From d2161f49ae46390c644e7640a6130d0387c8d4ab Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:52:46 +0000 Subject: [PATCH] fix: bump default actions/runner to 2.337.0 --- README.md | 4 ++-- action.yml | 2 +- dist/index.js | 5 ++++- src/config.js | 2 +- src/runner-checksums.js | 3 +++ tests/config.test.js | 4 ++-- 6 files changed, 13 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index b9127492..3821c8f9 100644 --- a/README.md +++ b/README.md @@ -325,7 +325,7 @@ Now you're ready to go! | `iam-role-name` | Optional. Used only with the `start` mode. | IAM role name to attach to the created EC2 runner.

This allows the runner to have permissions to run additional actions within the AWS account, without having to manage additional GitHub secrets and AWS users.

Setting this requires additional AWS permissions for the role launching the instance (see above). | | `aws-resource-tags` | Optional. Used only with the `start` mode. | Specifies tags to add to the EC2 instance and any attached storage.

This field is a stringified JSON array of tag objects, each containing a `Key` and `Value` field (see example below).

Setting this requires additional AWS permissions for the role launching the instance (see above). | | `eip-allocation-id` | Optional. Used only with the `start` mode. | Allocation Id of an Elastic IP to associate with the runner instance once it is running. | -| `runner-version` | Optional. Used only with the `start` mode. | Version of the `actions/runner` binary to download and register (default `2.336.0`).

Must have a matching entry in `src/runner-checksums.js`; the action verifies the downloaded tarball's SHA-256 against that table before extraction. | +| `runner-version` | Optional. Used only with the `start` mode. | Version of the `actions/runner` binary to download and register (default `2.337.0`).

