Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
184 commits
Select commit Hold shift + click to select a range
73805dd
link: actions/runner#...
jsoref Jan 22, 2026
fe556c5
link: joelparkerhenderson/architecture-decision-record
jsoref Jan 22, 2026
d492893
link: dotnet load SSL CA certificates on each OS
jsoref Jan 22, 2026
4e982fe
link: automate your use of self-hosted runners
jsoref Jan 22, 2026
5a71503
spelling: a string to the method
jsoref Jan 22, 2026
30a2c48
spelling: a
jsoref Jan 22, 2026
7fb0576
spelling: accidentally
jsoref Jan 22, 2026
aeb7bba
spelling: account
jsoref Jan 22, 2026
326880d
spelling: act
jsoref Jan 22, 2026
76de1cf
spelling: administrator
jsoref Jan 22, 2026
b93102d
spelling: all
jsoref Jan 22, 2026
99f0ced
spelling: already
jsoref Jan 22, 2026
7fb7572
spelling: always
jsoref Jan 22, 2026
18d9938
spelling: an
jsoref Jan 22, 2026
45e995d
spelling: anchors
jsoref Jan 22, 2026
8432403
spelling: arg-string
jsoref Jan 23, 2026
200d766
spelling: available
jsoref Jan 23, 2026
eb43841
spelling: be
jsoref Jan 22, 2026
3e07c46
spelling: believe
jsoref Jan 23, 2026
3e46386
spelling: belonging
jsoref Jan 23, 2026
19e3c62
spelling: boundary
jsoref Jan 23, 2026
c474081
spelling: buffered
jsoref Jan 23, 2026
f155cdd
spelling: by design the data scheme is excluded from this list and th…
jsoref Jan 22, 2026
222709e
spelling: cache
jsoref Jan 23, 2026
d7bb563
spelling: call
jsoref Jan 23, 2026
a9e180d
spelling: cancel
jsoref Jan 23, 2026
5909d23
spelling: cancellation
jsoref Jan 23, 2026
8d61899
spelling: cannot
jsoref Jan 22, 2026
cb035fb
spelling: case-insensitive
jsoref Jan 22, 2026
e6004f4
spelling: case-sensitive
jsoref Jan 22, 2026
3eb6edd
spelling: coalesce
jsoref Jan 23, 2026
1e03d0a
spelling: coming
jsoref Jan 23, 2026
4638278
spelling: comparer
jsoref Jan 23, 2026
e60c1a0
spelling: comparison
jsoref Jan 23, 2026
1f95215
spelling: compatible
jsoref Jan 23, 2026
a48ed5c
spelling: configuration
jsoref Jan 23, 2026
fd60400
spelling: constructing
jsoref Jan 23, 2026
6a4b193
spelling: constructor
jsoref Jan 23, 2026
8ecc2c7
spelling: containing
jsoref Jan 23, 2026
671325f
spelling: context
jsoref Jan 23, 2026
6c18d7f
spelling: convention
jsoref Jan 23, 2026
8448ae6
spelling: converter
jsoref Jan 23, 2026
77c8210
spelling: credential
jsoref Jan 23, 2026
98b053d
spelling: deconfigure
jsoref Jan 22, 2026
dcfa472
spelling: deconfigures
jsoref Jan 23, 2026
c9d9190
spelling: deconfiguring
jsoref Jan 23, 2026
0b623ce
spelling: default
jsoref Jan 23, 2026
7acdae0
spelling: definition
jsoref Jan 23, 2026
bec33c8
spelling: dependencies
jsoref Jan 23, 2026
874f5ae
spelling: dependent
jsoref Jan 23, 2026
5aaee8d
spelling: dependents
jsoref Jan 23, 2026
e3172af
spelling: deserialization
jsoref Jan 23, 2026
3ddaa04
spelling: determine the result of the runner update based on the log …
jsoref Jan 23, 2026
fff8d39
spelling: determined
jsoref Jan 23, 2026
2552f49
spelling: determines
jsoref Jan 23, 2026
cffab9a
spelling: diagnostic
jsoref Jan 23, 2026
02a8160
spelling: directory
jsoref Jan 23, 2026
2910e16
spelling: distinguish
jsoref Jan 23, 2026
4b7ff27
