docs: document the one-time broker elevation flow and accept fine-grained tokens#4
Draft
tomgrv wants to merge 1 commit into
Draft
docs: document the one-time broker elevation flow and accept fine-grained tokens#4tomgrv wants to merge 1 commit into
tomgrv wants to merge 1 commit into
Conversation
The package builder's elevated mode was reworked: the install no longer fails on purpose, and the manual root step becomes a single reviewable 'sudo /var/packages/GithubRunner/scripts/elevate' command that grants the package user access to a root-owned broker instead of flipping the whole package to run-as root. Update the installation steps accordingly, add security notes about the Docker socket and the access token, and fix the Releases link pointing to a misspelled repository name. Also allow fine-grained personal access tokens in the install wizard: the previous validator only accepted exactly 40 characters, rejecting the more secure github_pat_* tokens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1PGYcSzo7GMyvgxFumZJ6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Companion to tomgrv/synology-package-builder#12, which replaces the elevated mode with a least-privilege root broker.
sudo /var/packages/GithubRunner/scripts/elevatecommand that shows the image, container name, privileged mode and mounts before approving, and grants the package user access to one root-owned broker instead of flipping the package torun-as: root. Documented that the approval survives upgrades, that a new runner image requires a re-approval, and that uninstalling revokes everything.github_pat_*tokens (maxLengthraised to 255).github-runner-synology).Verification
install_uifilestill parses as valid JSON.🤖 Generated with Claude Code
https://claude.ai/code/session_01R1PGYcSzo7GMyvgxFumZJ6
Generated by Claude Code