<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[My migration from GitHub to Gitea became stalled when I realized that you can tie self-hosted Actions runners to]]></title><description><![CDATA[<p>My migration from GitHub to Gitea became stalled when I realized that you can tie self-hosted Actions runners to</p><p>* Repos (per repo token)<br />* Orgs <br />* not to the Pro Account with all repos</p><p>If you migrate, you have a parallel setup. </p><p>Gitea allows global runners. It's by far less complex. Which is a strength. </p><p>To self-host a combined GitHub and Gitea Actions runner, I need to queue jobs. Per repo as well.</p><p>I also need to keep the jobs compatible.</p><p>To archive this, I use Dagger(.io). My GitHub Action YAML only defines the triggers in GitHub (on push etc.). Dagger works locally, on-prem and in the cloud. It's a compatibility layer that is much more sane than YAML.</p><p>With Dagger and a custom queue, it's possible to move away from Actions without much effort. But there is a certain vendor lock-in effect with GitHub Actions.</p><p>The other consideration is, that cloud-hosted GitHub Actions runners exist for Linux (AArch64, x86), Windows (same), macOS (x86, Silicon). And they are super cheap. </p><p>To get the best out of both worlds:</p><p>1. use Dagger where it's possible<br />2. build a custom combined builder queue</p><p><a href="https://infosec.exchange/tags/dagger" rel="tag">#<span>dagger</span></a> <a href="https://infosec.exchange/tags/cicd" rel="tag">#<span>cicd</span></a> <a href="https://infosec.exchange/tags/actions" rel="tag">#<span>actions</span></a> <a href="https://infosec.exchange/tags/gitea" rel="tag">#<span>gitea</span></a></p>]]></description><link>https://board.circlewithadot.net/topic/9672688d-3cd8-4c9a-86c2-ae3fa6a1e9a3/my-migration-from-github-to-gitea-became-stalled-when-i-realized-that-you-can-tie-self-hosted-actions-runners-to</link><generator>RSS for Node</generator><lastBuildDate>Sat, 30 May 2026 15:14:51 GMT</lastBuildDate><atom:link href="https://board.circlewithadot.net/topic/9672688d-3cd8-4c9a-86c2-ae3fa6a1e9a3.rss" rel="self" type="application/rss+xml"/><pubDate>Sat, 16 May 2026 08:49:47 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to My migration from GitHub to Gitea became stalled when I realized that you can tie self-hosted Actions runners to on Sun, 17 May 2026 15:43:06 GMT]]></title><description><![CDATA[<p><div class="card col-md-9 col-lg-6 position-relative link-preview p-0">



<a href="https://github.com/Infisical/agent-vault" title="GitHub - Infisical/agent-vault: A HTTP credential proxy and vault for AI agents like Claude Code, OpenClaw, Hermes, custom agents + harnesses, and more.">
<img src="https://repository-images.githubusercontent.com/1194056092/a7ca50e4-a2c1-4561-922e-5f16faf868c6" class="card-img-top not-responsive" style="max-height: 15rem;" alt="Link Preview Image" />
</a>



<div class="card-body">
<h5 class="card-title">
<a href="https://github.com/Infisical/agent-vault">
GitHub - Infisical/agent-vault: A HTTP credential proxy and vault for AI agents like Claude Code, OpenClaw, Hermes, custom agents + harnesses, and more.
</a>
</h5>
<p class="card-text line-clamp-3">A HTTP credential proxy and vault for AI agents like Claude Code, OpenClaw, Hermes, custom agents + harnesses, and more. - Infisical/agent-vault</p>
</div>
<a href="https://github.com/Infisical/agent-vault" class="card-footer text-body-secondary small d-flex gap-2 align-items-center lh-2">



<img src="https://github.githubassets.com/favicons/favicon.svg" alt="favicon" class="not-responsive overflow-hiddden" style="max-width: 21px; max-height: 21px;" />



