always-further/nono sandbox
Run a command inside a nono sandbox with filesystem, network, and credential controls
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 24, 2026
- License
- None
Pinned Snippet
uses: always-further/nono-action@8beb58b282d01be952e8bc8b4496349d905fe28c # no releases — HEAD as of 2026-07-13tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| run | Command to execute inside the sandbox | yes | — |
| fs-read | Comma-separated paths to allow read access (default: working directory) | no | "" |
| fs-write | Comma-separated paths to allow write access | no | "" |
| network | Network policy: 'blocked', or comma-separated domain allowlist (e.g. 'registry.npmjs.org,api.github.com') | no | blocked |
| credentials | Newline-separated credential mappings. Each line: SECRET_NAME:host:inject_mode Example: DEPLOY_TOKEN:api.fly.io:header NPM_TOKEN:registry.npmjs.org:header | no | "" |
| endpoint-rules | Newline-separated endpoint allow rules for credential routes. Each line: SECRET_NAME:METHOD:path_glob Example: DEPLOY_TOKEN:POST:/apps/*/releases DEPLOY_TOKEN:GET:/apps/*/status | no | "" |
| nono-version | nono version to install (default: latest) | no | latest |
| profile | Path to a nono profile JSON (overrides fs-read/fs-write/network inputs) | no | "" |
Outputs
no outputs