chore(deps): update code.forgejo.org/forgejo/runner docker tag to v12 #6
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/code.forgejo.org-forgejo-runner-12.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
6.2.2->12.10.2Release Notes
forgejo/runner (code.forgejo.org/forgejo/runner)
v12.10.2Compare Source
Release Notes
v12.10.1Compare Source
Release Notes
v12.10.0Compare Source
Release Notes
v12.9.0Compare Source
Release Notes
workflow_callinputsv12.8.2Compare Source
Release Notes
one-jobreceives no taskv12.8.1Compare Source
Release Notes
^{commit}to actually letrev-parseresolve to the commitv12.8.0Compare Source
Release Notes
one-jobto request a particular jobdaemon,one-jobregister,create-runner-fileon.scheduleconnectcommand without replacementcreate-runner-filefrom Docker Compose examplev12.7.3Compare Source
Release Notes
logger.Panicfwith panics that have a useful error messagev12.7.2Compare Source
Release Notes
v12.7.1Compare Source
Release Notes
create-runner-filebehaviour changev12.7.0Compare Source
Release Notes
server.connectionsconfig to poll multiple Forgejo servers simultaneouslyv12.6.4Compare Source
Release Notes
v12.6.3Compare Source
Release Notes
node:ltsinstead ofnode:20-bullseyeas defaultdockerlabelv12.6.2Compare Source
Release Notes
v12.6.1Compare Source
Release Notes
PATHmodifications are lost in LXC executionsv12.6.0Compare Source
Release Notes
v12.5.3Compare Source
Release Notes
v12.5.2Compare Source
In combination with a runner with capacity > 1, and using Forgejo v14.0.0 or v14.0.1, this release has a known defect #1302 that may cause jobs to appear to be stalled in Forgejo. Please upgrade the runner to v12.5.3 to avoid this issue.
Release Notes
v12.5.1Compare Source
In combination with a runner with capacity > 1, and using Forgejo v14.0.0 or v14.0.1, this release has a known defect #1302 that may cause jobs to appear to be stalled in Forgejo. Please upgrade the runner to v12.5.3 to avoid this issue.
Release Notes
v12.5.0Compare Source
In combination with a runner with capacity > 1, and using Forgejo v14.0.0 or v14.0.1, this release has a known defect #1302 that may cause jobs to appear to be stalled in Forgejo. Please upgrade the runner to v12.5.3 to avoid this issue.
Release Notes
v12.4.0Compare Source
In combination with a runner with capacity > 1, and using Forgejo v14.0.0 or v14.0.1, this release has a known defect #1302 that may cause jobs to appear to be stalled in Forgejo. Please upgrade the runner to v12.5.3 to avoid this issue.
Release Notes
make integration-testcapacityjobs from Forgejo in one API callcmdandportsfrom container schemav12.3.1Compare Source
Release Notes
v12.3.0Compare Source
Release Notes
__metadatain workflow schema validationEvaluateWorkflowCallSecretsv12.2.0Compare Source
Release Notes
${{ needs... }}when expanding reusable workflowswithv12.1.2Compare Source
Release Notes
v12.1.1Compare Source
Release Notes
v12.1.0Compare Source
Release Notes
strategy.matrix--platformin container optionsforge.run_attemptis always 1lint-checkduring CI, add forbidigo, cleanup linter exclusionsv12.0.1Compare Source
Release Notes
v12.0.0Compare Source
Release Notes
Breaking change: This release is a major version bump due to a system requirement change, requiring a git installation. This requirement is included in the OCI containers, but may require the installation of a supported package, or packaging changes from redistributors of Forgejo Runner. Access to a
gitbinary is now required to access reusable actions and workflows, such asuse: action/checkout@v5-- before this release, access was performed using an internal library that avoided an external dependency. PRlxc-helpers.shhelper frmforgejo-runner-service.shv11.3.1Compare Source
Release Notes
v11.3.0Compare Source
Release Notes
v11.2.0Compare Source
Release Notes
[container].docker_hostv11.1.2Compare Source
Release Notes
Forgejo-Cache-Hostwhen ACTIONS_CACHE_URL is overridden.v11.1.1Compare Source
Release Notes
verboseto onv11.1.0Compare Source
Release Notes
v11.0.0Compare Source
Release Notes
The breaking change in this release is not technical, it is the change of the license which is now GPLv3-or-later.
v10.0.1Compare Source
Release Notes
v10.0.0Compare Source
Release Notes
PR: fix(security): prevent on: pull_request actions from mutating caches of other workflow events
forgej-runner currently creates a safer execution environment for workflows triggered by pull requests by denying those workflows access to the repository's secrets, preventing pull requests from compromising the confidentiality of the secrets.
