act runner release 0.6.0 #3

2026-04-29T00:55:53+02:00

demus commented

2026-04-29 00:55:53 +02:00

This release contains a security fix for CVE-2026-28708 which introduces authentication between the runner and the cache server. Thanks to @haroutp for the report.

Breaking changes

cache.external_server now requires cache.external_secret (#849). Operators running a standalone act_runner cache-server must set the same cache.external_secret in both the runner config and the cache-server config — neither process starts without it. Runners using the default embedded cache server are unaffected and need no config changes. As part of the same security fix, pre-existing entries in bolt.db have no repo stamp and will be evicted by GC, causing a one-time cache miss per key after upgrade.

Changelog

Clone different git repos in parallel via per-directory locks (#866)
fix: avoid 'filename too long' on matrix jobs by hashing container names (#853)
fix(deps): update module github.com/mattn/go-isatty to v0.0.22 (#863)
fix(deps): update module github.com/docker/docker to v25.0.14+incompatible (#862)
Authenticate cache requests via ACTIONS_RUNTIME_TOKEN and scope by repo (#849)
feat: show run command, shell and env in collapsible group before step output (#847)
run docker step in host mode (#857)
chore(deps): drop unused distribution/reference replace directive (#858)

This release contains a security fix for CVE-2026-28708 which introduces authentication between the runner and the cache server. Thanks to [@haroutp](https://github.com/haroutp) for the report. ## Breaking changes - cache.external_server now requires cache.external_secret ([#849](https://gitea.com/gitea/act_runner/issues/849)). Operators running a standalone act_runner cache-server must set the same cache.external_secret in both the runner config and the cache-server config — neither process starts without it. Runners using the default embedded cache server are unaffected and need no config changes. As part of the same security fix, pre-existing entries in bolt.db have no repo stamp and will be evicted by GC, causing a one-time cache miss per key after upgrade. ## Changelog - Clone different git repos in parallel via per-directory locks ([#866](https://gitea.com/gitea/act_runner/issues/866)) - fix: avoid 'filename too long' on matrix jobs by hashing container names ([#853](https://gitea.com/gitea/act_runner/issues/853)) - fix(deps): update module github.com/mattn/go-isatty to v0.0.22 ([#863](https://gitea.com/gitea/act_runner/issues/863)) - fix(deps): update module github.com/docker/docker to v25.0.14+incompatible ([#862](https://gitea.com/gitea/act_runner/issues/862)) - Authenticate cache requests via ACTIONS_RUNTIME_TOKEN and scope by repo ([#849](https://gitea.com/gitea/act_runner/issues/849)) - feat: show run command, shell and env in collapsible group before step output ([#847](https://gitea.com/gitea/act_runner/issues/847)) - run docker step in host mode ([#857](https://gitea.com/gitea/act_runner/issues/857)) - chore(deps): drop unused distribution/reference replace directive ([#858](https://gitea.com/gitea/act_runner/issues/858))

demus added 1 commit 2026-04-29 00:55:55 +02:00

act runner release 0.6.0 4ba289b16c

demus merged commit adc609934e into main

2026-04-29 00:56:40 +02:00

demus deleted branch upgrad/0.6.0

2026-04-29 00:56:41 +02:00

demus referenced this issue from a commit

2026-04-29 00:56:42 +02:00

act runner release 0.6.0 (#3)

Sign in to join this conversation.