spelling: distributions
jsoref Jan 23, 2026
53e21fb
spelling: does not exist
jsoref Jan 22, 2026
1dd86a7
spelling: empty
jsoref Jan 23, 2026
6599809
spelling: end
jsoref Jan 22, 2026
20101d2
spelling: ends
jsoref Jan 22, 2026
7276179
spelling: enumerable
jsoref Jan 23, 2026
3ee439f
spelling: env
jsoref Jan 23, 2026
da90178
spelling: equal
jsoref Jan 22, 2026
9aabb9d
spelling: equals
jsoref Jan 22, 2026
70e9fc2
spelling: equivalent
jsoref Jan 23, 2026
2dae19c
spelling: errors
jsoref Jan 23, 2026
36e79ba
spelling: etc.
jsoref Jan 23, 2026
d10e0b2
spelling: evaluate
jsoref Jan 23, 2026
2d7642e
spelling: evaluation
jsoref Jan 23, 2026
edba29a
spelling: exception
jsoref Jan 23, 2026
29f1414
spelling: exchanges
jsoref Jan 23, 2026
56928d9
spelling: explicitly
jsoref Jan 23, 2026
de0e7e2
spelling: expression
jsoref Jan 23, 2026
24e5760
spelling: failure
jsoref Jan 23, 2026
2e5f227
spelling: fall back
jsoref Jan 22, 2026
ecb1afe
spelling: full
jsoref Jan 23, 2026
1ddef17
spelling: function
jsoref Jan 23, 2026
2c51602
spelling: further
jsoref Jan 23, 2026
a7b49da
spelling: guarantee
jsoref Jan 23, 2026
1fa152d
spelling: hierarchically
jsoref Jan 23, 2026
9ac8393
spelling: how
jsoref Jan 22, 2026
d17f094
spelling: identifier
jsoref Jan 23, 2026
28e980d
spelling: identities
jsoref Jan 23, 2026
40fffce
spelling: image
jsoref Jan 23, 2026
191efa8
spelling: implicitly
jsoref Jan 23, 2026
facae10
spelling: in order
jsoref Jan 23, 2026
9007925
spelling: individual
jsoref Jan 23, 2026
0a2cc83
spelling: inherited
jsoref Jan 23, 2026
17d76e6
spelling: initialization
jsoref Jan 23, 2026
f7ff692
spelling: input
jsoref Jan 23, 2026
b00d7c1
spelling: insecure
jsoref Jan 22, 2026
994d0ba
spelling: insensitive
jsoref Jan 23, 2026
e638f91
spelling: internals visible to
jsoref Jan 23, 2026
afc8634
spelling: interrupt
jsoref Jan 23, 2026
3b6e50b
spelling: javascript
jsoref Jan 22, 2026
2aa1b4f
spelling: job request
jsoref Jan 23, 2026
af32255
spelling: junction
jsoref Jan 23, 2026
e7e6ea2
spelling: locked until
jsoref Jan 23, 2026
0457fde
spelling: lowercase
jsoref Jan 22, 2026
68621d9
spelling: lt
jsoref Jan 23, 2026
636bbb6
spelling: macos
jsoref Jan 25, 2026
95b4854
spelling: media type
jsoref Jan 23, 2026
44d5621
spelling: message
jsoref Jan 23, 2026
59767e7
spelling: navigable
jsoref Jan 23, 2026
ba94991
spelling: necessarily
jsoref Jan 23, 2026
b193391
spelling: necessary
jsoref Jan 23, 2026
7ac3e30
spelling: neither-nor
jsoref Jan 22, 2026
345d915
spelling: nonexistent
jsoref Jan 23, 2026
451e912
spelling: not
jsoref Jan 22, 2026
a467adb
spelling: null check
jsoref Jan 25, 2026
219977c
spelling: oauth
jsoref Jan 23, 2026
55a9f03
spelling: occurred
jsoref Jan 23, 2026
b2da26d
spelling: one
jsoref Jan 22, 2026
64f8468
spelling: optimize
jsoref Jan 22, 2026
332ea5d
spelling: optionally
jsoref Jan 23, 2026
c2b353b
spelling: otherwise
jsoref Jan 23, 2026
d40a994
spelling: out-of-date
jsoref Jan 22, 2026
0a235de
spelling: overridden
jsoref Jan 23, 2026
f05682b
spelling: parameter
jsoref Jan 23, 2026
548c05e
spelling: parameters
jsoref Jan 23, 2026
1913840
spelling: permission
