From 41f1e08becdb84007c22745a43de6bc0d3c6dec3 Mon Sep 17 00:00:00 2001 From: silverwind Date: Tue, 20 Oct 2026 16:14:16 +0000 Subject: [PATCH] chore(deps): bump the pins Renovate does not update (#1330) Renovate gets no release timestamps for Docker Hub images with more than 1000 tags (https://github.com/renovatebot/renovate/issues/46925) or for quay.io, so the 5-day minimum release age holds them back forever. The e2e workflows, the Kubernetes examples and the toolkit test pins are outside its managers, so these are bumped by hand. The builder follows the current Alpine instead of the frozen 3.23. Reviewed-on: https://gitea.com/gitea/runner/pulls/1330 Reviewed-by: bircni Co-authored-by: silverwind --- Dockerfile | 6 +++--- Makefile | 6 +++--- README.md | 2 +- act/runner/patch_actions_e2e_test.go | 18 +++++++++--------- e2e/testdata/workflows/cache.yml | 4 ++-- e2e/testdata/workflows/kubernetes.yml | 2 +- e2e/testdata/workflows/payloads.yml | 4 ++-- examples/kubernetes/dind-docker.yaml | 2 +- examples/kubernetes/statefulset-dind.yaml | 2 +- 9 files changed, 23 insertions(+), 23 deletions(-) diff --git a/Dockerfile b/Dockerfile index a025c9c0..d6214006 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ ### BUILDER STAGE # # -FROM golang:1.27-alpine3.23 AS builder +FROM golang:1.27-alpine AS builder # Do not remove `git` here, it is required for getting runner version when executing `make build` RUN apk add --no-cache make git @@ -17,7 +17,7 @@ RUN make clean && make build ### DIND VARIANT # # -FROM docker:29.7.2-dind AS dind +FROM docker:29.9.1-dind AS dind ARG VERSION=dev @@ -39,7 +39,7 @@ ENTRYPOINT ["s6-svscan","/etc/s6"] ### DIND-ROOTLESS VARIANT # # -FROM docker:29.7.2-dind-rootless AS dind-rootless +FROM docker:29.9.1-dind-rootless AS dind-rootless ARG VERSION=dev diff --git a/Makefile b/Makefile index 08e972d2..4fb2dee7 100644 --- a/Makefile +++ b/Makefile @@ -8,11 +8,11 @@ XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go XGO_VERSION := go-1.27.x GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.17 # renovate: datasource=go -PODMAN_TEST_IMAGE ?= quay.io/containers/podman:v5.8.4-immutable@sha256:90405e3c6a86f33c5a6f8dbdfa8e02a98143a8ba4337b84bdaec5336d2ef008a # renovate: datasource=docker +PODMAN_TEST_IMAGE ?= quay.io/containers/podman:v5.8.9-immutable@sha256:87f42f37fa85b421664c30b8f5f9cfc23920057f5e5fcadf0b6f68d9edc6d415 # renovate: datasource=docker E2E_JOB_IMAGE ?= docker.gitea.com/runner-images:ubuntu-latest@sha256:0e62e56b382ebf485bff1e51a05cbe27c708545a2e91425467fd31eb3e249521 # renovate: datasource=docker -SERVICE_IMAGE ?= nginx:1.31.4-alpine@sha256:db35bfc6b2951e7f8a72db5db120288c127ffaeeb4a6d4b95a26fead017d5913 # renovate: datasource=docker +SERVICE_IMAGE ?= nginx:1.31.7-alpine@sha256:892bb2152464f0c5d8972593a5f5afaf8054552580b699d95f8ff4af08c2d33d # renovate: datasource=docker E2E_GITEA_IMAGE ?= gitea/gitea:main-nightly -E2E_K3S_IMAGE ?= rancher/k3s:v1.36.4-k3s1@sha256:edad48e12bf81c3a09ac1c05c0c0ffaaa22145980b989d6fae84543a76b83657 # renovate: datasource=docker +E2E_K3S_IMAGE ?= rancher/k3s:v1.37.1-k3s1@sha256:ca7f37d993d82ef0dcdcfecb2e0e2618ea541dbaffc620c8cedebe01a82acd0d # renovate: datasource=docker LINUX_ARCHS ?= linux/amd64,linux/arm64 DARWIN_ARCHS ?