Update gitea/runner Docker tag to v3.3.1 #52

2026-08-27T00:00:58Z

renovate-bot commented

2026-08-27 00:00:58 +00:00

This PR contains the following updates:

Package	Update	Change
gitea/runner	patch	`3.3.0` → `3.3.1`

Release Notes

gitea/runner (gitea/runner)

`v3.3.1`

Compare Source

⚠️ Behavior changes

A workflow's container.options may no longer set --env-file or --label-file, which name files read on the runner, nor carry a volume driver option, which turns a name valid_volumes allows into a bind of any host path. Both still serve the runner's own options (https://gitea.com/gitea/runner/pulls/1151)
A bare --env NAME no longer resolves the value from the runner's own environment, for every source. Use runner.envs or runner.env_file to pass a variable on (https://gitea.com/gitea/runner/pulls/1151)
A job output whose value carries a secret is skipped with a warning instead of sent, matching GitHub, so a downstream needs.<job>.outputs.<name> reading it is empty (https://gitea.com/gitea/runner/pulls/1188)

Bug fixes

Keep the runner's own container.options when privileged mode is off. The host-escape filter dropped the administrator's options along with the workflow's, so a setup needing --device or --security-opt from the config file had no way to get them (https://gitea.com/gitea/runner/pulls/1151)
Mask secrets on every path they leave a job: uploaded log rows, the on-disk job.log, the runner's own log, debug stdout, job summaries, job outputs, and the job name that becomes a container name. ACTIONS_STEP_DEBUG and ACTIONS_RUNNER_DEBUG are never masked, as on GitHub (https://gitea.com/gitea/runner/pulls/1188)
Keep a step's own with: values out of its inputs context, so a colliding with: key or an INPUT_-shaped variable from env: no longer flips if: conditions or forges an input (https://gitea.com/gitea/runner/pulls/1192)
Honor volumes declared on service containers under the configured valid_volumes policy instead of dropping them silently (https://gitea.com/gitea/runner/pulls/1186)
Report step log ranges with the log flush, so rows the server takes between two state reports no longer land under no step or under "Complete job" (https://gitea.com/gitea/runner/pulls/1189)
Fail the run when matrix expansion fails, instead of reporting success without running anything (https://gitea.com/gitea/runner/pulls/1187)

Dependencies

Update the Go toolchain to 1.27.0, including the 1.26.6 security fixes. Building from source now needs Go 1.27 (https://gitea.com/gitea/runner/pulls/1183, https://gitea.com/gitea/runner/pulls/1185)
Update dependencies, docker to 29.7.2 (https://gitea.com/gitea/runner/pulls/1185)

Full changelog: https://gitea.com/gitea/runner/compare/v3.3.0...v3.3.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gitea/runner](https://gitea.com/gitea/runner) | patch | `3.3.0` → `3.3.1` | --- ### Release Notes <details> <summary>gitea/runner (gitea/runner)</summary> ### [`v3.3.1`](https://gitea.com/gitea/runner/releases/tag/v3.3.1) [Compare Source](https://gitea.com/gitea/runner/compare/v3.3.0...v3.3.1) #### ⚠️ Behavior changes - A workflow's `container.options` may no longer set `--env-file` or `--label-file`, which name files read on the runner, nor carry a volume driver option, which turns a name `valid_volumes` allows into a bind of any host path. Both still serve the runner's own options (<https://gitea.com/gitea/runner/pulls/1151>) - A bare `--env NAME` no longer resolves the value from the runner's own environment, for every source. Use `runner.envs` or `runner.env_file` to pass a variable on (<https://gitea.com/gitea/runner/pulls/1151>) - A job output whose value carries a secret is skipped with a warning instead of sent, matching GitHub, so a downstream `needs.<job>.outputs.<name>` reading it is empty (<https://gitea.com/gitea/runner/pulls/1188>) #### Bug fixes - Keep the runner's own `container.options` when privileged mode is off. The host-escape filter dropped the administrator's options along with the workflow's, so a setup needing `--device` or `--security-opt` from the config file had no way to get them (<https://gitea.com/gitea/runner/pulls/1151>) - Mask secrets on every path they leave a job: uploaded log rows, the on-disk `job.log`, the runner's own log, debug stdout, job summaries, job outputs, and the job name that becomes a container name. `ACTIONS_STEP_DEBUG` and `ACTIONS_RUNNER_DEBUG` are never masked, as on GitHub (<https://gitea.com/gitea/runner/pulls/1188>) - Keep a step's own `with:` values out of its `inputs` context, so a colliding `with:` key or an `INPUT_`-shaped variable from `env:` no longer flips `if:` conditions or forges an input (<https://gitea.com/gitea/runner/pulls/1192>) - Honor volumes declared on service containers under the configured `valid_volumes` policy instead of dropping them silently (<https://gitea.com/gitea/runner/pulls/1186>) - Report step log ranges with the log flush, so rows the server takes between two state reports no longer land under no step or under "Complete job" (<https://gitea.com/gitea/runner/pulls/1189>) - Fail the run when matrix expansion fails, instead of reporting success without running anything (<https://gitea.com/gitea/runner/pulls/1187>) #### Dependencies - Update the Go toolchain to 1.27.0, including the 1.26.6 security fixes. Building from source now needs Go 1.27 (<https://gitea.com/gitea/runner/pulls/1183>, <https://gitea.com/gitea/runner/pulls/1185>) - Update dependencies, docker to 29.7.2 (<https://gitea.com/gitea/runner/pulls/1185>) **Full changelog**: <https://gitea.com/gitea/runner/compare/v3.3.0...v3.3.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit 2026-08-27 00:00:58 +00:00

Update gitea/runner Docker tag to v3.3.1 3d1ad5fc02

Akumatic merged commit 151f563fa7 into main

2026-08-27 09:11:58 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Homelab/Docker-Gitea#52