The runner now downloads actions and reusable workflows with Git, so it needs git on its PATH. builtin:checkout now runs Git inside the job. Job images need Git as well, and the job must be able to reach Gitea and trust its certificate. The official runner images include Git.
It now supports SSH keys, LFS, submodules, sparse checkout and partial clones. It also accepts the fetch-tags, clean, show-progress and set-safe-directory inputs, and sets the ref and commit outputs. Branches are checked out as local branches tracking origin, and later steps can fetch and push with the persisted token or SSH key.
Two changes can break existing workflows. It removes untracked and ignored files from the checkout directory unless clean: false is set. It also fails when the triggering tag was moved after the workflow started.
A config value containing ${NAME} now reads that variable from the runner's environment, and the config fails to load when it is unset. Write $${NAME} to keep a literal ${NAME}, for example in a shell command inside a Kubernetes pod_template.
A workflow with a job that has no runs-on, or an empty one, now fails instead of running that job in runner.default_image. This matches GitHub. Jobs that call a reusable workflow are exempt.
OTLP metric names, units, types and attributes change, see the metrics docs. On /metrics, gitea_runner_client_errors_total has a new code label, and gitea_runner_job_total counts jobs stopped by runner.timeout as timeout.
Unless container.privileged is set, the runner drops --log-driver, --log-opt, --oom-score-adj and --oom-kill-disable from a workflow's container options and logs a warning.
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [gitea/runner](https://gitea.com/gitea/runner) | major | `4.1.0` → `5.0.0` |
---
### Release Notes
<details>
<summary>gitea/runner</summary>
### [`v5.0.0`](https://gitea.com/gitea/runner/releases/tag/v5.0.0)
[Compare Source](https://gitea.com/gitea/runner/compare/v4.1.0...v5.0.0)
#### ⚠️ Breaking changes
##### Git 2.34.1 or newer is required (<https://gitea.com/gitea/runner/pulls/1277>)
The runner now downloads actions and reusable workflows with Git, so it needs `git` on its `PATH`. `builtin:checkout` now runs Git inside the job. Job images need Git as well, and the job must be able to reach Gitea and trust its certificate. The official runner images include Git.
##### `builtin:checkout` works like `actions/checkout` (<https://gitea.com/gitea/runner/pulls/1277>)
It now supports SSH keys, LFS, submodules, sparse checkout and partial clones. It also accepts the `fetch-tags`, `clean`, `show-progress` and `set-safe-directory` inputs, and sets the `ref` and `commit` outputs. Branches are checked out as local branches tracking `origin`, and later steps can fetch and push with the persisted token or SSH key.
Two changes can break existing workflows. It removes untracked and ignored files from the checkout directory unless `clean: false` is set. It also fails when the triggering tag was moved after the workflow started.
##### Config values expand `${NAME}` (<https://gitea.com/gitea/runner/pulls/1274>)
A config value containing `${NAME}` now reads that variable from the runner's environment, and the config fails to load when it is unset. Write `$${NAME}` to keep a literal `${NAME}`, for example in a shell command inside a Kubernetes `pod_template`.
##### Jobs require `runs-on` (<https://gitea.com/gitea/runner/pulls/1271>)
A workflow with a job that has no `runs-on`, or an empty one, now fails instead of running that job in `runner.default_image`. This matches GitHub. Jobs that call a reusable workflow are exempt.
##### Metrics follow the OpenTelemetry semantic conventions (<https://gitea.com/gitea/runner/pulls/1282>)
OTLP metric names, units, types and attributes change, see the [metrics docs](https://gitea.com/gitea/runner/src/branch/main/docs/telemetry.md#metrics). On `/metrics`, `gitea_runner_client_errors_total` has a new `code` label, and `gitea_runner_job_total` counts jobs stopped by `runner.timeout` as `timeout`.
##### Unprivileged runners ignore workflow log and OOM options (<https://gitea.com/gitea/runner/pulls/1283>)
Unless `container.privileged` is set, the runner drops `--log-driver`, `--log-opt`, `--oom-score-adj` and `--oom-kill-disable` from a workflow's container `options` and logs a warning.
