Update GITEA_RUNNER_IMAGE (docker.io/gitea/runner) to v5 #13

2026-10-25T18:40:59-07:00

renovate Bot commented

2026-10-25 18:40:59 -07:00

This PR contains the following updates:

Package	Update	Change
GITEA_RUNNER_IMAGE	major	`3.5.0` → `5.3.0`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

gitea/runner (GITEA_RUNNER_IMAGE)

`v5.3.0`

Compare Source

Enhancements

Fetch Kubernetes job pod copies from the runner over the pod network via kubernetes.transfer.mode https://gitea.com/gitea/runner/pulls/1354
Scope cache entries by ref like GitHub, caches start cold once after upgrade https://gitea.com/gitea/runner/pulls/1361
Add GITEA_* aliases for built-in GITHUB_* environment variables https://gitea.com/gitea/runner/pulls/1358

Bug fixes

Fix exec --no-skip-checkout panic on local reusable workflows https://gitea.com/gitea/runner/pulls/1362
Scope github.action_repository and github.action_ref to the step executing an action https://gitea.com/gitea/runner/pulls/1359
Fix docker proxy probe leaking containers on slow daemons https://gitea.com/gitea/runner/pulls/1357
Fix zombie s6-notifyoncheck processes in dind images https://gitea.com/gitea/runner/pulls/1364

Dependencies

Update golang.org/x/net to v0.62.0 for CVE-2026-78661 https://gitea.com/gitea/runner/pulls/1356

Full changelog: https://gitea.com/gitea/runner/compare/v5.2.4...v5.3.0

`v5.2.4`

Compare Source

Changelog

ffd8010 enhance(kubernetes): gzip copies into job containers over exec (#1355)
b712c91 test(e2e): cover host mode, reusable workflows, scheduling, reconnect and CLI flags (#1347)
d77e216 fix(exec): serve the v4 artifact API so upload-artifact v4 and later work (#1341)
a76ccd7 test(e2e): cover the register/daemon CLI and failing jobs (#1346)

`v5.2.3`

Compare Source

What's Changed

fix: close the action header group before the action runs in #1345
fix: keep dry runs off the docker daemon and speed up the tests in #1349
fix: keep the shared action cache as extracted, re-fetch damaged trees in #1352
chore(deps): update dependencies in #1351
ci: implement gitea's cache-seeder in #1350
fix: align runner behaviours in #1338

Contributors

Full Changelog: v5.2.2...v5.2.3

`v5.2.2`

Compare Source

Changelog

c719a88 fix(k8s): retry the startup exec until the kubelet accepts it (#1337)

`v5.2.1`

Compare Source

Bug fixes

Hide workflow commands the runner applies itself, like ::set-output::, from the job log, as GitHub's runner does (https://gitea.com/gitea/runner/pulls/1333)
Register ::add-mask:: values in every step even when another step left ::stop-commands:: active, and stop logging post step commands twice (https://gitea.com/gitea/runner/pulls/1333)
Patch code-split action bundles like rust-cache v2.9.2, setup-java v6 and setup-deno v2 so they reach the v2 cache API (https://gitea.com/gitea/runner/pulls/1328)

Performance

Speed up job setup, action preparation and the cache server, a one-step exec drops from 1.70s to 0.87s (https://gitea.com/gitea/runner/pulls/1327)
Cache server lookups and sweeps no longer decode the whole store (https://gitea.com/gitea/runner/pulls/1336)

Refactoring

Migrate to connectrpc.com/connect/v2, works with Gitea servers on connect v1 and v2 (https://gitea.com/gitea/runner/pulls/1325)
Replace bolthold with direct bbolt access, existing caches keep working (https://gitea.com/gitea/runner/pulls/1336)
Remove dead code and consolidate tests (https://gitea.com/gitea/runner/pulls/1335)

Full changelog: https://gitea.com/gitea/runner/compare/v5.2.0...v5.2.1

`v5.2.0`

Compare Source

Security

Build with Go 1.27.3, which fixes CVE-2026-111943 by distrusting a set of intermediate certificates in crypto/x509 (#1332)

Enhancements

Kubernetes: reach services by their id when it is a DNS subdomain (e.g. devstoreaccount1.azurite.local), and warn about ids that differ only in case (#1320)

Bug fixes

Don't fail successful host steps when a leftover background process still holds their output open (#1323)
Fix block and folded scalar round-trips in YAML; config edit no longer wraps lines (#1321)

Refactoring

Drop logrus, mergo, httprouter, retry-go and other direct dependencies, shrinking the binary by ~5% (#1319). Behaviour differences:
- An unreadable file in a build context is skipped with a warning instead of producing a truncated tar
- Build contexts no longer carry security.capability xattrs
- The cache and artifact servers answer HEAD on GET routes, and no longer redirect trailing slashes or answer OPTIONS

