=false
 GITEA_DISABLE_REGISTRATION=false
 GITEA_ACTIONS_ENABLED=true
+# Generate this after Gitea starts with: docker compose exec -u git gitea gitea actions generate-runner-token
+GITEA_RUNNER_REGISTRATION_TOKEN=
+GITEA_RUNNER_NAME=cyphers-public
diff --git a/.hop/records/prompts/P_06FN82XHMRKPK05WQQZ6AWG.json b/.hop/records/prompts/P_06FN82XHMRKPK05WQQZ6AWG.json
new file mode 100644
index 0000000..4e748e3
--- /dev/null
+++ b/.hop/records/prompts/P_06FN82XHMRKPK05WQQZ6AWG.json
@@ -0,0 +1,16 @@
+{
+  "id": "P_06FN82XHMRKPK05WQQZ6AWG",
+  "task_id": "T_06FN82XHMVA9Y1SCV577AD8",
+  "attempt_id": "AT_06FN82XHMS7KSMMM343RTC8",
+  "state_id": "P_06FN82XHMRKPK05WQQZ6AWG",
+  "prompt": "trying to install on windows\n\n# Files mentioned by the user:\n\n## Screenshot 2026-07-11 at 6.57.22 PM.png: /var/folders/58/b6yn15tx3jb7_6lw9m67f89m0000gn/T/TemporaryItems/NSIRD_screencaptureui_jvjxqg/Screenshot 2026-07-11 at 6.57.22 PM.png",
+  "agent_name": "codex",
+  "status": "proposed",
+  "created_at": "2026-07-12T01:58:00.358793Z",
+  "metadata": {
+    "source_tree": "4e36b4521e738fed9e1132ca887716e852bdd6cc",
+    "git_commit": "077035fa84d8515d1b9e858b8555992ba3f13ad5",
+    "attempt_head": "C_06FN89GTD16MKY5G73AR9KG",
+    "attempt_head_kind": "checkpoint"
+  }
+}
diff --git a/.hop/records/prompts/P_06FN84JQ7WCV59RYRG0FHDR.json b/.hop/records/prompts/P_06FN84JQ7WCV59RYRG0FHDR.json
new file mode 100644
index 0000000..7e480aa
--- /dev/null
+++ b/.hop/records/prompts/P_06FN84JQ7WCV59RYRG0FHDR.json
@@ -0,0 +1,16 @@
+{
+  "id": "P_06FN84JQ7WCV59RYRG0FHDR",
+  "task_id": "T_06FN82XHMVA9Y1SCV577AD8",
+  "attempt_id": "AT_06FN82XHMS7KSMMM343RTC8",
+  "state_id": "P_06FN84JQ7WCV59RYRG0FHDR",
+  "prompt": "did you even read the fucking error? its doing the same thing!\n\n# Files mentioned by the user:\n\n## Screenshot 2026-07-11 at 7.04.17 PM.png: /var/folders/58/b6yn15tx3jb7_6lw9m67f89m0000gn/T/TemporaryItems/NSIRD_screencaptureui_Adb84G/Screenshot 2026-07-11 at 7.04.17 PM.png",
+  "agent_name": "codex",
+  "status": "proposed",
+  "created_at": "2026-07-12T02:05:15.967928Z",
+  "metadata": {
+    "source_tree": "4e36b4521e738fed9e1132ca887716e852bdd6cc",
+    "git_commit": "c19e90ab7a51a08619810f159d98359e75a4d0b1",
+    "attempt_head": "C_06FN89GTD16MKY5G73AR9KG",
+    "attempt_head_kind": "checkpoint"
+  }
+}
diff --git a/.hop/records/prompts/P_06FN85RCG5TWDM0VECCEGP8.json b/.hop/records/prompts/P_06FN85RCG5TWDM0VECCEGP8.json
new file mode 100644
index 0000000..9345766
--- /dev/null
+++ b/.hop/records/prompts/P_06FN85RCG5TWDM0VECCEGP8.json
@@ -0,0 +1,16 @@
+{
+  "id": "P_06FN85RCG5TWDM0VECCEGP8",
+  "task_id": "T_06FN82XHMVA9Y1SCV577AD8",
+  "attempt_id": "AT_06FN82XHMS7KSMMM343RTC8",
+  "state_id": "P_06FN85RCG5TWDM0VECCEGP8",
+  "prompt": "can we enable sign ups",
+  "agent_name": "codex",
+  "status": "proposed",
+  "created_at": "2026-07-12T02:10:24.513572Z",
+  "metadata": {
+    "source_tree": "4e36b4521e738fed9e1132ca887716e852bdd6cc",
+    "git_commit": "8a6357091284596f2babfa0b8172441dbadfda53",
+    "attempt_head": "C_06FN89GTD16MKY5G73AR9KG",
+    "attempt_head_kind": "checkpoint"
+  }
+}
diff --git a/.hop/records/prompts/P_06FN87CKEDXD3CDEB5CN9RG.json b/.hop/records/prompts/P_06FN87CKEDXD3CDEB5CN9RG.json
new file mode 100644
index 0000000..16603e5
--- /dev/null
+++ b/.hop/records/prompts/P_06FN87CKEDXD3CDEB5CN9RG.json
@@ -0,0 +1,16 @@
+{
+  "id": "P_06FN87CKEDXD3CDEB5CN9RG",
+  "task_id": "T_06FN82XHMVA9Y1SCV577AD8",
+  "attempt_id": "AT_06FN82XHMS7KSMMM343RTC8",
+  "state_id": "P_06FN87CKEDXD3CDEB5CN9RG",
