May 2026 Summaries

RWX has added support for Codeberg and Forgejo, positioning its CI/CD platform as a portable option for teams moving away from GitHub or seeking more reliable tooling. While Woodpecker CI and Forgejo Actions may suit smaller projects that prefer CI closely integrated with their code forge, RWX emphasizes graph-based workflows, content-based caching, execution without committing or pushing code, and capabilities for secrets management, observability, repeatability, and rapid team-wide iteration. Existing RWX users can experiment with Forgejo without changing their workflows, and open-source projects hosted on Codeberg can request free usage credits through the RWX open-source program. The Forgejo integration supports Codeberg as well as other Forgejo instances through a setup guide for connecting repositories and running workflows.

A May 11 compromise of 42 TanStack packages reportedly used a chain of vulnerabilities in which a fork pull request running under GitHub Actions’ pull_request_target context poisoned a shared pnpm cache, allowing a later privileged release workflow on main to restore attacker-controlled binaries and publish malicious versions. The incident was detected within 20 minutes because the payload broke tests, though the account argues a less visible payload could have harvested CI credentials for longer. RWX contrasts its design with conventional key-value CI caches by deriving cache entries automatically from a task’s command, environment, dependencies, base layer, and sandboxed file inputs, meaning altered fork code produces a distinct content hash rather than overwriting main’s cache. Its incremental tool caches are stored in branch-lockable vaults, allowing feature branches and fork pull requests to read caches but preventing them from writing to caches used by protected branches. RWX also pins package versions, including transitive package dependencies, and argues that these structural controls reduce CI cache-poisoning risks, while acknowledging that they do not eliminate risks from compromised upstream dependencies.

RWX has introduced persistent cloud sandboxes designed for coding agents and developers to run individual tests and full CI pipelines through a shared application-development environment. The platform keeps agents under local control while executing commands in isolated cloud environments that use the same RWX run definitions as CI, content-based caching for rapid startup, and automatic synchronization of local changes before and after commands. RWX positions this approach as an alternative to managing separate Docker images, OCI images, snapshots, or per-worktree local environments, particularly for agents operating across git worktrees or remotely. Sandboxes can be configured with an `.rwx/sandbox.yml` file, invoked through `rwx sandbox exec`, and used alongside `rwx run` to validate both targeted changes and complete CI workflows before code is pushed.