codeSplitter marketing: CI on your own hardware for a public repo, with no path in for fork PRs #978

Pitch codeSplitter's one-way mirror plus CiRunner as "run CI for your public repo on your own hardware, with no path in for strangers."

The use case

A public GitHub repo, mirrored one way into codeSplitter. codeSplitter's CiRunner hands jobs to a machine you own (a spare Mac at home, say), which pulls them. Nothing on that machine listens for incoming connections.

• Fork PRs never get in. They stay on GitHub and never mirror, so a stranger's .github/workflows edit can't reach your box. That's the usual reason GitHub warns against self-hosted runners on public repos, and personal accounts can't restrict runners to workflows (that needs an organization's runner groups).
• Only trusted code runs: merged main, which you reviewed, plus your own and your agents' branches pushed to codeSplitter.
• Your hardware: native builds, long sweeps and big test matrices run on the machine you already own. GitHub's free runners keep doing quick PR checks.

Honest framing

It's not new in kind. It's the pull model that big teams already use:

• GitLab's "CI/CD for external repos" (pull mirroring from GitHub plus GitLab runners)
• Buildkite (agents on your machines poll for work)
• GitOps in Kubernetes (Argo CD and Flux pull from git; nothing pushes into the cluster)

What's new is the packaging: that setup for one person and a home machine, without Kubernetes, GitLab or an organization. The headline is "the enterprise pull model, for one person and a spare Mac", not "a world first".

To do

• A short section (or a features.json entry, one item per line) in apps/codesplitter's README/REFERENCE, with a diagram: GitHub → mirror → codeSplitter → your machine pulls.
• Caveats in the pitch: job definitions live in codeSplitter's config, not the mirrored .github/ files, and run jobs as a sandbox user with no credentials, since merged code is code that runs at home.
• Check the claims against the code first: that the mirror really is one-way, that CiRunner jobs can target a pulling machine, and what's missing. File gaps as their own issues.

Related: #938 (the platform runs the loop).

🤖 Generated with Claude Code