Build & maintenance

Drop the unused xgo release* Makefile targets (#1329)
Bump the image and tool pins that Renovate doesn't update; the builder now follows the current Alpine (#1330)
Update a stale go-yaml wrapping comment (#1324)

Contributors

Full Changelog: v5.1.1...v5.2.0

`v5.1.1`

Compare Source

Enhancements

Added runner.log_report_level to set the level of runner messages in the job log independently of log.level (https://gitea.com/gitea/runner/pulls/1310)
Download each action once per job as an archive, with retries, falling back to git (https://gitea.com/gitea/runner/pulls/1316)

Bug fixes

Fix cannot lock ref failures and stale commits after an action's branch or tag moved (https://gitea.com/gitea/runner/pulls/1312)
Remove the job network even when container removal is slow (https://gitea.com/gitea/runner/pulls/1318)
Reclaim orphaned job networks and volumes after 10 minutes instead of workdir_cleanup_age (https://gitea.com/gitea/runner/pulls/1318)

Full changelog: https://gitea.com/gitea/runner/compare/v5.1.0...v5.1.1

`v5.1.0`

Compare Source

Enhancements

Show action pre and post steps as their own steps on Gitea versions that support it (https://gitea.com/gitea/runner/pulls/1293)
Retry startup while Gitea is unreachable instead of exiting (https://gitea.com/gitea/runner/pulls/1294)
exec --use-gitignore follows Git's own ignore rules (https://gitea.com/gitea/runner/pulls/1309)

Bug fixes

Keep GITHUB_ENV, GITHUB_OUTPUT, GITHUB_STATE and GITHUB_PATH for post steps after a timeout or cancellation (https://gitea.com/gitea/runner/pulls/1294)
Ignore --entrypoint in job container options with a warning instead of breaking the container (https://gitea.com/gitea/runner/pulls/1294)
Use the job container's own PATH in cross-architecture jobs (https://gitea.com/gitea/runner/pulls/1294)
Reuse a local image for platform variants like linux/arm/v7 instead of pulling it again (https://gitea.com/gitea/runner/pulls/1294)
Fix action copies on rootless Podman with images that symlink /var/run (https://gitea.com/gitea/runner/pulls/1294)
Lock the action cache across runners that share a cache directory (https://gitea.com/gitea/runner/pulls/1294)
Fix job cleanup for a runner nested behind another runner's Docker proxy (https://gitea.com/gitea/runner/pulls/1314)

Dependencies

Update Go to 1.27.2 and golang.org/x/net to v0.60.0 for security fixes (https://gitea.com/gitea/runner/pulls/1291, https://gitea.com/gitea/runner/pulls/1292)

Full changelog: https://gitea.com/gitea/runner/compare/v5.0.0...v5.1.0

`v5.0.0`

Compare Source

⚠️ Breaking changes

Git 2.34.1 or newer is required (https://gitea.com/gitea/runner/pulls/1277)

The runner now downloads actions and reusable workflows with Git, so it needs git on its PATH. builtin:checkout now runs Git inside the job. Job images need Git as well, and the job must be able to reach Gitea and trust its certificate. The official runner images include Git.

`builtin:checkout` works like `actions/checkout` (https://gitea.com/gitea/runner/pulls/1277)

It now supports SSH keys, LFS, submodules, sparse checkout and partial clones. It also accepts the fetch-tags, clean, show-progress and set-safe-directory inputs, and sets the ref and commit outputs. Branches are checked out as local branches tracking origin, and later steps can fetch and push with the persisted token or SSH key.

Two changes can break existing workflows. It removes untracked and ignored files from the checkout directory unless clean: false is set. It also fails when the triggering tag was moved after the workflow started.

Config values expand `${NAME}` (https://gitea.com/gitea/runner/pulls/1274)

A config value containing ${NAME} now reads that variable from the runner's environment, and the config fails to load when it is unset. Write $${NAME} to keep a literal ${NAME}, for example in a shell command inside a Kubernetes pod_template.

Jobs require `runs-on` (https://gitea.com/gitea/runner/pulls/1271)

A workflow with a job that has no runs-on, or an empty one, now fails instead of running that job in runner.default_image. This matches GitHub. Jobs that call a reusable workflow are exempt.

Metrics follow the OpenTelemetry semantic conventions (https://gitea.com/gitea/runner/pulls/1282)

OTLP metric names, units, types and attributes change, see the metrics docs. On /metrics, gitea_runner_client_errors_total has a new code label, and gitea_runner_job_total counts jobs stopped by runner.timeout as timeout.

Unprivileged runners ignore workflow log and OOM options (https://gitea.com/gitea/runner/pulls/1283)

Unless container.privileged is set, the runner drops --log-driver, --log-opt, --oom-score-adj and --oom-kill-disable from a workflow's container options and logs a warning.