Must have a matching entry in `src/runner-checksums.js`; the action verifies the downloaded tarball's SHA-256 against that table before extraction. | | `architecture` | Optional. Used only with the `start` mode. | Runner CPU architecture: `x64` (default) or `arm64` (Graviton). Must match the AMI (validated at start). All types in an `ec2-instance-type` fallback list must share this arch. See [Running on Graviton (arm64)](#running-on-graviton-arm64). | | `pre-runner-script` | Optional. Used only with the `start` mode. | Shell snippet run as root by the built-in bootstrap **before** runner config (install docker, mount caches, add certs). Fail-fast, tagged `failed:pre-runner-script`. Mutually exclusive with `user-data-template`. See [Custom bootstrap](#custom-bootstrap-pre-runner-script--user-data-template). | | `user-data-template` | Optional. Used only with the `start` mode. | Full bootstrap override — a repo-relative file path or inline string with `{{PLACEHOLDERS}}`. Replaces the built-in bootstrap (unsupported by design). Mutually exclusive with `pre-runner-script`. See [Custom bootstrap](#custom-bootstrap-pre-runner-script--user-data-template). | @@ -708,7 +708,7 @@ By default (`cleanup-on-start-failure: true`), the instance is **terminated** af The default `actions/runner` version is pinned (with SHA-256 checksums in `src/runner-checksums.js`) and bumped automatically: - **Automatic:** a weekly workflow (`.github/workflows/bump-runner.yml`) checks for a newer `actions/runner` release and, if found, opens a PR that updates the checksum table, `action.yml`, config, docs, and the rebuilt `dist/`. There is **no auto-merge** — review the PR (the body links the release notes and cites the checksum source) and merge it. -- **Manual / hotfix:** run `node scripts/bump-runner.js ` (e.g. `node scripts/bump-runner.js 2.336.0`). It fetches the release checksums, updates every file, and rebuilds `dist/` (running `npm ci` before `npm run package` for you). Commit and open a PR. +- **Manual / hotfix:** run `node scripts/bump-runner.js ` (e.g. `node scripts/bump-runner.js 2.337.0`). It fetches the release checksums, updates every file, and rebuilds `dist/` (running `npm ci` before `npm run package` for you). Commit and open a PR. ## Self-hosted runner security with public repositories diff --git a/action.yml b/action.yml index 5060c592..5e8f9c57 100644 --- a/action.yml +++ b/action.yml @@ -140,7 +140,7 @@ inputs: tarball's SHA-256 against that table before extraction). To override, add the corresponding hash to the table in a PR. required: false - default: '2.336.0' + default: '2.337.0' architecture: description: >- Used only with the 'start' mode. CPU architecture of the runner: diff --git a/dist/index.js b/dist/index.js index 66dada76..38091dd0 100644 --- a/dist/index.js +++ b/dist/index.js @@ -106246,7 +106246,7 @@ class Config { reuseMaxCycles: core.getInput('reuse-max-cycles') || '20', reaperStoppedMaxAge: core.getInput('reaper-stopped-max-age') || '1440', iamRoleName: core.getInput('iam-role-name'), - runnerVersion: core.getInput('runner-version') || '2.336.0', + runnerVersion: core.getInput('runner-version') || '2.337.0', architecture: core.getInput('architecture') || 'x64', httpTokens: core.getInput('http-tokens') || 'required', encryptEbs: core.getInput('encrypt-ebs') || 'false', @@ -106724,10 +106724,13 @@ module.exports = { // this table and upstream is caught at code-review time, not at runtime. // // Sources: +// https://github.com/actions/runner/releases/tag/v2.337.0 // https://github.com/actions/runner/releases/tag/v2.336.0 // https://github.com/actions/runner/releases/tag/v2.335.1 const CHECKSUMS = { + 'x64-2.337.0': '70920811a4f8ad4328818682bca5c6469c1c942fab52448868071d0063816613', + 'arm64-2.337.0': '9b1dc70626422526e3c94767cf024896beb15da5342a3f4819bf2feac13e0393', 'x64-2.336.0': '04cf0be1aff4c3ec3554466c39124ca250e3effd8873bb7e8d68535aa9505d5d', 'arm64-2.336.0': '58b758e420b87093fbd4bfddd368074960053e2f1388f01848c82624b90f27d1', // v2.335.1 — pinned default as of 2026-06-17. Bumped from 2.333.1, which diff --git a/src/config.js b/src/config.js index 5cf411fc..0d19a347 100644 --- a/src/config.js +++ b/src/config.js @@ -29,7 +29,7 @@ class Config { reuseMaxCycles: core.getInput('reuse-max-cycles') || '20', reaperStoppedMaxAge: core.getInput('reaper-stopped-max-age') || '1440', iamRoleName: core.getInput('iam-role-name'), - runnerVersion: core.getInput('runner-version') || '2.336.0', + runnerVersion: core.getInput('runner-version') || '2.337.0', architecture: core.getInput('architecture') || 'x64', httpTokens: core.getInput('http-tokens') || 'required', encryptEbs: core.getInput('encrypt-ebs') || 'false', diff --git a/src/runner-checksums.js b/src/runner-checksums.js index cff56292..d6198d42 100644 --- a/src/runner-checksums.js +++ b/src/runner-checksums.js @@ -21,10 +21,13 @@ // this table and upstream is caught at code-review time, not at runtime. // // Sources: +// https://github.com/actions/runner/releases/tag/v2.337.0 // https://github.com/actions/runner/releases/tag/v2.336.0 // https://github.com/actions/runner/releases/tag/v2.335.1 const CHECKSUMS = { + 'x64-2.337.0': '70920811a4f8ad4328818682bca5c6469c1c942fab52448868071d0063816613', + 'arm64-2.337.0': '9b1dc70626422526e3c94767cf024896beb15da5342a3f4819bf2feac13e0393', 'x64-2.336.0': '04cf0be1aff4c3ec3554466c39124ca250e3effd8873bb7e8d68535aa9505d5d', 'arm64-2.336.0': '58b758e420b87093fbd4bfddd368074960053e2f1388f01848c82624b90f27d1', // v2.335.1 — pinned default as of 2026-06-17. Bumped from 2.333.1, which diff --git a/tests/config.test.js b/tests/config.test.js index c2afd225..ff850a43 100644 --- a/tests/config.test.js +++ b/tests/config.test.js @@ -359,9 +359,9 @@ describe('Config — max-lifetime-minutes input', () => { }); describe('Config — runner-version input', () => { - test('defaults to 2.336.0 when unset', () => { + test('defaults to 2.337.0 when unset', () => { const config = loadConfig(startModeInputs); - expect(config.input.runnerVersion).toBe('2.336.0'); + expect(config.input.runnerVersion).toBe('2.337.0'); }); test('honors an explicit override', () => {