ci: gate runner-image digest automerge on a real smoke test, drop unresolvable soak - #50
Merged
Merged
Conversation
…esolvable soak Upstream rebuilds myoung34/github-runner:latest more often than the org default's 2-day digest soak, so minimumReleaseAge never resolves — Renovate re-targets the newer digest each run and resets the clock, and the bump never automerges. A soak is meaningless for a continuously-rebuilt rolling tag: there is no discrete release to age. Replace it with a gate that's actually meaningful for a digest rebuild: - ci.yml gains runner-image-smoke, which pulls the pinned image and runs Runner.Listener --version, asserting a semver result. This catches a broken or GitHub-deprecated runner binary that `docker compose config` (YAML-only) never would. Uses Runner.Listener because config.sh refuses to run as root. - renovate.json drops the inherited soak for myoung34 digests (minimumReleaseAge:0) and adds a weekly schedule to rate-limit adoption to one digest/week; the runner self-updates its binary at container start, so weekly currency is ample.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Renovate PRs for
myoung34/github-runnerdigest bumps (e.g. #44) never automerge. Upstream rebuilds:latestmore often than the org default's 2-day digest soak (minimumReleaseAge), so the soak never resolves — each Renovate run re-targets the newer digest, resetting the clock. A soak is fundamentally meaningless for a continuously-rebuilt rolling tag: there's no discrete release to age.Worse, the soak was the only real safety net on these automerges — PR CI (
docker compose config) only parses YAML and never pulls the image, so a broken or GitHub-deprecated runner binary would sail through on green.Fix
Replace the unworkable soak with a gate that's actually meaningful for a digest rebuild:
ci.yml— newrunner-image-smokejob pulls the pinned image and runsRunner.Listener --version, asserting a semver result. This directly catches the failure the soak was meant to (broken/deprecated binary landing unattended). Runs concurrently with the other jobs (~1GB pull). UsesRunner.Listenerrather thanconfig.sh --versionbecauseconfig.shrefuses to run as root.renovate.json— drop the inherited soak for myoung34 digests (minimumReleaseAge: "0") and add a weeklyscheduleto rate-limit adoption to one digest/week. The runner self-updates its binary at container start, so weekly currency is ample; the schedule cuts PR churn hard.Validation
Smoke gate run locally against the current pinned digest →
Runner version: 2.335.1, semver assertion passes.Follow-up
After merge, poke #44 (rebase checkbox / close-reopen) so Renovate re-evaluates it against the new rule and runs the smoke gate.