travis-build

The build execution bits of Travis appear to be open source: https://github.com/travis-ci/travis-build https://github.com/travis-ci/worker It should be possible to make a GitHub action that runs an existing .travis.yml.

I've moved on back when Travis CI employees have started recommending to turn off secret filtering in Windows build logs as a workaround for a bug, then decided to turn the workaround into a fix, exposing secrets in the logs of all Windows builds. https://travis-ci.community/t/current-known-issues-please-re... https://github.com/travis-ci/travis-build/pull/1719

Even disregarding CPU bugs, Travis CI is a security disaster. Keep your secrets far away from it. * They use 32-bit id to retrieve an OpenPGP key (meaning that anybody can get their key added to the APT keyring): https://github.com/travis-ci/travis-build/pull/1269 * Here they are identifying OpenPGP keys with HTTP URLs (sometimes with 32-bit id, too): https://github.com/travis-ci/apt-source-whitelist/blob/maste... * But none of the above matters much, because they use APT with the --force-yes, which among other things, disables package authentication: https://github.com/travis-ci/travis-build/commit/c4d15425f7b... [I reported the --force-yes bug to the security team in October 2017, but AFAICS nothing changed nice then.] * https://github.com/travis-ci/apt-package-whitelist is just bizarre. They try to to detect "malicious or goofy bits" w