fix(provider): the runner pin constrains what runs, not what GitHub advertises; release .121 - #376
Merged
rldyourmnd merged 2 commits intoSep 2, 2026
Conversation
…dvertises Every create validated that the runner package GitHub advertises equals the version the fleet pins. The fleet never downloads that package: the warm claim and the direct-JIT cold create both run the runner baked into the image, and neither passes the cloud-config the metadata would have fed (.108). The version that runs is pinned where it is installed -- the image manifest names the archive and its digest, the build verifies both, the smoke asserts the installed runner. So the guard made every create depend on GitHub's release schedule. On 2026-09-02 GitHub moved all three organisations to 2.337.0 while the image baked 2.336.0, and within ten minutes 25 of 77 creates failed with "filename ... does not match pinned ..."; the share would have reached every create as the warm pools drained. The asset must still be an official actions/runner linux-x64 release tarball whose download URL is the github.com release URL for that same filename, so a substituted host, another architecture or a renamed asset is refused exactly as before. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp
…elease Source 53ec735, built twice with CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags "-buildid= -s -w -X main.version=v0.1.5-nddev.121 -X main.commit=<source>"; both builds agree on b0d1a6980bb7efdd112acaed141d01708eeed9bb211770edc965cc033ff322a7. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp
rldyourmnd
enabled auto-merge
September 2, 2026 13:06
rldyourmnd
deleted the
fix/the-pin-lives-in-the-image-not-in-githubs-offer
branch
September 2, 2026 13:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live incident. GitHub moved all three organisations to runner 2.337.0 today while the worker image bakes 2.336.0. Every create validated GitHub's advertised package against the fleet's pin and refused: 25 of 77 creates failed in ten minutes, and the share would have reached every create as the warm pools drained. Jobs kept starting only because warm instances were already built.
The fleet never downloads that package. The warm claim and the direct-JIT cold create both run the runner baked into the image, and neither passes the cloud-config the metadata would have fed (provider .108 removed it). The version that runs is pinned where it is installed: the image manifest names the archive and its digest, the build verifies both, the smoke asserts the installed runner.
The guard now requires the advertised asset to be an official
actions/runnerlinux-x64 release tarball whose download URL is the github.com release URL for that same filename. A substituted host, another architecture, a renamed asset or a mismatched URL is refused exactly as before; a newer advertised version is not a reason to refuse a job.Release v0.1.5-nddev.121, two reproducible builds agree.
https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp