@p @TeaTootler @m0xEE @phnt

> And completely changes the service from "Store these blobs" to "execute arbitrary code".

the system doesn't exec arbitrary code. it handles git operations, drops builds, runs linters, sast/sca, full test-harness with regression suite, then deployments where applicable. it's all very intentional.

ace theoretically could occur in the ci system (not related to forgejo), however if the operator is running a ci system that allows elevated privilege to the host operating system that the runners kick on, that is problematic and poor choice to make. i do not have that problem.

and the scraper issue people were hemming/hawing about is a non issue when you have a waf at the edge, which we do. (servo has ascended)