🤖 Overview

Drone is a web crawler operated by Harness Inc. (formerly Drone.io), a continuous integration and delivery platform first launched in 2012. Its primary purpose is to fetch source code, build artifacts, and repository metadata from version control hosts (e.g., GitHub, GitLab, Bitbucket) to power automated build, test, and deployment pipelines. Unlike search engine bots, Drone is a legitimate automated agent that interacts with web applications primarily through git clone operations and API calls, not general web indexing. Official documentation at docs.drone.io confirms its role as a CI runner that triggers builds based on webhook events.

🌐 Technical Behavior

Drone’s crawl pattern is event‑driven rather than periodic: it contacts web servers only when a push, pull request, or tag event is received via a webhook. Requests are made over HTTPS and typically target repository archive endpoints (e.g., /repos/{owner}/{repo}/zipball) and git smart‑HTTP protocols. The bot uses persistent HTTP connections and may issue multiple parallel requests to reduce build latency. IP ranges originate from major cloud providers (AWS, GCP, Azure) based on Harness’s infrastructure; a 2023 advisory on their status page listed approximately 50 CIDR blocks. Request frequency per repository is low (usually one clone per event), but across many repositories aggregated activity can become high. Drone does not browse HTML pages; it exclusively fetches version‑controlled data.

📋 robots.txt Compliance

Drone’s official documentation (docs.drone.io) does not mention robots.txt because the bot interacts only with authenticated API endpoints and git repositories, not public web content. Therefore it is not designed to honor Disallow directives, as those apply to web crawling rather than authenticated CI operations. Administrators who wish to block Drone must restrict access at the network level or via repository access controls, not through robots.txt.

🔍 Detection Indicators

The primary User-Agent string used by Drone is Drone/1.0 (or Drone/0.8 for older versions), often accompanied by a From header containing the repository URL. Additional identifying headers include X-Drone-Build-Id and X-Drone-Event. Behavioral fingerprints include requests to /git-upload-pack or /info/refs?service=git-upload-pack endpoints, which are characteristic of git operations. No IP‑based fingerprint is reliable due to cloud elasticity, but the User‑Agent string remains the strongest indicator.

📊 Data Usage

Collected source code and build metadata are used exclusively by Harness’s CI/CD platform to execute user‑defined pipelines (compile, test, deploy). No data is used for AI training, search indexing, or analytics outside the scope of the repository owner’s build processes. Drone does not store or sell content; it acts as a temporary relay between VCS systems and runner agents, deleting fetched data after the build completes.

⚙️ Rate Limiting Policy

Rate limiting for Drone is warranted because a single webhook event can trigger immediate parallel clone requests that may overwhelm small or rate‑unprotected servers. The policy rationale is to set a threshold (e.g., 10 requests per 10 seconds from a given IP) that blocks accidental flood behavior while still allowing legitimate CI operations. Blocking is not recommended; instead, rate‑limiting with a reasonable burst window ensures Drone’s activity does not degrade service for human users.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.