v0.25.0

v0.25.0 - 2026-11-06

Added

• The native layer store is crash-tested. In CI, Store.publish, the once-per-boot check, oci.Store.ensure and volumes.adoptSeed run on ext4 over dm-log-writes, the disk is put back to every flush, FUA and mark of the log and mounted, and no layer open accepts differs from what was published; and a publish on a disk that fails writes (dm-flakey) must fail, in syncTree, in syncfs and through the job's descriptor, rather than publish.
• The tests run in as many processes as the machine has cores, in zig build test, CI and the pre-push hook alike (runner/tools/test_shards.zig; ZIG_TEST_SHARDS=1 for one). The tests that use fixed ports on the host, and as root all the native backend's, still run one at a time.

Fixed

• A native job near its memory.high gets more while the host has memory to spare. A first zig build test was held at the 1 GB a job with no history gets, and spent over an hour in swap with 4 GB free, where the Dagger backend took 2 minutes.
• A native publish commits a layer in one journal commit, not two or three. The layer's data is written back first and its meta written before the fsyncs, so a small layer's publish takes about half the time.
• The end-to-end suite tolerates GitHub's API lag: it re-reads jobs and runs that are completed but still list no conclusion, starts the cancel when the job has plainly been running for 30 s even if the step list does not show Hog (the checks still need Hog cancelled and its output in the log), and bounds the wait for job logs GitHub does not serve (one 60 s budget for the suite, and a skipped job is asked once).
• With RUNNER_ZIG_LOCAL_CACHE, an unchanged commit no longer recompiles. Zig's local cache names the builtin.zig files it generated in the global cache's b/, which is each job's own, so every job found them gone and compiled the tests and the runner again (9 s and 8 s on the laptop, cached now). b/ has a volume of its own beside the local cache's, in the same repo scope, filled from the seed's so that the seed's build runner still hits; on the Dagger and the native backends.
• The allocation-failure tests rerun on a faster allocator and count what is left themselves, so they take half as long with the same checks: a quarter off the test run of every build and push.
• Running out of memory while reading the Results service's answer to a log or step summary upload is reported as that, not as "no logs_url in response" (or "no summary_url"): the lookup swallowed the allocation failure as a missing key.
• A rerun of the same commit replays its steps again. RUNNER_TOOL_TREES (on by default) reached --exec-job but never the jobs the runner's loop runs, so "Set up job" did not check the tool cache's trees, and a replayed step that put a directory of the tool cache on the PATH (Install Zig) ran again, with every step after it: a rerun took as long as the first run, 41-48 s against 2 s on the laptop.
• A native publish of a checkout no longer waits for everything else being written to the disk. Layers of up to 512 entries sync only their own files, up from 256.
• The end-to-end suite checks the replay of cache on its third attempt. With the tool cache's trees checked (RUNNER_TOOL_TREES), the tree list is in every step's key, so a tree installed by the run's toolcache job between two attempts makes the next one run its steps again, once; the second attempt now only has to succeed.
• Native Dockerfile actions: a build's stored layers are keyed on what the base image is, not only its tag, so a tag that moved builds again instead of stacking layers from the old image on the new one. Build keys also keep a root and a rootless runner apart and hash every field length-prefixed. The store format is now 5, so existing layers are rebuilt once.
• The native services test asks for the redis image CI fetches, and a change to those images runs the tests. Renovate moved the images to redis 8 on a change that skipped the tests, which left every later test run failing.
• A native job no longer fails at random unpacking an image with a .. symlink while another job publishes a layer. The kernel refuses such a lookup with EAGAIN when any rename on the machine races it, and openIn now tries again.
• A runner that has been up for a while no longer loses GitHub when a certificate rotates. A certificate issued after the runner started failed every new connection until a restart: std reports any failed handshake as TlsInitializationFailed, which the check that replaces the client did not match. The client is now replaced after such a failure, at most once in 15 minutes, and once it is a day old, so it also stops accepting a certificate that expired since it started; and github/http.zigs tests, which the build never listed, now run.

Security

• The inputs #107 listed as untracked are pinned and tracked: the JavaScript runtime images for actions (oven/bun, node) by multi-arch index digest and zizmor by version and file hashes (.github/zizmor-requirements.txt, installed by .github/scripts/zizmor.sh with --require-hashes). Renovate moves both, and leaves a Node or Bun major to be moved by hand.