CI/CD

Fetch hosted scripts in a pipeline with curl. Do not put fetch tokens in logs or URLs if you can use a header.

Pattern

CI is just another client. Fetch the bytes, then run the interpreter in the job. Do not assume a clean scan means the script is safe for your pipeline.

Bash

curl -fsSL https://runny.sh/r/{slug} | bash

Secrets

For private scripts, put the fetch token in the runner’s secret store and send it as a header. Avoid ?token= in YAML; it lands in logs.

Bash

curl -fsSL -H "Authorization: Bearer $RUNNY_TOKEN" https://runny.sh/r/{slug} | bash

A GitHub Actions example lives under Integrations → GitHub Actions. There is no GitHub App. The workflow is ordinary curl.