Skip to content

Bump hook to 0.8.1 #4222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nikola-jokic wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump hook to 0.8.1 #4222

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion images/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-c
&& unzip ./runner-container-hooks.zip -d ./k8s \
&& rm runner-container-hooks.zip

RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v0.8.0/actions-runner-hooks-k8s-0.8.0.zip \
RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v0.8.1/actions-runner-hooks-k8s-0.8.1.zip \
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This creates an inconsistency in runner-container-hooks versions. The k8s directory (line 20) uses RUNNER_CONTAINER_HOOKS_VERSION which is set to 0.7.0, while k8s-novolume now uses 0.8.1. Consider either:

  1. Updating RUNNER_CONTAINER_HOOKS_VERSION to 0.8.1 and using it for both installations
  2. Creating a separate ARG for the k8s-novolume version if the different versions are intentional
  3. Documenting why different versions are needed if this is by design

Having different versions without clear justification makes maintenance harder and could lead to unexpected behavior differences.

Copilot uses AI. Check for mistakes.
Copy link
Member

@TingluoHuang TingluoHuang Feb 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nikola-jokic can you check this comment?

i noticed we download the hooks twice into different dir.

Should they use the same version, and just copied to different folder?

Copy link
Contributor Author

@nikola-jokic nikola-jokic Feb 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is intentional. The hook 0.8.x release is less stable than 0.7.0, not relying on volumes. That is why we kept the 0.7.0 while allowing kubernetes-novolume mode to use 0.8.1 version of the hook

Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This curl + unzip pattern downloads runner-container-hooks.zip from a GitHub Releases tag and immediately extracts it without any checksum or signature verification, creating a supply-chain risk if the actions/runner-container-hooks release or tag is ever compromised. An attacker who can tamper with that release asset (or the tag it’s built from) could deliver malicious hooks that get baked into every built runner image. To mitigate this, pin the download to an immutable identifier (e.g., a commit SHA or exact asset hash) and verify the archive’s integrity (checksum or signature) before unzipping.

Copilot uses AI. Check for mistakes.
&& unzip ./runner-container-hooks.zip -d ./k8s-novolume \
&& rm runner-container-hooks.zip

Expand Down
Loading