<p class="d-inline-block text-truncate mb-0">GitHub <span class="text-secondary">(github.com)</span></p>
</a>
</div></p><p>This looks fascinating. </p><p>An open-source credential broker by Infisical that sits between your agents and the APIs they call.<br />Agents should not possess credentials. Agent Vault eliminates credential exfiltration risk with brokered access.</p><p>And that can be self-hosted or operated as SaaS. Going to follow this up next week, looking to see if this scales for larger dev teams. </p><p>The best defense against supply-chain compromise is being able to manage credentials. For many new AI threats, that will be the same. </p><p><a href="https://infosec.exchange/tags/agentic" rel="tag">#<span>agentic</span></a> <a href="https://infosec.exchange/tags/saas" rel="tag">#<span>saas</span></a> <a href="https://infosec.exchange/tags/agaas" rel="tag">#<span>agaas</span></a> <a href="https://infosec.exchange/tags/credentialtheft" rel="tag">#<span>credentialtheft</span></a></p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/windsheep/statuses/116590679604775124</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/windsheep/statuses/116590679604775124</guid><dc:creator><![CDATA[windsheep@infosec.exchange]]></dc:creator><pubDate>Sun, 17 May 2026 15:43:06 GMT</pubDate></item><item><title><![CDATA[Reply to My migration from GitHub to Gitea became stalled when I realized that you can tie self-hosted Actions runners to on Sat, 16 May 2026 16:16:47 GMT]]></title><description><![CDATA[<p>Decided to deploy Infisical with `pyinfra`(not using Ansible because of Yaml hell).</p><p>`pyinfra` is faster. <img src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f642.png?v=28325c671da" class="not-responsive emoji emoji-android emoji--slightly_smiling_face" style="height:23px;width:auto;vertical-align:middle" title=":)" alt="🙂" /> </p><p>Since we can use `uv` easily nowadays, the whole venv setup also becomes much simpler. </p><p>Good stuff. </p><p><a href="https://infosec.exchange/tags/ansible" rel="tag">#<span>ansible</span></a> <a href="https://infosec.exchange/tags/pyinfra" rel="tag">#<span>pyinfra</span></a> <a href="https://infosec.exchange/tags/yaml" rel="tag">#<span>yaml</span></a> <a href="https://infosec.exchange/tags/infisical" rel="tag">#<span>infisical</span></a></p>

<div class="row mt-3"><div class="col-12 mt-3"><img class="img-thumbnail" src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/585/146/058/133/311/original/b81da74d83a62c7d.png" alt="Link Preview Image" /></div></div>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/windsheep/statuses/116585149698235199</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/windsheep/statuses/116585149698235199</guid><dc:creator><![CDATA[windsheep@infosec.exchange]]></dc:creator><pubDate>Sat, 16 May 2026 16:16:47 GMT</pubDate></item><item><title><![CDATA[Reply to My migration from GitHub to Gitea became stalled when I realized that you can tie self-hosted Actions runners to on Sat, 16 May 2026 14:16:05 GMT]]></title><description><![CDATA[<p><div class="card col-md-9 col-lg-6 position-relative link-preview p-0">



<a href="https://infisical.com/blog/self-hosting-infisical-homelab" title="Self-Hosting Infisical: A Guide to Securing Your Homelab'...">
<img src="https://images.ctfassets.net/rzezkvk1rm65/3GsFhTLZxdws8sLyENMJeI/4cddf9d03afb2aebec06fa3ffc651991/homelab-secrets-management.webp" class="card-img-top not-responsive" style="max-height: 15rem;" alt="Link Preview Image" />
</a>



<div class="card-body">
<h5 class="card-title">
<a href="https://infisical.com/blog/self-hosting-infisical-homelab">
Self-Hosting Infisical: A Guide to Securing Your Homelab'...
</a>
</h5>
<p class="card-text line-clamp-3">Learn how to self-host Infisical to secure your homelab secrets. Step-by-step tutorial covers Docker deployment, backup key protection, and just-in-time secret injection. </p>
</div>
<a href="https://infisical.com/blog/self-hosting-infisical-homelab" class="card-footer text-body-secondary small d-flex gap-2 align-items-center lh-2">



<img src="https://infisical.com/infisical.ico" alt="favicon" class="not-responsive overflow-hiddden" style="max-width: 21px; max-height: 21px;" />





<p class="d-inline-block text-truncate mb-0">Infisical Blog <span class="text-secondary">(infisical.com)</span></p>
</a>
</div></p><p>I am thinking of using Infisical over Vault after the license change / IBM acquisition. </p><p>I think Vault is unnecessarily complex, and I have seen IBM simplifying software. </p><p><a href="https://infosec.exchange/tags/hashicorp" rel="tag">#<span>hashicorp</span></a> <a href="https://infosec.exchange/tags/vault" rel="tag">#<span>vault</span></a> <a href="https://infosec.exchange/tags/infisical" rel="tag">#<span>infisical</span></a> <a href="https://infosec.exchange/tags/ibm" rel="tag">#<span>ibm</span></a></p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/windsheep/statuses/116584675134313847</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/windsheep/statuses/116584675134313847</guid><dc:creator><![CDATA[windsheep@infosec.exchange]]></dc:creator><pubDate>Sat, 16 May 2026 14:16:05 GMT</pubDate></item></channel></rss>