Skip to content

docs: restore developer guides and document recent validation changes#4010

Draft
cursor[bot] wants to merge 1 commit into
developfrom
cursor/engineering-documentation-updates-884f
Draft

docs: restore developer guides and document recent validation changes#4010
cursor[bot] wants to merge 1 commit into
developfrom
cursor/engineering-documentation-updates-884f

Conversation

@cursor

@cursor cursor Bot commented Jul 6, 2026

Copy link
Copy Markdown

Summary

Restores in-repo developer documentation and syncs deployment/API docs with recent runner and workflow changes on develop.

Docs added/updated

File Change
docs/developer/README.md Index for in-repo developer docs
docs/developer/runner-auth-and-jwt.md Runner bearer tokens, registration, online/offline status, fleet timeouts, task JWT
docs/developer/runner-executors.md Local/docker/k8s executor strategies
docs/developer/docker-images.md Server, runner, job, helper images
docs/developer/workflows.md Pro workflow API surface
docs/developer/ha-cluster-dashboard.md HA cluster admin routes
docs/developer/input-validation.md New — playbook path, git URL, branch override, custom roles, access key checks
deployment/compose/README.md Runner liveness/timeouts; fix duplicate SQLite section
deployment/docker/README.md Job/helper image table
api-docs.yml Runner status/started_at, template jwt_params, workflow stop endpoint; remove stale runner private_key
README.md, CONTRIBUTING.md Link developer docs; drop --recursive clone (submodule removed)

Codepaths covered

  • Runner auth and liveness: api/runners.go, db/Runner.go, services/runners/, util/config.go (runners.*)
  • Task JWT: template jwt_params, /.well-known/jwks.json
  • Executors and Docker images: services/runners/, deployment/docker/
  • Workflows (Pro): workflow run/stop endpoints
  • HA cluster API: admin cluster routes
  • Input validation: db/playbook_path.go, db/git_url.go, services/tasks/local_executor.go (resolveGitBranch), db/Role.go, api/projects/keys.go

Knowledge gaps addressed

  • Broken semaphore-docs submodule replaced with maintained in-repo developer notes
  • Runner online/offline semantics and fleet timeout config documented for operators
  • Recent security fixes on develop (playbook path traversal, git option injection, branch override gate, custom role slug shadowing, access key IDOR) explained for contributors
  • API spec aligned with runner JWT and workflow stop behaviour
Open in Web View Automation 

Replace the broken semaphore-docs submodule with in-repo documentation under
docs/developer/. Restores guides for runner auth/JWT, executors, Docker images,
workflows, and the HA cluster API from prior doc automation work.

- Sync api-docs.yml with runner status/started_at, template jwt_params, workflow
  stop endpoint; remove stale runner private_key field
- Document runner liveness timeouts in deployment/compose README
- Add job/helper image table to deployment/docker README
- Fix duplicate SQLite section in compose docs
- Add input-validation.md for playbook path, git URL, branch override, roles,
  and access key update checks (develop commits since June 2026)
- Link developer docs from README and CONTRIBUTING; drop --recursive clone hint

Co-authored-by: Denis Gukov <fiftin@outlook.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant