Cloud runs: start an incode task on a remote machine and get the result back #23

Activity

1. blockmandev

   added 2 commits that reference this issue on Oct 22, 2026

   remote: find the template's publish job by line, not by "\n" (refs #23)

   ...

   24d0a78

   Merge pull request #49 from incordai/feat/remote-run

   ...

   93762c4
2. blockmandev commented on Oct 22, 2026

   

   blockmandev

   on Oct 22, 2026

   MemberAuthor

   More actions

   Done in #49 (merged 93762c4): incode remote run | list | logs.

   The three open questions, settled:

   • Backend: GitHub Actions only (workflow_dispatch).
   • Result: a branch incode/remote-<id> plus the JSON result. No pull request is opened automatically; a person reviews the branch.
   • Timeout: the client waits 60 minutes by default (--timeout, 1–10080). A wait that runs out cancels nothing, and incode remote logs <run-id> reads the result later. The job itself is capped at 120 minutes.

   How it works:

   • incode remote run "<task>" [-R owner/repo] [--ref <branch>] [-m <model>] [--timeout <min>] [--no-wait]:
     • dispatches the repository's incode-remote.yml with task, model and a fresh id, and finds the run by that id in its title;
     • checks the run every 10 s (up to 5 failed reads in a row are retried rather than ending the wait);
     • prints result.json from the run's incode-result artifact: the incode -t --output-format json result plus branch.
     • It exits non-zero when the run failed, the task reported is_error, or the wait ran out.
   • incode remote list shows recent runs. incode remote logs <run-id> shows one run's state and result, and exits non-zero for a completed run that failed.
   • No gh dependency: it uses reqwest. The token comes from GH_TOKEN, else GITHUB_TOKEN.
     • It travels only in a header, only to the API's own origin, and only over https.
     • The artifact download's redirect to blob storage is fetched without it.

   The workflow ships as a template, .github/workflows/incode-remote.yml.example; setup is in docs/remote-runs.md. It has two jobs:

   • task runs the agent with contents: read and no stored credentials, then uploads its result and a patch of its changes as data.
   • publish, on a fresh runner with contents: write, applies the patch and pushes the branch.
   • Why two jobs: a hosted runner gives the agent's commands sudo, so the job that can push never runs anything the agent left behind.
   • A patch holding the model key as written is not pushed.
   • Every input reaches the shell only through environment variables.

   Verified:

   • 13 tests against a loopback fake GitHub, with key tests checked by deliberately broken controls.
   • The workflow's git steps were simulated against a local bare repo (normal case, a patch holding the key, an invalid id).
   • CI is green on Linux, macOS and Windows.

   Not yet verified: a first real run on GitHub Actions. It needs a repository with the workflow copied in and the ANTHROPIC_API_KEY secret set.

   Left for later, as this issue planned: a self-hosted target (an SSH host or a container, with incode serve and sbx on the far side).
3. blockmandev

   closed this as completedon Oct 22, 2026