From 3e8e29c89863f426046d1575a6928b56e89978b3 Mon Sep 17 00:00:00 2001 From: zzswang Date: Tue, 11 Aug 2026 09:57:06 +0800 Subject: [PATCH 1/2] fix: track actions-runner latest tag GitHub rejects job messages from runner versions that fall out of the support window, and ARC disables runner self-update, so a pinned base image silently breaks every runner once it expires (2.334.0 now returns 403 and exit code 7). Tracking latest avoids the recurring outage; the build forces a base image pull so inline cache cannot pin a stale digest. Co-authored-by: Cursor --- .github/workflows/ci.yml | 2 ++ .github/workflows/release-please.yml | 2 ++ Dockerfile | 4 +++- 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a246e8a..97b8133 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -53,6 +53,8 @@ jobs: with: context: . push: true + # inline cache would otherwise pin the base image to a stale digest + pull: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=registry,ref=${{ env.DOCKER_IMAGE }} diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index eb2be94..ea52ee9 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -61,6 +61,8 @@ jobs: with: context: . push: true + # inline cache would otherwise pin the base image to a stale digest + pull: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=registry,ref=${{ env.DOCKER_IMAGE }} diff --git a/Dockerfile b/Dockerfile index f80f72e..fd43749 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,6 @@ -FROM ghcr.io/actions/actions-runner:2.334.0 +# Track latest: ARC disables runner self-update, and GitHub rejects job messages +# from runner versions that fall out of the support window (exit code 7). +FROM ghcr.io/actions/actions-runner:latest RUN sudo apt update -y && \ sudo apt install -y curl make bash jq From b0c97743158eb89a7e482ebfbd335e7fd5b3e065 Mon Sep 17 00:00:00 2001 From: zzswang Date: Tue, 11 Aug 2026 09:59:01 +0800 Subject: [PATCH 2/2] fix: pin actions-runner to 2.336.0 latest only resolves at build time; a published image is still a frozen snapshot, so tracking latest does not avoid the next deprecation outage and obscures which runner version each release contains. Pin 2.336.0 explicitly (current actions/runner release) to unblock ARC runners that fail with exit code 7 on deprecated 2.334.0. Co-authored-by: Cursor --- .github/workflows/ci.yml | 2 -- .github/workflows/release-please.yml | 2 -- Dockerfile | 4 +--- 3 files changed, 1 insertion(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 97b8133..a246e8a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -53,8 +53,6 @@ jobs: with: context: . push: true - # inline cache would otherwise pin the base image to a stale digest - pull: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=registry,ref=${{ env.DOCKER_IMAGE }} diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index ea52ee9..eb2be94 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -61,8 +61,6 @@ jobs: with: context: . push: true - # inline cache would otherwise pin the base image to a stale digest - pull: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=registry,ref=${{ env.DOCKER_IMAGE }} diff --git a/Dockerfile b/Dockerfile index fd43749..4841e29 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,4 @@ -# Track latest: ARC disables runner self-update, and GitHub rejects job messages -# from runner versions that fall out of the support window (exit code 7). -FROM ghcr.io/actions/actions-runner:latest +FROM ghcr.io/actions/actions-runner:2.336.0 RUN sudo apt update -y && \ sudo apt install -y curl make bash jq