Features

Support mutual TLS to Gitea with runner.client_cert_file and runner.client_key_file (https://gitea.com/gitea/runner/pulls/1273)
Support SHA-256 repositories for actions, reusable workflows and builtin:checkout (https://gitea.com/gitea/runner/pulls/1277)
Support ${NAME} environment variables in config values (https://gitea.com/gitea/runner/pulls/1274)
Support :ro entries in valid_volumes, which allow only read-only mounts (https://gitea.com/gitea/runner/pulls/1272)
Added runner.extra_headers for headers that a reverse proxy in front of Gitea requires (https://gitea.com/gitea/runner/pulls/1269)
Added container.sweep: false to keep services that jobs deploy to the runner's Docker daemon (https://gitea.com/gitea/runner/pulls/1275)
Added gitea_runner_state metric, which reports whether the runner is busy, idle or unavailable (https://gitea.com/gitea/runner/pulls/1282)

Bug fixes

Fix ephemeral runners failing on every restart with recent Gitea versions (https://gitea.com/gitea/runner/pulls/1287)
Fix actions not reaching Kubernetes job pods on Ubuntu-based images (https://gitea.com/gitea/runner/pulls/1286)
Match matrix include and exclude entries regardless of case, like GitHub (https://gitea.com/gitea/runner/pulls/1278)
Apply runner.insecure to reusable workflow downloads and job summary uploads (https://gitea.com/gitea/runner/pulls/1273)
Apply the Docker daemon's mtu to job networks (https://gitea.com/gitea/runner/pulls/1270)

Full changelog: https://gitea.com/gitea/runner/compare/v4.1.0...v5.0.0

`v4.1.0`

Compare Source

Features

Add a Kubernetes backend for running jobs (#1260)

Enhancements

Prometheus metrics can now also be exported through OpenTelemetry (#1248)
Include task, job and run identifiers in logs when a task starts (#1257)
Recommend Docker-in-Docker for container jobs in the documentation (#1258)

Bug fixes

Align Docker actions, job environment handling and host mode more closely with GitHub Actions (#1268)
Prevent action clones from hanging on stalled HTTP/2 connections (#1266)
Fail registration attempts faster and honor GITEA_MAX_REG_ATTEMPTS (#1197)
Fix Docker-in-Docker image readiness checks, exit code propagation and shutdown ordering (#1265)
Clear consumed ephemeral registration state to prevent it from being reused (#1256)

Contributors

Full Changelog: v4.0.1...v4.1.0

`v4.0.1`

Compare Source

What's Changed

fix: resolve container sleep through PATH in #1255
fix: honor configured Docker registration file in #1259
chore(deps): update dependencies in #1254
fix: apply a job container without image to the runs-on image in #1252
fix: misc bug fixed and improvements in #1253
fix: restore the caller's event and inputs in reusable workflow jobs in #1250

Contributors

Full Changelog: v4.0.0...v4.0.1

`v4.0.0`

Compare Source

⚠️ Breaking changes

Jobs reach the cache through their runner (https://gitea.com/gitea/runner/pulls/1229)

With cache.external_server set, jobs send cache requests to their runner, which forwards them. Jobs that cannot reach their runner, such as on a remote DOCKER_HOST, need cache.host and cache.port set to an address they reach.

Jobs on container.network: bridge cannot reach a runner container outside bridge, so their cache and artifact uploads fail. Leave container.network empty or use a user-defined network.

`*` in `valid_volumes` no longer matches across `/` (https://gitea.com/gitea/runner/pulls/1214)

A host pattern relying on * to match nested paths needs **, for example /data/** instead of /data/*.

Features

Added builtin:checkout action, which needs no download and no Node in the job image (https://gitea.com/gitea/runner/pulls/871)
Added self: prefix in step uses which resolves on the runner's Gitea instance (https://gitea.com/gitea/runner/pulls/1233)
Support S3-compatible storage as cache backend with cache.s3, shared between runners without a cache server (https://gitea.com/gitea/runner/pulls/1244)
OpenTelemetry tracing of jobs and steps, enabled with OTEL_EXPORTER_OTLP_ENDPOINT (https://gitea.com/gitea/runner/pulls/1206)

Enhancements

A runner container on the jobs' Docker daemon joins each job network, so jobs reach its cache without cache.host (https://gitea.com/gitea/runner/pulls/1229)
Only runners need to reach cache.external_server, which no longer needs to reach Gitea (https://gitea.com/gitea/runner/pulls/1229)
Faster job start for runners in a container (https://gitea.com/gitea/runner/pulls/1231)
Support --umask in container.options (https://gitea.com/gitea/runner/pulls/1238)

Bug fixes

Skip a job whose if: fails to evaluate instead of failing it, like GitHub (https://gitea.com/gitea/runner/pulls/1247)
Stop actions/cache inside composite actions saving caches of failed jobs (https://gitea.com/gitea/runner/pulls/1242)
Give jobs of Podman runners in a container the Docker socket instead of an empty directory (https://gitea.com/gitea/runner/pulls/1231)
Fix Windows paths in valid_volumes patterns (https://gitea.com/gitea/runner/pulls/1214)
Silence the docker-init subreaper warning in the dind images (https://gitea.com/gitea/runner/pulls/1241)