jsoref Jan 23, 2026
ae6fcfa
spelling: platform
jsoref Jan 23, 2026
3e24e08
spelling: position
jsoref Jan 23, 2026
1bb2644
spelling: post job
jsoref Jan 23, 2026
47ff698
spelling: prompt
jsoref Jan 23, 2026
7b9bf74
spelling: property
jsoref Jan 23, 2026
647be07
spelling: quarter
jsoref Jan 23, 2026
20216ae
spelling: questions
jsoref Jan 23, 2026
0c3b4a5
spelling: range of
jsoref Jan 22, 2026
fff16c0
spelling: received
jsoref Jan 23, 2026
32bb577
spelling: red hat
jsoref Jan 22, 2026
a118994
spelling: represents
jsoref Jan 23, 2026
1ce8823
spelling: requests
jsoref Jan 23, 2026
13d716c
spelling: resiliency
jsoref Jan 23, 2026
e3c7823
spelling: retrieve
jsoref Jan 23, 2026
c536644
spelling: retrieving
jsoref Jan 23, 2026
2dc7320
spelling: retryable
jsoref Jan 25, 2026
5ddd053
spelling: reusable
jsoref Jan 23, 2026
8223221
spelling: rules
jsoref Jan 25, 2026
c32c2f8
spelling: satisfied
jsoref Jan 23, 2026
f05a655
spelling: separate
jsoref Jan 23, 2026
6f8211b
spelling: separated
jsoref Jan 23, 2026
ee97ce5
spelling: separator
jsoref Jan 23, 2026
424bc0c
spelling: serialize
jsoref Jan 23, 2026
bb6110d
spelling: service
jsoref Jan 23, 2026
d8db233
spelling: set up
jsoref Jan 22, 2026
15c9d18
spelling: similar
jsoref Jan 23, 2026
2b7546b
spelling: simply
jsoref Jan 23, 2026
544d341
spelling: something
jsoref Jan 23, 2026
7a4dcf6
spelling: specific
jsoref Jan 23, 2026
b55c83d
spelling: step host
jsoref Jan 23, 2026
2d2e717
spelling: successfully
jsoref Jan 23, 2026
de7804e
spelling: supported
jsoref Jan 23, 2026
800a974
spelling: surrogate
jsoref Jan 23, 2026
d841c6e
spelling: synchronization
jsoref Jan 23, 2026
b6d5159
spelling: than
jsoref Jan 22, 2026
2faa01f
spelling: the type of the field to which the path maps
jsoref Jan 22, 2026
5de7338
spelling: the
jsoref Jan 22, 2026
236ed86
spelling: then
jsoref Jan 22, 2026
e2363a6
spelling: timeout
jsoref Jan 23, 2026
2af7ed2
spelling: to
jsoref Jan 22, 2026
6788489
spelling: todo
jsoref Jan 23, 2026
8d5cdc2
spelling: two
jsoref Jan 22, 2026
b104b56
spelling: typescript
jsoref Jan 22, 2026
2f2ea22
spelling: unattended
jsoref Jan 23, 2026
3975520
spelling: unmodified
jsoref Jan 22, 2026
5e0fb1b
spelling: unnecessarily
jsoref Jan 23, 2026
9cb5d83
spelling: unnecessary
jsoref Jan 22, 2026
5c6474c
spelling: unsanitized
jsoref Jan 23, 2026
93907d9
spelling: until locked-until
jsoref Jan 25, 2026
d975353
spelling: unzip
jsoref Jan 22, 2026
cc97d39
spelling: update
jsoref Jan 23, 2026
873974e
spelling: value
jsoref Jan 23, 2026
1d3edb2
spelling: variables
jsoref Jan 23, 2026
9cb58cc
spelling: warnings
jsoref Jan 23, 2026
ccea13f
spelling: well-formed absolute
jsoref Jan 22, 2026
6f1ece1
spelling: when
jsoref Jan 22, 2026
e95c0e9
spelling: whether or not
jsoref Jan 22, 2026
c882b05
spelling: with the
jsoref Jan 23, 2026
bc20dd6
spelling: workflow
jsoref Jan 23, 2026
cc00ae3
spelling: written
jsoref Jan 23, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/adrs/0276-problem-matchers.md
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ Coalesce empty with \"error\". For any other values, omit logging an issue and d

