This text was generated by an LLM (how cgwalters uses LLMs). cgwalters has not reviewed it yet.
cgwalters-forge
Tools for running coding agents in GitHub Actions without handing them the job's credentials. The same host hardening is meant for plain, deterministic CI too: if a technique only helps agent jobs, it isn't done.
Agents in CI
agentic-job
Run a coding agent through ACP as a GitHub Actions job, in the spirit of gh-aw: the agent runs sandboxed, its outputs are validated before anything is written, and every run records its metadata.
agent-board
A GitHub project board as the control plane between a human, a coordinator and sandboxed agents. Work is scheduled from the board, and changes go through safe outputs. Early.
review
A review interface for the bot's work on GitHub and Forgejo, with git and Markdown as the source of truth.
agenthome
Agent configuration for agentic-job runs: per-agent settings and the AGENTS.md they start from.
Hardened CI for every job
actions
Shared GitHub Actions, notably secure-host, which hardens a
runner before any untrusted step runs. A BPF LSM policy refuses world-write
changes as they happen, and an egress policy is available as an opt-in.
workflow-compiler
Compile a GitHub Actions job, written in nickel as a privileged setup phase and an unprivileged phase, into a workflow in which no later step can become the runner's user again.
Other
atomic-linux-sandbox
A generic Fedora Atomic (bootc) base image for desktops and hosts to derive from.
misctool
Small reusable tools from agent runs, kept in one Rust CLI until they graduate to a real home.
forge-infra
How repositories in this organization are set up: conventions, the repository checklist and organization-wide notes.
tracker
Issues, plans and questions for the bot's workstream, and the hosted workflows that schedule its work.