foldrun 4.0.0 → 4.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/agents.md +9 -0
- package/docs/team-and-access.md +7 -0
- package/package.json +1 -1
package/docs/agents.md
CHANGED
|
@@ -506,6 +506,15 @@ and snapshots as `runtime: system:`, so a package anyone in the account
|
|
|
506
506
|
installed before is back in about a second. pip and npm packages need no root
|
|
507
507
|
and are installed as the agent, into a directory of the step's own.
|
|
508
508
|
|
|
509
|
+
A pip or npm package runs none of its own code on the way in. npm installs
|
|
510
|
+
with `--ignore-scripts` — no `preinstall` or `postinstall` — and pip takes
|
|
511
|
+
built wheels only (`--only-binary :all:`), because building a source package
|
|
512
|
+
runs its `setup.py`. Debian packages are different: apt runs their
|
|
513
|
+
maintainer scripts as root, which is why only the start-up's helper installs
|
|
514
|
+
them, and only by a checked package name from Debian's own archive. A package that exists only as source is refused with the line
|
|
515
|
+
to add instead: `runtime: packages:` builds it before the step, where the
|
|
516
|
+
build is declared and cached.
|
|
517
|
+
|
|
509
518
|
Each install is in the run log with the line that would have it ready before
|
|
510
519
|
the step starts — `install: apt ffmpeg — ready (snapshot, 1s). To have it
|
|
511
520
|
before the step starts: runtime: system: [ffmpeg]`. Moving it into `runtime:`
|
package/docs/team-and-access.md
CHANGED
|
@@ -50,6 +50,13 @@ because a key names an account and never a who — and exceed its role.
|
|
|
50
50
|
A scoped admin sees and revokes only keys inside its own scope; a key wider
|
|
51
51
|
than that, the owner's included, is not in its list.
|
|
52
52
|
|
|
53
|
+
A key stays no wider than its maker **after** it is made, too. Remove a
|
|
54
|
+
member and every key they minted in the account stops working at once —
|
|
55
|
+
the one `foldrun login` made included. Lower their role, or narrow their
|
|
56
|
+
workspaces, and each of their keys that would now reach more than they can
|
|
57
|
+
stops; they mint a new one at their new standing. Each such revocation is
|
|
58
|
+
in the audit log (`apikey.revoked`, and `keysRevoked` on `member.removed`).
|
|
59
|
+
|
|
53
60
|
A CI job or a contractor should hold a key that opens one workspace —
|
|
54
61
|
`foldrun keys create ci --workspaces leads`, or Settings → API keys. (Deploy
|
|
55
62
|
keys, for the platform's own git, went with it on 17 October 2026; one
|