#### Default severity level

Problem matchers are unable to interpret severity strings other than `warning` and `error`. The `severity` match group expects `warning` or `error` (case insensitive).
Problem matchers are unable to interpret severity strings other than `warning` and `error`. The `severity` match group expects `warning` or `error` (case-insensitive).

However some tools indicate error/warning in different ways. For example `flake8` uses codes like `E100`, `W200`, and `F300` (error, warning, fatal, respectively).

Expand Down
2 changes: 1 addition & 1 deletion docs/adrs/0279-hashFiles-expression-function.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
**Status**: Accepted

## Context
First party action `actions/cache` needs a input which is an explicit `key` used for restoring and saving the cache. For packages caching, the most common `key` might be the hash result of contents from all `package-lock.json` under `node_modules` folder.
First party action `actions/cache` needs an input which is an explicit `key` used for restoring and saving the cache. For packages caching, the most common `key` might be the hash result of contents from all `package-lock.json` under `node_modules` folder.

There are serval different ways to get the hash `key` input for `actions/cache` action.

Expand Down
2 changes: 1 addition & 1 deletion docs/adrs/0297-base64-masking-trailing-characters.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,6 @@ This will result in us only revealing length or bit information when a prefix or

## Consequences

- In the case where a secret has a prefix or suffix added before base64 encoding, we may now reveal up to 20 bits of information and the length of the original string modulo 3, rather then the original 16 bits and no length information
- In the case where a secret has a prefix or suffix added before base64 encoding, we may now reveal up to 20 bits of information and the length of the original string modulo 3, rather than the original 16 bits and no length information
- Secrets with a suffix appended before encoding will now be masked across the board. Previously it was only masked if it was a multiple of 3 characters
- Performance will suffer in a negligible way
2 changes: 1 addition & 1 deletion docs/adrs/0549-composite-run-steps.md
Original file line number Diff line number Diff line change
Expand Up @@ -314,7 +314,7 @@ runs:

**We will not support "timeout-minutes" in a composite action for now. This functionality will be focused on in a future ADR.**

A composite action in its entirety is a job. You can set both timeout-minutes for the whole composite action or its steps as long as the sum of the `timeout-minutes` for each composite action step that has the attribute `timeout-minutes` is less than or equals to `timeout-minutes` for the composite action. There is no default timeout-minutes for each composite action step.
A composite action in its entirety is a job. You can set both timeout-minutes for the whole composite action or its steps as long as the sum of the `timeout-minutes` for each composite action step that has the attribute `timeout-minutes` is less than or equal to `timeout-minutes` for the composite action. There is no default timeout-minutes for each composite action step.

If the time taken for any of the steps in combination or individually exceeds the whole composite action `timeout-minutes` attribute, the whole job will fail (1). If an individual step exceeds its own `timeout-minutes` attribute but the total time that has been used including this step is below the overall composite action `timeout-minutes`, the individual step will fail but the rest of the steps will run based on their own `timeout-minutes` attribute (they will still abide by condition (1) though).

