chore: sync upstream, and fix Renovate skipping this fork - #5
Merged
Conversation
…ub-runner-2.x Update myoung34/github-runner Docker tag to v2.336.0
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ding Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add PR build testing and auto-merge for dependency PRs
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
The upstream myoung34 entrypoint reuses CONFIGURED_ACTIONS_RUNNER_FILES_DIR credentials unconditionally: if .runner exists it skips registration with no validation and no fallback. When the runner has been removed server-side (GitHub prunes runners offline >14 days, manual deletion, etc), the stored credentials are dead and the container crash-loops forever — even though a valid ACCESS_TOKEN is sitting in the environment the whole time. Add a preflight entrypoint that asks GitHub whether the persisted agentId still exists. Only a definitive 404 wipes the persisted registration, letting the upstream entrypoint fall through to fresh ACCESS_TOKEN registration and store the new credentials back. Transient errors, missing env, or unparseable state leave everything untouched, so behavior is never worse than upstream. Declaring ENTRYPOINT resets the CMD inherited from the base image, so the base CMD is restated verbatim. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…sisted-registration fix: validate persisted runner registration before reusing it
The 404 wipe removed .runner/.credentials/.credentials_rsaparams but left
.runner_migrated behind. The runner's IsConfigured() treats .runner_migrated
as a valid config (ConfigurationStore.cs checks either file), so config.sh
refused to re-register while run.sh crashed loading the missing .runner
("Value cannot be null. (Parameter 'configuredSettings')") — an unrecoverable
crash loop, observed on bump-android-nas.local after GitHub pruned its
registration during a long offline stretch.
Wipes now cover the migrated files, clean /actions-runner as well (the
writable layer survives restarts and the upstream persist-back step re-seeds
the persist dir from it), and a preflight pass heals the already-wedged
orphaned-.runner_migrated state left by older images.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…rated-config fix: wipe migrated config files too when clearing dead registrations
Merges upstream `compscidr/docker-github-actions-runner-android@main`. The
fork's own features (GHCR-only publishing, multi-arch amd64+arm64 manifests,
Node.js LTS matrix, digest-based merge job) are preserved; upstream's additions
are taken as-is where they don't collide.
Taken from upstream:
- Base runner image 2.335.1 -> 2.336.0-ubuntu-noble.
- preflight-entrypoint.sh: validates the persisted runner registration against
the GitHub API and wipes it only on a definitive 404, so a runner removed
server-side re-registers from ACCESS_TOKEN instead of crash-looping forever.
Wired up as ENTRYPOINT, with the base image's CMD restated.
- A PR build workflow with an "All builds passed" gate job, adapted to this
fork's matrix: every JDK against the default Node, every Node against the
default JDK, plus one linux/arm64 build of the default pair. That is 9 builds
instead of the ~28 the full java x node x arch product would produce, and the
arm64 build keeps the TARGETARCH-derived JAVA_HOME covered.
- Upstream's design/plan docs, annotated with where this fork deviates.
Deliberately not taken: upstream's AUTOMERGE_PAT requirement and
`gh pr merge --auto` in the weekly update workflow. That workflow keeps using
GITHUB_TOKEN, so its permissions stay contents:write + pull-requests:write and
its PRs are merged manually. PRs opened with GITHUB_TOKEN do not trigger
workflows, so an auto-merge request would wait forever on a check that never
runs.
Renovate fixes:
- Add `"forkProcessing": "enabled"`. This is why the base image stopped being
updated: the Mend-hosted App leaves forkProcessing disabled for org-wide
("All repositories") installations, so it silently skipped this repository.
2.336.0-ubuntu-noble had been available since 2026-07-20 with no PR raised.
- `config:base` -> `config:recommended`; the old preset only survived via a
deprecation migration and the config validator flagged it.
Also points docker-compose.yml's commented-out image at this fork's GHCR image
rather than upstream's Docker Hub one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges upstream
compscidr/docker-github-actions-runner-android@mainand fixes the reason Renovate stopped bumping the base image.Why the base image was stale
The Mend-hosted Renovate App leaves
forkProcessingdisabled for org-wide ("All repositories") installations, anddodi-smartinstalls it that way — so Renovate silently skipped this repository because it is a fork.2.336.0-ubuntu-noblehad been on Docker Hub since 2026-07-20 with no PR raised.renovate.jsonnow sets"forkProcessing": "enabled".Two supporting problems, both fixed:
extends: ["config:base"]only worked through a deprecation migration; the config validator flagged it. Nowconfig:recommended.Taken from upstream
2.335.1→2.336.0-ubuntu-noblepreflight-entrypoint.sh404, so a runner removed server-side re-registers fromACCESS_TOKENinstead of crash-looping. Wired asENTRYPOINTwith the base image'sCMDrestatedAll builds passedgateThe fork's own features are preserved: GHCR-only publishing, multi-arch amd64+arm64 manifests, the Node.js LTS matrix, and the digest-based merge job.
PR build matrix
Upstream builds JDKs on amd64 only. The full
java × node × archproduct here would be ~28 images per PR, sobuild.ymlcovers every JDK against the default Node, every Node against the default JDK, and onelinux/arm64build of the default pair — 9 builds. The arm64 build keeps theTARGETARCH-derivedJAVA_HOMEcovered, which is fork-specific and the most likely thing to break silently.Deliberately not taken
Upstream's
AUTOMERGE_PATrequirement andgh pr merge --autoin the weekly SDK/JDK/Node workflow. That workflow keeps usingGITHUB_TOKENand its PRs are merged manually. PRs opened withGITHUB_TOKENdo not trigger workflows, sobuild.ymlwould never run and an auto-merge request would hang forever on a check that never reports. Adopting it would also hard-fail the weekly workflow until a PAT secret exists.Verification
renovate-config-validator: passes clean, no migration warning.matrix.jsonand produces the expected 9 entries.bash -non both shell scripts;jqon both JSON files; no conflict markers anywhere.build.ymlrun is the first real build of the merged Dockerfile.Follow-up (not done here)
Require the
All builds passedcheck onmainin branch protection — that is what lets Renovate'splatformAutomergeactually work now that auto-merge is enabled.🤖 Generated with Claude Code