#### Features
- Support mutual TLS to Gitea with `runner.client_cert_file` and `runner.client_key_file` (<https://gitea.com/gitea/runner/pulls/1273>)
- Support SHA-256 repositories for actions, reusable workflows and `builtin:checkout` (<https://gitea.com/gitea/runner/pulls/1277>)
- Support `${NAME}` environment variables in config values (<https://gitea.com/gitea/runner/pulls/1274>)
- Support `:ro` entries in `valid_volumes`, which allow only read-only mounts (<https://gitea.com/gitea/runner/pulls/1272>)
- Added `runner.extra_headers` for headers that a reverse proxy in front of Gitea requires (<https://gitea.com/gitea/runner/pulls/1269>)
- Added `container.sweep: false` to keep services that jobs deploy to the runner's Docker daemon (<https://gitea.com/gitea/runner/pulls/1275>)
- Added `gitea_runner_state` metric, which reports whether the runner is busy, idle or unavailable (<https://gitea.com/gitea/runner/pulls/1282>)
#### Bug fixes
- Fix ephemeral runners failing on every restart with recent Gitea versions (<https://gitea.com/gitea/runner/pulls/1287>)
- Fix actions not reaching Kubernetes job pods on Ubuntu-based images (<https://gitea.com/gitea/runner/pulls/1286>)
- Match matrix `include` and `exclude` entries regardless of case, like GitHub (<https://gitea.com/gitea/runner/pulls/1278>)
- Apply `runner.insecure` to reusable workflow downloads and job summary uploads (<https://gitea.com/gitea/runner/pulls/1273>)
- Apply the Docker daemon's `mtu` to job networks (<https://gitea.com/gitea/runner/pulls/1270>)
**Full changelog**: <https://gitea.com/gitea/runner/compare/v4.1.0...v5.0.0>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDcuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE0Ny4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
4.1.0→5.0.0Release Notes
gitea/runner
v5.0.0Compare Source
⚠️ Breaking changes
Git 2.34.1 or newer is required (https://gitea.com/gitea/runner/pulls/1277)
The runner now downloads actions and reusable workflows with Git, so it needs
giton itsPATH.builtin:checkoutnow runs Git inside the job. Job images need Git as well, and the job must be able to reach Gitea and trust its certificate. The official runner images include Git.builtin:checkoutworks likeactions/checkout(https://gitea.com/gitea/runner/pulls/1277)It now supports SSH keys, LFS, submodules, sparse checkout and partial clones. It also accepts the
fetch-tags,clean,show-progressandset-safe-directoryinputs, and sets therefandcommitoutputs. Branches are checked out as local branches trackingorigin, and later steps can fetch and push with the persisted token or SSH key.Two changes can break existing workflows. It removes untracked and ignored files from the checkout directory unless
clean: falseis set. It also fails when the triggering tag was moved after the workflow started.Config values expand
${NAME}(https://gitea.com/gitea/runner/pulls/1274)A config value containing
${NAME}now reads that variable from the runner's environment, and the config fails to load when it is unset. Write$${NAME}to keep a literal${NAME}, for example in a shell command inside a Kubernetespod_template.Jobs require
runs-on(https://gitea.com/gitea/runner/pulls/1271)A workflow with a job that has no
runs-on, or an empty one, now fails instead of running that job inrunner.default_image. This matches GitHub. Jobs that call a reusable workflow are exempt.Metrics follow the OpenTelemetry semantic conventions (https://gitea.com/gitea/runner/pulls/1282)
OTLP metric names, units, types and attributes change, see the metrics docs. On
/metrics,gitea_runner_client_errors_totalhas a newcodelabel, andgitea_runner_job_totalcounts jobs stopped byrunner.timeoutastimeout.Unprivileged runners ignore workflow log and OOM options (https://gitea.com/gitea/runner/pulls/1283)
Unless
container.privilegedis set, the runner drops--log-driver,--log-opt,--oom-score-adjand--oom-kill-disablefrom a workflow's containeroptionsand logs a warning.Features
runner.client_cert_fileandrunner.client_key_file(https://gitea.com/gitea/runner/pulls/1273)builtin:checkout(https://gitea.com/gitea/runner/pulls/1277)${NAME}environment variables in config values (https://gitea.com/gitea/runner/pulls/1274):roentries invalid_volumes, which allow only read-only mounts (https://gitea.com/gitea/runner/pulls/1272)runner.extra_headersfor headers that a reverse proxy in front of Gitea requires (https://gitea.com/gitea/runner/pulls/1269)container.sweep: falseto keep services that jobs deploy to the runner's Docker daemon (https://gitea.com/gitea/runner/pulls/1275)gitea_runner_statemetric, which reports whether the runner is busy, idle or unavailable (https://gitea.com/gitea/runner/pulls/1282)Bug fixes
includeandexcludeentries regardless of case, like GitHub (https://gitea.com/gitea/runner/pulls/1278)runner.insecureto reusable workflow downloads and job summary uploads (https://gitea.com/gitea/runner/pulls/1273)mtuto job networks (https://gitea.com/gitea/runner/pulls/1270)Full changelog: https://gitea.com/gitea/runner/compare/v4.1.0...v5.0.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.