Expand Down
4 changes: 2 additions & 2 deletions docs/adrs/1144-composite-actions.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ We released [composite run steps](https://github.com/actions/runner/pull/554) la

We want to support the `uses` steps from workflows in composite actions, including:
- Container actions
- Javascript actions
- JavaScript actions
- Other Composite actions (up to a limit of course!)
- The pre and post steps these actions can generate

Expand Down Expand Up @@ -80,7 +80,7 @@ We want to support the `uses` steps from workflows in composite actions, includi

### Defaults - Not being considered at this time

- In actions, we have the idea of [defaults](https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#defaultsrun) , which allow you to specify a shell and working directory in one location, rather then on each step.
- In actions, we have the idea of [defaults](https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#defaultsrun) , which allow you to specify a shell and working directory in one location, rather than on each step.
- However, `shell` is currently required in composite run steps
- In regular run steps, it is optional, and defaults to a different value based on the OS.
- We want to prioritize the right experience for the consumer, and make the action author continue to explicitly set these values. We can consider improving this experience in the future.
Expand Down
6 changes: 3 additions & 3 deletions docs/adrs/1438-conditional-composite.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ However, one of the [most requested features](https://github.com/actions/runner/
### Goals
- We want to keep consistent with current behavior
- We want to support conditionals via the `if` keyword
- Our built in functions like `success` should be implementable without calling them, for example you can do `job.status == success` rather then `success()` currently.
- Our built in functions like `success` should be implementable without calling them, for example you can do `job.status == success` rather than `success()` currently.

### How does composite currently work?

Expand All @@ -32,7 +32,7 @@ Lets formalize that concept into a "real" idea.

- We will add an `action_status` field to the github context to mimic the [job's context status](https://docs.github.com/en/actions/learn-github-actions/contexts#job-context).
- We have an existing concept that does this `action_path` which is only set for composite actions on the github context.
- In a composite action during a main step, the `success()` function will check if `action_status == success`, rather then `job_status == success`. Failure will work the same way.
- In a composite action during a main step, the `success()` function will check if `action_status == success`, rather than `job_status == success`. Failure will work the same way.
- Pre and post steps in composite actions will not change, they will continue to check the job status.


Expand All @@ -57,7 +57,7 @@ For example, lets imagine a scenario with a simple nested composite action
The child composite actions steps should run in this example, the child composite action has not yet failed, so it should run all steps until a step fails. This is consistent with how a composite action currently works in production if the main job fails but a composite action is invoked with `if:always()` or `if: failure()`

### Other options explored
We could add the `current_step_status` to the job context rather then `__status` to the steps context, however this comes with two major downsides:
We could add the `current_step_status` to the job context rather than `__status` to the steps context, however this comes with two major downsides:
- We need to support the field for every type of step, because its non trivial to remove a field from the job context once it has been added (its readonly)
- For all actions besides composite it would only every be `success`
- Its weird to have a `current_step` value on the job context
Expand Down
20 changes: 10 additions & 10 deletions docs/adrs/1751-runner-job-hooks.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,30 +2,30 @@

## Context

This ADR details the design changes for supporting custom configurable hooks for on various runner events. This has been a long requested user feature [here](https://github.com/actions/runner/issues/1543), [here](https://github.com/actions/runner/issues/699) and [here](https://github.com/actions/runner/issues/1116) for users to have more information on runner observability, and for the ability to run cleanup and teardown jobs.
This ADR details the design changes for supporting custom configurable hooks for on various runner events. This has been a long requested user feature ([actions/runner#699](https://github.com/actions/runner/issues/699) [actions/runner#1116](https://github.com/actions/runner/issues/1116), and [actions/runner#1543](https://github.com/actions/runner/issues/1543)) for users to have more information on runner observability, and for the ability to run cleanup and teardown jobs.

This feature is mainly intended for self hosted runner administrators.

**What we hope to solve with this feature**
1. A runner admininstrator is able to add custom scripts to cleanup their runner environment at the start or end of a job
2. A runner admininstrator is able to add custom scripts to help setup their runner environment at the beginning of a job, for reasons like [caching](https://github.com/actions/runner/issues/1543#issuecomment-1050346279)
1. A runner administrator is able to add custom scripts to cleanup their runner environment at the start or end of a job
2. A runner administrator is able to add custom scripts to help setup their runner environment at the beginning of a job, for reasons like [caching](https://github.com/actions/runner/issues/1543#issuecomment-1050346279)
3. A runner administrator is able to grab custom telemetry of jobs running on their self hosted runner