Full changelog: https://gitea.com/gitea/runner/compare/v3.5.0...v4.0.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [GITEA_RUNNER_IMAGE](https://gitea.com/gitea/runner) | major | `3.5.0` → `5.3.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information. --- ### Release Notes <details> <summary>gitea/runner (GITEA_RUNNER_IMAGE)</summary> ### [`v5.3.0`](https://gitea.com/gitea/runner/releases/tag/v5.3.0) [Compare Source](https://gitea.com/gitea/runner/compare/v5.2.4...v5.3.0) #### Enhancements - Fetch Kubernetes job pod copies from the runner over the pod network via `kubernetes.transfer.mode` <https://gitea.com/gitea/runner/pulls/1354> - Scope cache entries by ref like GitHub, caches start cold once after upgrade <https://gitea.com/gitea/runner/pulls/1361> - Add `GITEA_*` aliases for built-in `GITHUB_*` environment variables <https://gitea.com/gitea/runner/pulls/1358> #### Bug fixes - Fix `exec --no-skip-checkout` panic on local reusable workflows <https://gitea.com/gitea/runner/pulls/1362> - Scope `github.action_repository` and `github.action_ref` to the step executing an action <https://gitea.com/gitea/runner/pulls/1359> - Fix docker proxy probe leaking containers on slow daemons <https://gitea.com/gitea/runner/pulls/1357> - Fix zombie `s6-notifyoncheck` processes in dind images <https://gitea.com/gitea/runner/pulls/1364> #### Dependencies - Update `golang.org/x/net` to v0.62.0 for CVE-2026-78661 <https://gitea.com/gitea/runner/pulls/1356> **Full changelog**: <https://gitea.com/gitea/runner/compare/v5.2.4...v5.3.0> ### [`v5.2.4`](https://gitea.com/gitea/runner/releases/tag/v5.2.4) [Compare Source](https://gitea.com/gitea/runner/compare/v5.2.3...v5.2.4) #### Changelog - [`ffd8010`](https://github.com/gitea/runner/commit/ffd80101a317d6c3ef922dfb4856b629b3d60064) enhance(kubernetes): gzip copies into job containers over exec ([#1355](https://github.com/gitea/runner/issues/1355)) - [`b712c91`](https://github.com/gitea/runner/commit/b712c91c2d562538c837a05ea0202094d6a18c93) test(e2e): cover host mode, reusable workflows, scheduling, reconnect and CLI flags ([#1347](https://github.com/gitea/runner/issues/1347)) - [`d77e216`](https://github.com/gitea/runner/commit/d77e216674e99c8c8761d546d9dab864378280fa) fix(exec): serve the v4 artifact API so upload-artifact v4 and later work ([#1341](https://github.com/gitea/runner/issues/1341)) - [`a76ccd7`](https://github.com/gitea/runner/commit/a76ccd7020dfb68875f489d68ba386f5863a8712) test(e2e): cover the register/daemon CLI and failing jobs ([#1346](https://github.com/gitea/runner/issues/1346)) ### [`v5.2.3`](https://gitea.com/gitea/runner/releases/tag/v5.2.3) [Compare Source](https://gitea.com/gitea/runner/compare/v5.2.2...v5.2.3) #### What's Changed - fix: close the action header group before the action runs in [#1345](https://gitea.com/gitea/runner/pulls/1345) - fix: keep dry runs off the docker daemon and speed up the tests in [#1349](https://gitea.com/gitea/runner/pulls/1349) - fix: keep the shared action cache as extracted, re-fetch damaged trees in [#1352](https://gitea.com/gitea/runner/pulls/1352) - chore(deps): update dependencies in [#1351](https://gitea.com/gitea/runner/pulls/1351) - ci: implement gitea's cache-seeder in [#1350](https://gitea.com/gitea/runner/pulls/1350) - fix: align runner behaviours in [#1338](https://gitea.com/gitea/runner/pulls/1338) #### Contributors - [@bircni](https://github.com/bircni) - [@silverwind](https://github.com/silverwind) - [@Zettat123](https://github.com/Zettat123) - [@renovate-bot](https://github.com/renovate-bot) **Full Changelog**: [v5.2.2...v5.2.3](https://gitea.com/gitea/runner/compare/v5.2.2...v5.2.3) ### [`v5.2.2`](https://gitea.com/gitea/runner/releases/tag/v5.2.2) [Compare Source](https://gitea.com/gitea/runner/compare/v5.2.1...v5.2.2) #### Changelog - [`c719a88`](https://github.com/gitea/runner/commit/c719a88f36262a9ab9d6e7b26090fcc4e647a785) fix(k8s): retry the startup exec until the kubelet accepts it ([#1337](https://github.com/gitea/runner/issues/1337)) ### [`v5.2.1`](https://gitea.com/gitea/runner/releases/tag/v5.2.1) [Compare Source](https://gitea.com/gitea/runner/compare/v5.2.0...v5.2.1) #### Bug fixes - Hide workflow commands the runner applies itself, like `::set-output::`, from the job log, as GitHub's runner does (<https://gitea.com/gitea/runner/pulls/1333>) - Register `::add-mask::` values in every step even when another step left `::stop-commands::` active, and stop logging post step commands twice (<https://gitea.com/gitea/runner/pulls/1333>) - Patch code-split action bundles like `rust-cache` v2.9.2, `setup-java` v6 and `setup-deno` v2 so they reach the v2 cache API (<https://gitea.com/gitea/runner/pulls/1328>) #### Performance - Speed up job setup, action preparation and the cache server, a one-step `exec` drops from 1.70s to 0.87s (<https://gitea.com/gitea/runner/pulls/1327>) - Cache