> My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“.

Having worked at a Travis CI competitor that also offered open-source credits. The answer is "many" if you don't do anything about it...

What is the state of the art in doing something about this? Has anyone tried using CPU perf counters to see if the workload looks like hashing?

Indeed, that is why Travis said they were changing the way they handled open source, because people were using it to mine crypto. They just weren't clear that the "change" was basically "not anymore providing free services to open source".

> Running arbitrary code on a distributed network of end user PCs

It's a bit more complicated than that.

I run gitlab and gitlab runners for a living, I can tell.

First thing first, you'd have to register a runner with a specific project. So no "arbitrary code".

Second thing, unless you can push a branch to the project main repository, no pipeline is ran. So for your own personal forks you'd either rely on gitlab.com-provided free minutes or you run your own runner (and tbh, it's fairly easy).

Last thing: you should not think of regular end-users. Think of middle to advanced users, that have a home server or something like that (homelabbers?).

> First thing first, you'd have to register a runner with a specific project. So no "arbitrary code".

This isn't what "arbitrary code" means.

> The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs.

With GitHub Actions it's even simpler, and no OAuth required at all.

I especially like the auto-suggested template-types based on what kind of project the repo hosts (Node, Python, etc).