**What we don't think this will solve**
- Policy features that require certain steps run at the beginning or end of all jobs
- This would be better solved to in a central place in settings, rather then decentralized on each runner.
- The Proposed `Notification Hooks for Runners` is limited to self hosted runners, we don't beileve Policy features should be
- Reuse scenarios between jobs are covered by [composite actions](https://docs.github.com/en/actions/creating-actions/creating-a-composite-action) and [resuable workflows](https://docs.github.com/en/actions/using-workflows/reusing-workflows)
- This would be better solved to in a central place in settings, rather than decentralized on each runner.
- The Proposed `Notification Hooks for Runners` is limited to self hosted runners, we don't believe Policy features should be
- Reuse scenarios between jobs are covered by [composite actions](https://docs.github.com/en/actions/creating-actions/creating-a-composite-action) and [reusable workflows](https://docs.github.com/en/actions/using-workflows/reusing-workflows)
- Security applications, security should be handled on the policy side on the server, not decentralized on each runner

## Hooks
- We will expose 2 variables that users can set to enable hooks
- We will expose two variables that users can set to enable hooks
- `ACTIONS_RUNNER_HOOK_JOB_STARTED`
- `ACTIONS_RUNNER_HOOK_JOB_COMPLETED`

You can set these variables to the **absolute** path of a `.sh` or `.ps1` file.

We will execute `pwsh` (fallback to `powershell`) or `bash` (fallback to `sh`) as appropriate.
We will execute `pwsh` (fall back to `powershell`) or `bash` (fall back to `sh`) as appropriate.
- `.sh` files will execute with the args `-e {pathtofile}`
- `.ps1` files will execute with the args `-command \". '{pathtofile}'\"`

Expand Down Expand Up @@ -63,7 +63,7 @@ These are **synchronous** hooks, so they will block job execution while they are
- There will be no support for `continue-on-error`

## Key Decisions
- We will expose 2 variables that users can set to enable hooks
- We will expose two variables that users can set to enable hooks
- `ACTIONS_RUNNER_HOOK_JOB_STARTED`
- `ACTIONS_RUNNER_HOOK_JOB_COMPLETED`
- Users can set these variables to the path of a `.sh` or `.ps1` file, which we will execute when Jobs are started or completed.
Expand All @@ -73,7 +73,7 @@ These are **synchronous** hooks, so they will block job execution while they are
- These files will execute as the Runner user, outside of any container specification on the job
- These are **synchronous** hooks
- Runner admins can execute a background process for async hooks if they want
- We will fail the job and halt execution on any exit code that is not 0. The Runner admin is responsible for returning the correct exit code and ensuring resilency.
- We will fail the job and halt execution on any exit code that is not 0. The Runner admin is responsible for returning the correct exit code and ensuring resiliency.
- This includes that the runner user needs access to the file in the env and the file must exist
- There will be no `continue-on-error` type option on launch
- There will be no `timeout` option on launch
Expand Down
14 changes: 7 additions & 7 deletions docs/adrs/1891-container-hooks.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
# Background

[Job Hooks](https://github.com/actions/runner/blob/main/docs/adrs/1751-runner-job-hooks.md) have given users the ability to customize how their self hosted runners run a job.
Users also want the ability to customize how they run containers during the scope of the job, rather then being locked into the docker implementation we have in the runner. They may want to use podman, kubernetes, or even change the docker commands we run.
We should give them that option, and publish examples how how they can create their own hooks.
Users also want the ability to customize how they run containers during the scope of the job, rather than being locked into the docker implementation we have in the runner. They may want to use podman, kubernetes, or even change the docker commands we run.
We should give them that option, and publish examples how they can create their own hooks.

# Guiding Principles
- **Extensibility** is the focus, we need to make sure we are flexible enough to cover current and future scenarios, even at the cost of making it harder to utilize these hooks
Expand Down Expand Up @@ -46,7 +46,7 @@ All text written to stdout or stderr should appear in the job or step logs. With
1. Wrapping the json in some unique tag and processing it like we do commands
2. Writing to a file

For 1, users typically view logging information as a safe action, so we worry someone accidentialy logging unsantized information and causing unexpected or un-secure behavior. We eventually plan to move off of stdout/stderr style commands in favor of a runner cli.
For 1, users typically view logging information as a safe action, so we worry someone accidentally logging unsanitized information and causing unexpected or insecure behavior. We eventually plan to move off of stdout/stderr style commands in favor of a runner cli.
Investing in this area doesn't make a lot of sense at this time.

