Skip to content
chant Docs Demo

Run Applies Only on Started Runners

llms.txt lists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.
Show the whole prompt
Read https://intentius.io/chant/guide/security-isolated-runners/.
Add `isolated-runners` to `security` in `chant.workspace.json`, run `npx chant workspace check`, and list each `WSP165` finding with what a person has to do about it.
Open a pull request with the declaration change only.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Every security feature in chant is off until a workspace turns it on (#4168). A group turns on a set of them at once, and each feature still turns on alone; the security features reference lists them all.

Under isolated-runners, chant ci run apply refuses to start unless a provisioner’s runner-start statement names the job (#4147), as --require-runner-start does. The check runs before the job’s first step, so no secret reaches a runner nobody vouched for. chant ci serve runs its apply jobs through chant ci run, so it gets the same check, and chant build --pr-loop writes --require-runner-start into the generated apply job. A --local run on your own machine is exempt.

Without the group, a job runs on whatever runner picks it up.

Opt in

Section titled “Opt in”

Add the group to security in chant.workspace.json, at the top level for every member or on one member for that member only. A member’s list adds to the top-level one.

"security": ["isolated-runners"]

A declaration that uses security sets minReader to 0.124.33 or newer.

Fill the gaps

Section titled “Fill the gaps”

chant workspace check reports what the group still lacks as WSP165 warnings:

CodeWhat to do
security-runner-start-no-keyAdd the provisioner’s key under runners with chant workspace trust runner add <principal> --key <ssh-ed25519 line>, on a branch a person reviews.
security-runner-start-no-roleGrant that principal the runner role in .chant/trust.json: "roles": { "runner": ["<principal>"] }.
security-trust-unreadableFix .chant/trust.json so it reads; the finding says what is wrong.

The provisioner then signs a statement for each runner it starts with chant ci runner-start sign, and the job checks it with chant ci runner-start verify (chant ci).

chant