= darwin-12/amd64,darwin-12/arm64 diff --git a/README.md b/README.md index f854198d..b1828467 100644 --- a/README.md +++ b/README.md @@ -242,7 +242,7 @@ A job's `services` are started before its steps run. When a service's image or i ```yaml services: postgres: - image: postgres:17 + image: postgres:18 options: >- --health-cmd pg_isready --health-interval 5s diff --git a/act/runner/patch_actions_e2e_test.go b/act/runner/patch_actions_e2e_test.go index 5a8d14cc..f824866c 100644 --- a/act/runner/patch_actions_e2e_test.go +++ b/act/runner/patch_actions_e2e_test.go @@ -200,21 +200,21 @@ func TestPatchedBundleAcrossActions(t *testing.T) { // The cache toolkit, in each bundler shape and from a spread of ecosystems, including the // actions that drive a Go or a Rust cache client of their own. {"actions/cache", actionsCacheRef, "dist/restore/index.js", true}, - {"actions/setup-node", "v7.0.0", "dist/cache-save/index.js", true}, + {"actions/setup-node", "v7.1.0", "dist/cache-save/index.js", true}, {"actions/setup-python", "v7.0.0", "dist/setup/index.js", true}, {"actions/setup-go", "v7.0.0", "dist/setup/index.js", true}, {"actions/setup-java", "v5.7.0", "dist/setup/index.js", true}, - {"ruby/setup-ruby", "v1.321.0", "dist/index.js", true}, - {"pnpm/action-setup", "v6.0.9", "dist/index.js", true}, + {"ruby/setup-ruby", "v1.331.0", "dist/index.js", true}, + {"pnpm/action-setup", "v6.1.0", "dist/index.js", true}, {"oven-sh/setup-bun", "v2.2.0", "dist/setup/index.js", true}, {"Swatinem/rust-cache", "v2.9.1", "dist/restore/index.js", true}, - {"docker/build-push-action", "v7.3.0", "dist/index.cjs", true}, + {"docker/build-push-action", "v7.4.0", "dist/index.cjs", true}, // The artifact toolkit, where the gate is a refusal and there is nothing to redirect. // v4.4.0 is the first release whose gate carries the localhost test this matches; the // releases before it refuse in a shape the runner leaves alone. {"actions/upload-artifact", "v4.4.0", "dist/upload/index.js", true}, - {"actions/upload-artifact", "v7.0.1", "dist/upload/index.js", true}, - {"actions/download-artifact", "v8.0.1", "dist/index.js", true}, + {"actions/upload-artifact", "v7.0.2", "dist/upload/index.js", true}, + {"actions/download-artifact", "v8.0.2", "dist/index.js", true}, // Neither toolkit's gate, so these have to come back byte for byte. sccache-action is the // one that exports ACTIONS_CACHE_SERVICE_V2 itself, for the Rust client it installs. {"actions/checkout", "v7.0.1", "dist/index.js", false}, @@ -297,7 +297,7 @@ func TestUploadArtifactThroughTheResultsService(t *testing.T) { token := "e30." + base64.RawURLEncoding.EncodeToString([]byte(`{"scp":"Actions.Results:11:22"}`)) + ".sig" defer handler.RegisterJob(token, artifactcache.JobCredential{Repo: "testuser/testrepo", Results: gitea.URL})() - upload := patchedAction(t, "actions/upload-artifact", "v7.0.1", "dist/upload/index.js") + upload := patchedAction(t, "actions/upload-artifact", "v7.0.2", "dist/upload/index.js") env := jobEnv{ workspace: tempDirPath(t), @@ -319,7 +319,7 @@ func TestUploadArtifactThroughTheResultsService(t *testing.T) { // And back down again: listing and downloading go the same way, and the signed URL the // artifact service hands out is fetched straight