While writing to a file to communicate isn't the most ideal pattern, its an existing pattern in the runner and serves us well, so lets reuse it.
Expand Down Expand Up @@ -88,14 +88,14 @@ We will not version these hooks at launch. If needed, we can always major versio
The [job context](https://docs.github.com/en/actions/learn-github-actions/contexts#example-contents-of-the-job-context) currently has a variety of fields that correspond to containers. We should consider allowing hooks to populate new fields in the job context. That is out of scope for this original release however.

## Hooks
Hooks are to be implemented at a very high level, and map to actions the runner does, rather then specific docker actions like `docker build` or `docker create`. By mapping to runner actions, we create a very extensible framework that is flexible enough to solve any user concerns in the future. By providing first party implementations, we give users easy starting points to customize specific hooks (like `docker build`) without having to write full blown solutions.
Hooks are to be implemented at a very high level, and map to actions the runner does, rather than specific docker actions like `docker build` or `docker create`. By mapping to runner actions, we create a very extensible framework that is flexible enough to solve any user concerns in the future. By providing first party implementations, we give users easy starting points to customize specific hooks (like `docker build`) without having to write full blown solutions.

The other would be to provide hooks that mirror every docker call we make, and expose more hooks to help support k8s users, with the expectation that users may have to no-op on multiple hooks if they don't correspond to our use case.

Why we don't want to go that way
- It feels clunky, users need to understand which hooks they need to implement and which they can ignore, which isn't a great UX
- It doesn't scale well, I don't want to build a solution where we may need to add more hooks, by mapping to runner actions, updating hooks is a painful experience for users
- Its overwhelming, its easier to tell users to build 4 hooks and track data themselves, rather then 16 hooks where the runner needs certain information and then needs to provide that information back into each hook. If we expose `Container Create`, you need to return the container you created, then we do `container run` which uses that container. If we just give you an image and say create and run this container, you don't need to store the container id in the runner, and it maps better to k8s scenarios where we don't really have container ids.
- Its overwhelming, its easier to tell users to build 4 hooks and track data themselves, rather than 16 hooks where the runner needs certain information and then needs to provide that information back into each hook. If we expose `Container Create`, you need to return the container you created, then we do `container run` which uses that container. If we just give you an image and say create and run this container, you don't need to store the container id in the runner, and it maps better to k8s scenarios where we don't really have container ids.

### Prepare_job hook
The `prepare_job` hook is called when a job is started. We pass in any job or service containers the job has. We expect that you:
Expand Down Expand Up @@ -286,9 +286,9 @@ jobContainer: **Optional** An Object containing information about the specified

### Cleanup Job
The `cleanup_job` hook is called at the end of a job and expects you to:
- Stop any running service or job containers (or the equiavalent pod)
- Stop any running service or job containers (or the equivalent pod)
- Stop the network (if one exists)
- Delete any job or service containers (or the equiavalent pod)
- Delete any job or service containers (or the equivalent pod)
- Delete the network (if one exists)
- Cleanup anything else that was created for the run

Expand Down
2 changes: 1 addition & 1 deletion docs/adrs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,4 @@ This folder includes ADRs for the actions runner. ADRs are proposed in the form

---

- More information about ADRs can be found [here](https://github.com/joelparkerhenderson/architecture_decision_record).
- More information about ADRs can be found in [joelparkerhenderson/architecture-decision-record](https://github.com/joelparkerhenderson/architecture_decision_record).
2 changes: 1 addition & 1 deletion docs/checks/actions.md
Original file line number Diff line number Diff line change
Expand Up @@ -80,4 +80,4 @@ Make sure the runner has access to actions service for GitHub.com or GitHub Ente

## Still not working?

Contact [GitHub Support](https://support.github.com) if you have further questuons, or log an issue at https://github.com/actions/runner if you think it's a runner issue.
Contact [GitHub Support](https://support.github.com) if you have further questions, or log an issue at https://github.com/actions/runner if you think it's a runner issue.
Loading