Update disabled-update runners to v2.335.1 and automate freshness

[jmcte]

Finding

The fleet registers runners with automatic updates disabled, but the repository pins Actions Runner 2.334.0 across the Linux/Windows Dockerfiles, image build helper, Lume config, environment defaults, and host runtime. The current official release is v2.335.1, published June 9, 2026.

GitHub's self-hosted runner update policy requires disabled-update runners to move to a new release within 30 days or they stop receiving queued jobs. As of July 10, the repository pin is outside that window. The existing check-runner-version command is not invoked by any workflow.

Impact

Newly built or recycled runners can become ineligible for jobs, and the fleet has no automated gate before the cutoff is crossed.

Recommended work

• Update and deploy all runner planes to 2.335.1 (or the latest verified release at implementation time).
• Establish one runner-version source of truth and derive Docker, Lume, and environment defaults from it.
• Add a scheduled and release-time freshness check using check-runner-version.
• Alert before day 30 and fail release/deployment once the supported window is exceeded.

Automated Linux pool rollout

The Linux container pools also need a safe post-release reconciliation path. When a verified runner image is published, the fleet should update the Synology and dedicated Linux Docker pools without modifying a runner that is currently executing a job:

1. Receive a trusted release signal or reconcile on a bounded schedule.
2. Resolve and verify the exact image tag/digest produced by the release workflow.
3. Drain active jobs and wait for the configured deadline.
4. Pull the verified image and recreate the Compose services.
5. Let new ephemeral containers register from the new image and deregister normally after one job.

The rollout must be serialized, idempotent, and fail closed on an unverified or unavailable image. The existing workflow_job: completed webhook may enqueue reconciliation, but job completion must not directly mutate a live runner.

Acceptance criteria

• All deployable planes render the same current runner version.
• CI fails on cross-file version drift.
• A scheduled check reports version age and blocks before GitHub's cutoff.
• Updated images/runtimes are verified and rolled out, not only changed in source.
• Linux container pools can reconcile to a newly published verified image after active jobs drain.
• A repeated release signal does not cause overlapping drain or deployment operations.
• A failed image lookup or verification leaves the existing pool running and records an actionable failure.
• Tests cover successful rollout, active-job draining, duplicate signals, and failed verification.

Evidence

• src/lib/runner-plane.ts:94-95
• docker/Dockerfile:6
• docker/Dockerfile.windows:5
• scripts/build-image.sh:46
• config/lume-runners.yaml:23
• scripts/lume/install-runtime.sh:70
• src/lib/env.ts:195
• package.json:15

[jmcte]

2026-07-13 implementation status

PR #170 supplies the canonical .runner-version, cross-plane drift enforcement, scheduled 21-day freshness gate, and release validation. PR #171 is the narrower Lume pin update. Both are green and mergeable, with non-author reviews requested from Pheidon and Athena.

The issue should remain open until the reviewed release PR merges, the verified v0.2.2 artifact is published, and refreshed runner versions are proven live across applicable planes.