What does a sandbox need?

One variable, HUSHRUN_AGENT, holding an agent token an admin created, network access to api.hushrun.com, and hushrun 0.6.0 or later in the repository.

Does a sandbox's pass skip CI?

Yes, in a CI job without variants, unless an admin set the repository so that its CI reuses only CI's results. A job with variants, such as a matrix, skips only on its own CI pass.

What if the sandbox can't reach hushrun?

The check runs, as it would without hushrun, and its exit code doesn't change. hushrun says why in one line.

What if the network goes away after setup?

For compiled code, the setup script runs hushrun build fetch with the checks the agent will run. Later runs reuse what it saved for 24 hours, with no network and no token. How

Do I need an account?

Yes, for a sandbox: its token belongs to an organization on hushrun's hosted service, free up to 2,000 recorded checks a month. Skips are free.

Sandboxes skip what already passed

A coding agent in a sandbox runs your checks through hushrun, and skips each one that you, CI or another agent already passed on these exact files. What it passes is recorded for your team, so CI can skip those checks after the push.

Start free Ask for help

Free to start, with GitHub.

Or run this at your repository's root:

$ npx hushrun init

It finds your checks, signs you in with GitHub so results are shared with CI and your team, and shows every change before making it.

What a sandbox reuses Checks, tests, compiled code.

hushrun's output

hushrun: test skipped: this exact code passed in CI 3 min ago (saves 41s)
hushrun: unit passed in 3s; reusing 98 tests saved about 1s; it won't run again on this code
hushrun: build: 226 of 360 crates reused (226 from the shared store), 134 built, saving about 2m 3s

A check that passed
When you, CI or another agent passed this check on the same files, the sandbox skips it and exits 0, as a pass. Change one file, and it runs.
How a skip works
Tests whose files didn't change
When a check's code changed, it can leave out the tests that already passed on the files they read, and run the rest. It's off until you turn it on, check by check.
What it works with
Compiled code
Where your organization shares compiled code, a sandbox downloads what your trusted CI (branches an admin lists) already compiled instead of compiling it again. The shared store is off until an admin turns it on.
What it works with

Each line is hushrun's output as its docs print it: an example of what it says, not a measurement.

Set it up in a sandbox One variable, HUSHRUN_AGENT.

The repository's checks already run through hushrun, as npx hushrun init sets them up. A sandbox has no browser to sign in with, so it uses an agent token instead.

Create an agent token
An admin runs hushrun token create --agent fleet-a, or uses the dashboard's Agents page. It prints one line, HUSHRUN_AGENT=…, once. One string can serve a whole fleet.
Give each sandbox the variable
Store it as a secret in the sandbox's environment: it holds a private key. HUSHRUN_INVOKED_BY=agent:<id> labels each sandbox's runs in the dashboard.
Let it reach hushrun
Allow api.hushrun.com and your package registry. Where your organization shares compiled code, allow its store's host too.
Run the checks the usual way
The repository's scripts now skip what already passed, and record what runs. hushrun whoami shows the agent, its repository and when its token expires.

For cloud agent sessions, containers, fleets and sandboxes that lose the network after setup: Agents in sandboxes.

Why it's safe to reuse Signed, for one repository.

Signed by your organization
A pass counts only when a member's machine, one of your agent tokens or your repository's CI signed it. The server keeps the token's hash and the public half of its key, never the token.
Scoped, and it lapses
A token covers one repository unless an admin makes it cover the organization. It expires after 30 days unless set otherwise, a year at most. Revoke it, and nothing it signs from then on counts.
It writes no compiled code by default
A sandbox reuses only what your trusted CI compiled, and uploads nothing unless an admin turns writing on for its token.

What has to match for a skip, and what the service sees: Why a skip is safe.

Questions about sandboxes

What does a sandbox need?: One variable, HUSHRUN_AGENT, holding an agent token an admin created, network access to api.hushrun.com, and hushrun 0.6.0 or later in the repository.
Does a sandbox's pass skip CI?: Yes, in a CI job without variants, unless an admin set the repository so that its CI reuses only CI's results. A job with variants, such as a matrix, skips only on its own CI pass.
What if the sandbox can't reach hushrun?: The check runs, as it would without hushrun, and its exit code doesn't change. hushrun says why in one line.
What if the network goes away after setup?: For compiled code, the setup script runs hushrun build fetch with the checks the agent will run. Later runs reuse what it saved for 24 hours, with no network and no token. How
Do I need an account?: Yes, for a sandbox: its token belongs to an organization on hushrun's hosted service, free up to 2,000 recorded checks a month. Skips are free.

Try it in one sandbox

Start free

$ npx hushrun init

Want help setting it up?

Leave your work email, and we'll write back.

Sandboxes skip what already passed

What a sandbox reuses Checks, tests, compiled code.

A check that passed

Tests whose files didn't change

Compiled code

Set it up in a sandbox One variable, HUSHRUN_AGENT.

Create an agent token

Give each sandbox the variable

Let it reach hushrun

Run the checks the usual way

Why it's safe to reuse Signed, for one repository.

Signed by your organization

Scoped, and it lapses

It writes no compiled code by default

Questions about sandboxes

Try it in one sandbox

Want help setting it up?