server lookups and sweeps no longer decode the whole store (<https://gitea.com/gitea/runner/pulls/1336>) #### Refactoring - Migrate to `connectrpc.com/connect/v2`, works with Gitea servers on connect v1 and v2 (<https://gitea.com/gitea/runner/pulls/1325>) - Replace bolthold with direct bbolt access, existing caches keep working (<https://gitea.com/gitea/runner/pulls/1336>) - Remove dead code and consolidate tests (<https://gitea.com/gitea/runner/pulls/1335>) **Full changelog**: <https://gitea.com/gitea/runner/compare/v5.2.0...v5.2.1> ### [`v5.2.0`](https://gitea.com/gitea/runner/releases/tag/v5.2.0) [Compare Source](https://gitea.com/gitea/runner/compare/v5.1.1...v5.2.0) #### Security - Build with Go 1.27.3, which fixes CVE-2026-111943 by distrusting a set of intermediate certificates in crypto/x509 ([#1332](https://gitea.com/gitea/runner/pulls/1332)) #### Enhancements - Kubernetes: reach services by their id when it is a DNS subdomain (e.g. `devstoreaccount1.azurite.local`), and warn about ids that differ only in case ([#1320](https://gitea.com/gitea/runner/pulls/1320)) #### Bug fixes - Don't fail successful host steps when a leftover background process still holds their output open ([#1323](https://gitea.com/gitea/runner/pulls/1323)) - Fix block and folded scalar round-trips in YAML; `config edit` no longer wraps lines ([#1321](https://gitea.com/gitea/runner/pulls/1321)) #### Refactoring - Drop logrus, mergo, httprouter, retry-go and other direct dependencies, shrinking the binary by \~5% ([#1319](https://gitea.com/gitea/runner/pulls/1319)). Behaviour differences: - An unreadable file in a build context is skipped with a warning instead of producing a truncated tar - Build contexts no longer carry `security.capability` xattrs - The cache and artifact servers answer HEAD on GET routes, and no longer redirect trailing slashes or answer OPTIONS #### Build & maintenance - Drop the unused xgo `release*` Makefile targets ([#1329](https://gitea.com/gitea/runner/pulls/1329)) - Bump the image and tool pins that Renovate doesn't update; the builder now follows the current Alpine ([#1330](https://gitea.com/gitea/runner/pulls/1330)) - Update a stale go-yaml wrapping comment ([#1324](https://gitea.com/gitea/runner/pulls/1324)) #### Contributors - [@bircni](https://github.com/bircni) - [@silverwind](https://github.com/silverwind) - [@Zettat123](https://github.com/Zettat123) **Full Changelog**: [v5.1.1...v5.2.0](https://gitea.com/gitea/runner/compare/v5.1.1...v5.2.0) ### [`v5.1.1`](https://gitea.com/gitea/runner/releases/tag/v5.1.1) [Compare Source](https://gitea.com/gitea/runner/compare/v5.1.0...v5.1.1) #### Enhancements - Added `runner.log_report_level` to set the level of runner messages in the job log independently of `log.level` (<https://gitea.com/gitea/runner/pulls/1310>) - Download each action once per job as an archive, with retries, falling back to git (<https://gitea.com/gitea/runner/pulls/1316>) #### Bug fixes - Fix `cannot lock ref` failures and stale commits after an action's branch or tag moved (<https://gitea.com/gitea/runner/pulls/1312>) - Remove the job network even when container removal is slow (<https://gitea.com/gitea/runner/pulls/1318>) - Reclaim orphaned job networks and volumes after 10 minutes instead of `workdir_cleanup_age` (<https://gitea.com/gitea/runner/pulls/1318>) **Full changelog**: <https://gitea.com/gitea/runner/compare/v5.1.0...v5.1.1> ### [`v5.1.0`](https://gitea.com/gitea/runner/releases/tag/v5.1.0) [Compare Source](https://gitea.com/gitea/runner/compare/v5.0.0...v5.1.0) #### Enhancements - Show action `pre` and `post` steps as their own steps on Gitea versions that support it (<https://gitea.com/gitea/runner/pulls/1293>) - Retry startup while Gitea is unreachable instead of exiting (<https://gitea.com/gitea/runner/pulls/1294>) - `exec --use-gitignore` follows Git's own ignore rules (<https://gitea.com/gitea/runner/pulls/1309>) #### Bug fixes - Keep `GITHUB_ENV`, `GITHUB_OUTPUT`, `GITHUB_STATE` and `GITHUB_PATH` for post steps after a timeout or cancellation (<https://gitea.com/gitea/runner/pulls/1294>) - Ignore `--entrypoint` in job container `options` with a warning instead of breaking the container (<https://gitea.com/gitea/runner/pulls/1294>) - Use the job container's own `PATH` in cross-architecture jobs (<https://gitea.com/gitea/runner/pulls/1294>) - Reuse a local image for platform variants like `linux/arm/v7` instead of pulling it again (<https://gitea.com/gitea/runner/pulls/1294>) - Fix action copies on rootless Podman with images that symlink `/var/run` (<https://gitea.com/gitea/runner/pulls/1294>) - Lock the action cache across runners that share a cache directory (<https://gitea.com/gitea/runner/pulls/1294>) - Fix job cleanup for a runner nested behind another runner's Docker proxy (<https://gitea.com/gitea/runner/pulls/1314>) #### Dependencies - Update Go to 