from it. - download := patchedAction(t, "actions/download-artifact", "v8.0.1", "dist/index.js") + download := patchedAction(t, "actions/download-artifact", "v8.0.2", "dist/index.js") env.workspace = tempDirPath(t) out = runActionEntrypoint(t, download, env, map[string]string{ "name": "an-artifact", "path": "downloaded", "merge-multiple": "false", @@ -341,7 +341,7 @@ func TestUploadArtifactThroughTheResultsService(t *testing.T) { func TestSetupActionFindsTheCacheService(t *testing.T) { requireHostTools(t, "node", "npm") - setup := patchedAction(t, "actions/setup-node", "v7.0.0", "dist/setup/index.js") + setup := patchedAction(t, "actions/setup-node", "v7.1.0", "dist/setup/index.js") handler, err := artifactcache.StartHandler(artifactcache.Options{Dir: filepath.Join(t.TempDir(), "cache"), OutboundIP: "127.0.0.1"}) require.NoError(t, err) diff --git a/e2e/testdata/workflows/cache.yml b/e2e/testdata/workflows/cache.yml index 163a6e9f..af7cfac0 100644 --- a/e2e/testdata/workflows/cache.yml +++ b/e2e/testdata/workflows/cache.yml @@ -7,7 +7,7 @@ jobs: - run: | mkdir -p cached echo "cached-payload" > cached/data.txt - - uses: actions/cache@v4 + - uses: actions/cache@v6 with: path: cached key: e2e-cache-${{ github.run_id }} @@ -15,7 +15,7 @@ jobs: needs: save runs-on: e2e-cache steps: - - uses: actions/cache@v4 + - uses: actions/cache@v6 id: restore with: path: cached diff --git a/e2e/testdata/workflows/kubernetes.yml b/e2e/testdata/workflows/kubernetes.yml index 5b8a3012..f4ddef5d 100644 --- a/e2e/testdata/workflows/kubernetes.yml +++ b/e2e/testdata/workflows/kubernetes.yml @@ -10,7 +10,7 @@ jobs: NGINX_ENTRYPOINT_QUIET_LOGS: 1 options: --health-cmd "wget -q -O /dev/null http://localhost/" --health-interval 1s steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - run: | test -f .gitea/workflows/kubernetes.yml echo "FROM_ENV=exported" >> "$GITHUB_ENV" diff --git a/e2e/testdata/workflows/payloads.yml b/e2e/testdata/workflows/payloads.yml index 942eace5..b4c53a0f 100644 --- a/e2e/testdata/workflows/payloads.yml +++ b/e2e/testdata/workflows/payloads.yml @@ -33,7 +33,7 @@ jobs: - id: emit run: echo "token=produced-value-42" >> "$GITHUB_OUTPUT" - run: echo "artifact content" > payload.txt - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: payload path: payload.txt @@ -41,7 +41,7 @@ jobs: needs: produce runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: name: payload - run: grep -q 'artifact content' payload.txt diff --git a/examples/kubernetes/dind-docker.yaml b/examples/kubernetes/dind-docker.yaml index 75e02a43..9359af27 100644 --- a/examples/kubernetes/dind-docker.yaml +++ b/examples/kubernetes/dind-docker.yaml @@ -68,7 +68,7 @@ spec: claimName: docker-vol initContainers: - name: docker - image: docker:28.2.2-dind + image: docker:29.9.1-dind securityContext: privileged: true volumeMounts: diff --git a/examples/kubernetes/statefulset-dind.yaml b/examples/kubernetes/statefulset-dind.yaml index 2d3c6cfa..94c9cae7 100644 --- a/examples/kubernetes/statefulset-dind.yaml +++ b/examples/kubernetes/statefulset-dind.yaml @@ -39,7 +39,7 @@ spec: emptyDir: {} initContainers: - name: docker - image: docker:28.2.2-dind + image: docker:29.9.1-dind securityContext: privileged: true volumeMounts: