Files
time/.github/workflows/venture.yml
T
teahubxyzandclaude 17e51a6b08 security: harden Time for a public repo (#45)
- beats_of/verdict/retry: trust only github-actions[bot] and owner/member/collaborator authors (forged state and stranger retries on a public repo)
- touches_protected: paginate pull files and include previous_filename
- browser_check: drop .git after clone, serve only the venture folder, Chrome with no network but localhost
- Hands.run: execute in a docker container when a daemon exists (TIME_RUN_IMAGE), host shell fallback
- tests: logins on fake comments, stranger retry/forged beat cases, paginated files fake


Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6

Co-authored-by: claude <noreply@anthropic.com>
2026-10-13 21:24:42 -07:00

59 lines
2.9 KiB
YAML

name: venture
# The venture loop: trending repos -> pitches -> board -> launch plan -> launch page on Pages -> 7 days of signups.
# Every 20 minutes it advances whatever is due (cheap when nothing is); a new venture card starts once a day,
# or right away: Actions -> venture -> Run workflow -> tick "Start a new venture now" (gh workflow run venture.yml -f start=true).
# Batches: TIME_VENTURE_BATCH=3 (or Run workflow -> batch) runs k ventures at once in one milestone.
# Off until TIME_VENTURE=on. Signups come in through .github/ISSUE_TEMPLATE/early-access.yml.
on:
schedule:
- cron: "*/20 * * * *"
workflow_dispatch:
inputs:
start:
description: "Start a new venture now, even if today's has already run"
type: boolean
default: false
batch:
description: "Start a venture batch now: one scout, the board's top k, launched together (k = TIME_VENTURE_BATCH, or 3)"
type: boolean
default: false
permissions:
contents: write
issues: write
pages: write
statuses: write
concurrency:
group: venture
cancel-in-progress: false
jobs:
tick:
runs-on: ubuntu-latest
timeout-minutes: 40
steps:
- uses: actions/checkout@v5
with:
sparse-checkout: .github/time
persist-credentials: false # the worker's shell must not find the token in .git/config
- run: python3 .github/time/venture.py tick
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VENICE_API_KEY: ${{ secrets.VENICE_API_KEY }}
TIME_RUN_IMAGE: node:22-bookworm # the worker's shell runs in a throwaway container, not next to these secrets
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} # optional: a backend per venture (cloudflare.py)
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
TIME_VENTURE_DOMAIN: ${{ vars.TIME_VENTURE_DOMAIN }}
TIME_VENTURE_AI_MODEL: ${{ vars.TIME_VENTURE_AI_MODEL }}
TIME_VENTURE: ${{ vars.TIME_VENTURE }}
TIME_VENTURE_START: ${{ inputs.start && '1' || '' }}
TIME_VENTURE_BATCH_START: ${{ inputs.batch && '1' || '' }}
TIME_VENTURE_BATCH: ${{ vars.TIME_VENTURE_BATCH }} # k; set, a batch replaces the daily single card
TIME_VENTURE_BATCH_HOLD_HOURS: ${{ vars.TIME_VENTURE_BATCH_HOLD_HOURS }} # launch-together hold (default 6)
TIME_VENTURE_HEAVY: ${{ vars.TIME_VENTURE_HEAVY }} # worker runs at once per tick (default 3)
TIME_VENTURE_PITCH: ${{ vars.TIME_VENTURE_PITCH }}
TIME_VENTURE_BOARD: ${{ vars.TIME_VENTURE_BOARD }}
TIME_VENTURE_CHAIR: ${{ vars.TIME_VENTURE_CHAIR }}
TIME_VENTURE_MEASURE_DAYS: ${{ vars.TIME_VENTURE_MEASURE_DAYS }}
TIME_WORKER: ${{ vars.TIME_WORKER }}
TIME_WORKER_STEPS: ${{ vars.TIME_WORKER_STEPS }}
TIME_WORKER_MAX_TOKENS: ${{ vars.TIME_WORKER_MAX_TOKENS }}