1.27.2 and `golang.org/x/net` to v0.60.0 for security fixes (<https://gitea.com/gitea/runner/pulls/1291>, <https://gitea.com/gitea/runner/pulls/1292>) **Full changelog**: <https://gitea.com/gitea/runner/compare/v5.0.0...v5.1.0> ### [`v5.0.0`](https://gitea.com/gitea/runner/releases/tag/v5.0.0) [Compare Source](https://gitea.com/gitea/runner/compare/v4.1.0...v5.0.0) #### ⚠️ Breaking changes ##### Git 2.34.1 or newer is required (<https://gitea.com/gitea/runner/pulls/1277>) The runner now downloads actions and reusable workflows with Git, so it needs `git` on its `PATH`. `builtin:checkout` now runs Git inside the job. Job images need Git as well, and the job must be able to reach Gitea and trust its certificate. The official runner images include Git. ##### `builtin:checkout` works like `actions/checkout` (<https://gitea.com/gitea/runner/pulls/1277>) It now supports SSH keys, LFS, submodules, sparse checkout and partial clones. It also accepts the `fetch-tags`, `clean`, `show-progress` and `set-safe-directory` inputs, and sets the `ref` and `commit` outputs. Branches are checked out as local branches tracking `origin`, and later steps can fetch and push with the persisted token or SSH key. Two changes can break existing workflows. It removes untracked and ignored files from the checkout directory unless `clean: false` is set. It also fails when the triggering tag was moved after the workflow started. ##### Config values expand `${NAME}` (<https://gitea.com/gitea/runner/pulls/1274>) A config value containing `${NAME}` now reads that variable from the runner's environment, and the config fails to load when it is unset. Write `$${NAME}` to keep a literal `${NAME}`, for example in a shell command inside a Kubernetes `pod_template`. ##### Jobs require `runs-on` (<https://gitea.com/gitea/runner/pulls/1271>) A workflow with a job that has no `runs-on`, or an empty one, now fails instead of running that job in `runner.default_image`. This matches GitHub. Jobs that call a reusable workflow are exempt. ##### Metrics follow the OpenTelemetry semantic conventions (<https://gitea.com/gitea/runner/pulls/1282>) OTLP metric names, units, types and attributes change, see the [metrics docs](https://gitea.com/gitea/runner/src/branch/main/docs/telemetry.md#metrics). On `/metrics`, `gitea_runner_client_errors_total` has a new `code` label, and `gitea_runner_job_total` counts jobs stopped by `runner.timeout` as `timeout`. ##### Unprivileged runners ignore workflow log and OOM options (<https://gitea.com/gitea/runner/pulls/1283>) Unless `container.privileged` is set, the runner drops `--log-driver`, `--log-opt`, `--oom-score-adj` and `--oom-kill-disable` from a workflow's container `options` and logs a warning. #### Features - Support mutual TLS to Gitea with `runner.client_cert_file` and `runner.client_key_file` (<https://gitea.com/gitea/runner/pulls/1273>) - Support SHA-256 repositories for actions, reusable workflows and `builtin:checkout` (<https://gitea.com/gitea/runner/pulls/1277>) - Support `${NAME}` environment variables in config values (<https://gitea.com/gitea/runner/pulls/1274>) - Support `:ro` entries in `valid_volumes`, which allow only read-only mounts (<https://gitea.com/gitea/runner/pulls/1272>) - Added `runner.extra_headers` for headers that a reverse proxy in front of Gitea requires (<https://gitea.com/gitea/runner/pulls/1269>) - Added `container.sweep: false` to keep services that jobs deploy to the runner's Docker daemon (<https://gitea.com/gitea/runner/pulls/1275>) - Added `gitea_runner_state` metric, which reports whether the runner is busy, idle or unavailable (<https://gitea.com/gitea/runner/pulls/1282>) #### Bug fixes - Fix ephemeral runners failing on every restart with recent Gitea versions (<https://gitea.com/gitea/runner/pulls/1287>) - Fix actions not reaching Kubernetes job pods on Ubuntu-based images (<https://gitea.com/gitea/runner/pulls/1286>) - Match matrix `include` and `exclude` entries regardless of case, like GitHub (<https://gitea.com/gitea/runner/pulls/1278>) - Apply `runner.insecure` to reusable workflow downloads and job summary uploads (<https://gitea.com/gitea/runner/pulls/1273>) - Apply the Docker daemon's `mtu` to job networks (<https://gitea.com/gitea/runner/pulls/1270>) **Full changelog**: <https://gitea.com/gitea/runner/compare/v4.1.0...v5.0.0> ### [`v4.1.0`](https://gitea.com/gitea/runner/releases/tag/v4.1.0) [Compare Source](https://gitea.com/gitea/runner/compare/v4.0.1...v4.1.0) #### Features - Add a Kubernetes backend for running jobs ([#1260](https://github.com/gitea/runner/issues/1260)) #### Enhancements - Prometheus metrics can now also be exported through OpenTelemetry ([#1248](https://github.com/gitea/runner/issues/1248)) - Include task, job and run identifiers in logs when a task starts ([#1257](https://github.com/gitea/runner/issues/1257)) - Recommend Docker-in-Docker