Workflows do have access to write to the action cache, which is shared with future workflow executions, including executions that may have access to repository secrets. This was assumed safe as the cache is a "write-once" operation based upon the cache key; if an execution writes to that cache, it will be read by other workflows only if a matching key parameter is provided, and it can not be modified again. These assumptions were identified as weak security practices with known workarounds.
It is possible for a malicious pull request to mutate the shared cache and embed untrusted artifacts, which may later be executed in workflow executions with access to secrets, risking the confidentiality of those secrets.
In order to eliminate this risk, workflows executing with the
pull_requestandpull_request_targetevents have their write operations to the cache isolated to future workflow executions from the same pull request. They can continue to read from the shared cache if applicable.If using an external cache server configuration, both the cache server and other instances of the runner must be running the same software version. The recommended upgrade procedure in this configuration is to bring all runners offline, upgrade the cache server to the latest release and bring it online, and then bring all other runners online.
PR: fix(security): ensure unique names for container images created by actions
Without this fix, when a workflow ran a local docker action (e.g. the example in the end-to-end tests), it used an image tag that could collide with other workflows that happen to use the same name. The workaround for older runner versions is to set
[container].force_rebuild: truein the runner configuration file.job_levelandlevelgithub.com/pkg/errorsv9.1.1Compare Source
Release Notes
v9.1.0Compare Source
Release Notes
[runner].timeoutexpiresshellon a task step if it referenced a matrix variablev9.0.3Compare Source
Release Notes
job.<id>.services.<id>.optionsv9.0.2Compare Source
v9.0.1Compare Source
v9.0.0Compare Source
Workflows and actions go through a schema validation and the runner will not start a job if they do not pass. Some existing workflows or actions may have syntax errors that did not prevent them from running with versions 7.0.0 and below but they will no longer work with versions 8.0.0 and above.
Existing workflows can be verified and fixed before upgrading by using the new
forgejo-runner validatecommand. For instance, the following will try to validate workflows and/or actions found in the Git repository athttps://example.com/my/repo(a local directory at the root of a Git repository can also be used):If the error is not immediately obvious, please file an issue with a copy of the failed workflow and revert to using version 7.0.0 until it is resolved.
forgejo-runner validatecommand can be used to verify if an action or a workflow is conformant with the expected schema.forgejo-runner validate --repository https://example.com/my/repositorywill validate all the workflows and actions a Git repository contains. Alternativelyforgejo-runner validate --path myaction/action.yml --actionorforgejo-runner validate --path .forgejo/workflows/test.yml --workflowcan be used to validate a single file. It is recommended to use these commands to verify existing actions and workflows pass before upgrading to Forgejo runner v8.0.0 or above to not disrupt existing workflows.contrib/forgejo-runner.servicehostschema in 8.0.0 is a breaking changev8.0.1Compare Source
v8.0.0Compare Source
Existing workflows can be verified and fixed before upgrading by using
forgejo-runner exec --workflows path-to-the-workflow. For instance in a workflow whereruins-onwas typed by mistake instead ofruns-on: If the error is not immediately obvious, please file an issue with a copy of the failed workflow and revert to using version 7.0.0 until it is resolved.docker://node:22-bookworminstead ofdocker://node:20-bullseyeorhost.lxcscheme is set with no argument, it defaults tolxc://debian:bookworminstead oflxc://debian:bullseye.hostschema cannot have any argument, it can no longer behost://-self-hostedbashinstead ofshwhen a container image is explicitly specified in the step. If a workflow depens on that behavior, it will need to be modified to explictly set the shell tosh.[^A-Z0-9-]+. They will be sanitized and a message displayed in the logs showing the sanitized name. The service can either be renamed to match the constraint so it can be used as is. Or the sanitized name can be used. For instance of a PostgreSQL service runs asdata.baseit will be sanitized asdata_base.v7.0.0Compare Source
forge.FORGEJO_REPOSITORYis the same asgithub.GITHUB_REPOSITORY. TheGITHUB_*environment variables are preserved indefinitely for backward compatibiliy with existing workflows and actions. A workflow that previously set presetFORGEJO_*variables in any context, they will be overridden by this naming change. For instance ifsecrets.FORGEJO_TOKENwas set, it will be set to the automatic token and instead of the value from the secrets of the repository. The same is true forforge.FORGEJO_REPOSITORYetc.v6.4.0Compare Source
Do not use, it contains a regression fixed in 7.0.0.
v6.3.1Compare Source
v6.3.0Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.