+  "prompt": "would we be able to enable actions? (also why do we call it evidence like i dont really understand that) would our server be able to handle that?",
+  "agent_name": "codex",
+  "status": "proposed",
+  "created_at": "2026-07-12T02:17:32.275677Z",
+  "metadata": {
+    "source_tree": "4e36b4521e738fed9e1132ca887716e852bdd6cc",
+    "git_commit": "0c3e01ed7716e8cb26dba1832d832b0b0a89d132",
+    "attempt_head": "C_06FN89GTD16MKY5G73AR9KG",
+    "attempt_head_kind": "checkpoint"
+  }
+}
diff --git a/.hop/records/prompts/P_06FN88BVQ5VVPM511BE2M08.json b/.hop/records/prompts/P_06FN88BVQ5VVPM511BE2M08.json
new file mode 100644
index 0000000..6119fe5
--- /dev/null
+++ b/.hop/records/prompts/P_06FN88BVQ5VVPM511BE2M08.json
@@ -0,0 +1,17 @@
+{
+  "id": "P_06FN88BVQ5VVPM511BE2M08",
+  "task_id": "T_06FN82XHMVA9Y1SCV577AD8",
+  "attempt_id": "AT_06FN82XHMS7KSMMM343RTC8",
+  "state_id": "P_06FN88BVQ5VVPM511BE2M08",
+  "prompt": "lets just leave it named as actions, and i think we need to let anyone use it if we are going to try and attract users.",
+  "agent_name": "codex",
+  "status": "proposed",
+  "response_summary": "Enable public Actions with an isolated resource-limited runner",
+  "created_at": "2026-07-12T02:21:48.345066Z",
+  "metadata": {
+    "source_tree": "4e36b4521e738fed9e1132ca887716e852bdd6cc",
+    "git_commit": "ec021fc146a21735e3b0639705598704dfa4d65f",
+    "attempt_head": "C_06FN89GTD16MKY5G73AR9KG",
+    "attempt_head_kind": "checkpoint"
+  }
+}
diff --git a/compose.yaml b/compose.yaml
index cae3f52..8b0434e 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -46,6 +46,26 @@ services:
       - gitea-data:/data
     networks: [hopweb]
 
+  actions-runner:
+    image: docker.io/gitea/act_runner:latest-dind-rootless
+    depends_on:
+      gitea:
+        condition: service_started
+    environment:
+      GITEA_INSTANCE_URL: http://gitea:3000
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
+      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-cyphers-public}
+      GITEA_RUNNER_LABELS: ${GITEA_RUNNER_LABELS:-ubuntu-latest:docker://gitea/runner-images:ubuntu-latest,ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04}
+      CONFIG_FILE: /data/config.yaml
+    cpus: "2.0"
+    mem_limit: 4g
+    pids_limit: 1024
+    security_opt:
+      - no-new-privileges:true
+    volumes:
+      - actions-runner-data:/data
+    networks: [hopweb]
+
   control-plane:
     build:
       context: ./services/control-plane
@@ -74,5 +94,6 @@ networks:
   hopweb:
 
 volumes:
+  actions-runner-data:
   gitea-data:
   postgres-data:
diff --git a/deploy/gitea/public/assets/js/hop-native.js b/deploy/gitea/public/assets/js/hop-native.js
index b16af8e..8043f89 100644
--- a/deploy/gitea/public/assets/js/hop-native.js
+++ b/deploy/gitea/public/assets/js/hop-native.js
@@ -6,7 +6,6 @@
     ['Issues', 'Tasks'],
     ['Pull Requests', 'Proposals'],
     ['Pull requests', 'Proposals'],
-    ['Actions', 'Evidence'],
     ['Commits', 'Checkpoints'],
     ['Branches', 'Attempts'],
     ['New Issue', 'New Task'],
@@ -25,7 +24,6 @@
     [/\bnew issue\b/g, 'new task'],
     [/\bIssues\b/g, 'Tasks'],
     [/\bissues\b/g, 'tasks'],
-    [/\bActions\b/g, 'Evidence'],
     [/\bCommits\b/g, 'Checkpoints'],
     [/\bBranches\b/g, 'Attempts'],
   ];
@@ -164,7 +162,7 @@
       workflowLink(document.querySelector('.hop-native-prompts-tab'), 'Prompts'),
       workflowLink(navigationLink('/issues'), 'Tasks'),
       workflowLink(navigationLink('/pulls'), 'Proposals'),
-      workflowLink(navigationLink('/actions'), 'Evidence'),
+      workflowLink(navigationLink('/actions'), 'Actions'),
     ].filter(Boolean);
     if (!links.length) return;