for container jobs in the documentation ([#1258](https://github.com/gitea/runner/issues/1258)) #### Bug fixes - Align Docker actions, job environment handling and host mode more closely with GitHub Actions ([#1268](https://github.com/gitea/runner/issues/1268)) - Prevent action clones from hanging on stalled HTTP/2 connections ([#1266](https://github.com/gitea/runner/issues/1266)) - Fail registration attempts faster and honor `GITEA_MAX_REG_ATTEMPTS` ([#1197](https://github.com/gitea/runner/issues/1197)) - Fix Docker-in-Docker image readiness checks, exit code propagation and shutdown ordering ([#1265](https://github.com/gitea/runner/issues/1265)) - Clear consumed ephemeral registration state to prevent it from being reused ([#1256](https://github.com/gitea/runner/issues/1256)) #### Contributors - [@silverwind](https://github.com/silverwind) - [@bircni](https://github.com/bircni) - [@wmTJc9IK0Q](https://github.com/wmTJc9IK0Q) **Full Changelog**: [v4.0.1...v4.1.0](https://gitea.com/gitea/runner/compare/v4.0.1...v4.1.0) ### [`v4.0.1`](https://gitea.com/gitea/runner/releases/tag/v4.0.1) [Compare Source](https://gitea.com/gitea/runner/compare/v4.0.0...v4.0.1) #### What's Changed - fix: resolve container sleep through PATH in [#1255](https://gitea.com/gitea/runner/pulls/1255) - fix: honor configured Docker registration file in [#1259](https://gitea.com/gitea/runner/pulls/1259) - chore(deps): update dependencies in [#1254](https://gitea.com/gitea/runner/pulls/1254) - fix: apply a job container without `image` to the runs-on image in [#1252](https://gitea.com/gitea/runner/pulls/1252) - fix: misc bug fixed and improvements in [#1253](https://gitea.com/gitea/runner/pulls/1253) - fix: restore the caller's event and inputs in reusable workflow jobs in [#1250](https://gitea.com/gitea/runner/pulls/1250) #### Contributors - [@bircni](https://github.com/bircni) - [@renovate-bot](https://github.com/renovate-bot) - [@silverwind](https://github.com/silverwind) - [@Zettat123](https://github.com/Zettat123) **Full Changelog**: [v4.0.0...v4.0.1](https://gitea.com/gitea/runner/compare/v4.0.0...v4.0.1) ### [`v4.0.0`](https://gitea.com/gitea/runner/releases/tag/v4.0.0) [Compare Source](https://gitea.com/gitea/runner/compare/v3.5.0...v4.0.0) #### ⚠️ Breaking changes ##### Jobs reach the cache through their runner (<https://gitea.com/gitea/runner/pulls/1229>) With `cache.external_server` set, jobs send cache requests to their runner, which forwards them. Jobs that cannot reach their runner, such as on a remote `DOCKER_HOST`, need `cache.host` and `cache.port` set to an address they reach. Jobs on `container.network: bridge` cannot reach a runner container outside `bridge`, so their cache and artifact uploads fail. Leave `container.network` empty or use a user-defined network. ##### `*` in `valid_volumes` no longer matches across `/` (<https://gitea.com/gitea/runner/pulls/1214>) A host pattern relying on `*` to match nested paths needs `**`, for example `/data/**` instead of `/data/*`. #### Features - Added `builtin:checkout` action, which needs no download and no Node in the job image (<https://gitea.com/gitea/runner/pulls/871>) - Added `self:` prefix in step `uses` which resolves on the runner's Gitea instance (<https://gitea.com/gitea/runner/pulls/1233>) - Support S3-compatible storage as cache backend with `cache.s3`, shared between runners without a cache server (<https://gitea.com/gitea/runner/pulls/1244>) - OpenTelemetry tracing of jobs and steps, enabled with `OTEL_EXPORTER_OTLP_ENDPOINT` (<https://gitea.com/gitea/runner/pulls/1206>) #### Enhancements - A runner container on the jobs' Docker daemon joins each job network, so jobs reach its cache without `cache.host` (<https://gitea.com/gitea/runner/pulls/1229>) - Only runners need to reach `cache.external_server`, which no longer needs to reach Gitea (<https://gitea.com/gitea/runner/pulls/1229>) - Faster job start for runners in a container (<https://gitea.com/gitea/runner/pulls/1231>) - Support `--umask` in `container.options` (<https://gitea.com/gitea/runner/pulls/1238>) #### Bug fixes - Skip a job whose `if:` fails to evaluate instead of failing it, like GitHub (<https://gitea.com/gitea/runner/pulls/1247>) - Stop `actions/cache` inside composite actions saving caches of failed jobs (<https://gitea.com/gitea/runner/pulls/1242>) - Give jobs of Podman runners in a container the Docker socket instead of an empty directory (<https://gitea.com/gitea/runner/pulls/1231>) - Fix Windows paths in `valid_volumes` patterns (<https://gitea.com/gitea/runner/pulls/1214>) - Silence the `docker-init` subreaper warning in the dind images (<https://gitea.com/gitea/runner/pulls/1241>) **Full changelog**: <https://gitea.com/gitea/runner/compare/v3.5.0...v4.0.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate Bot force-pushed renovate/gitea_runner_image-5.x from 1dff7d63a2 to 500523b579

2026-10-26 17:04:47 -07:00

Compare

renovate Bot force-pushed renovate/gitea_runner_image-5.x from 500523b579 to f0580a2e4a

2026-10-26 23:04:56 -07:00

Compare

renovate Bot force-pushed renovate/gitea_runner_image-5.x from f0580a2e4a to d4db5f59aa

2026-10-28 05:05:47 -07:00

Compare

renovate Bot force-pushed renovate/gitea_runner_image-5.x from d4db5f59aa to 87d9ddab3c

2026-10-28 23:06:40 -07:00

Compare

renovate Bot added 1 commit 2026-11-02 04:06:58 -08:00

Update GITEA_RUNNER_IMAGE (docker.io/gitea/runner) to v5 8f8334ef3d

renovate Bot force-pushed renovate/gitea_runner_image-5.x from 87d9ddab3c to 8f8334ef3d

2026-11-02 04:06:58 -08:00

Compare

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/gitea_runner_image-5.x:renovate/gitea_runner_image-5.x

git checkout renovate/gitea_runner_image-5.x

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: AtlasHorizon/compose#13

Update GITEA_RUNNER_IMAGE (docker.io/gitea/runner) to v5 #13

Release Notes

Enhancements

Bug fixes

Dependencies

Changelog

What's Changed

Contributors

Changelog

Bug fixes

Performance

Refactoring

Security

Enhancements

Bug fixes

Refactoring

Build & maintenance

Contributors

Enhancements

Bug fixes

Enhancements

Bug fixes

Dependencies

⚠️ Breaking changes

Git 2.34.1 or newer is required (https://gitea.com/gitea/runner/pulls/1277)

builtin:checkout works like actions/checkout (https://gitea.com/gitea/runner/pulls/1277)

Config values expand ${NAME} (https://gitea.com/gitea/runner/pulls/1274)

Jobs require runs-on (https://gitea.com/gitea/runner/pulls/1271)

Metrics follow the OpenTelemetry semantic conventions (https://gitea.com/gitea/runner/pulls/1282)

Unprivileged runners ignore workflow log and OOM options (https://gitea.com/gitea/runner/pulls/1283)

Features

Bug fixes

Features

Enhancements

Bug fixes

Contributors

What's Changed

Contributors

⚠️ Breaking changes

Jobs reach the cache through their runner (https://gitea.com/gitea/runner/pulls/1229)

* in valid_volumes no longer matches across / (https://gitea.com/gitea/runner/pulls/1214)

Features

Enhancements

Bug fixes

Configuration

Checkout

`builtin:checkout` works like `actions/checkout` (https://gitea.com/gitea/runner/pulls/1277)

Config values expand `${NAME}` (https://gitea.com/gitea/runner/pulls/1274)

Jobs require `runs-on` (https://gitea.com/gitea/runner/pulls/1271)

`*` in `valid_volumes` no longer matches across `/` (https://gitea.com/gitea/runner/pulls/1214)