v0.27.0

v0.27.0 - 2026-11-07

Added

• A native pool warms its store when it starts: the default image is provisioned and the Zig cache seeds are built in the background, with or without an engine (RUNNER_ENGINE=none), so the first jobs on an empty store no longer wait for them. A failed warm is only said.
• A container: job's volumes: that are directories of the job (an anonymous /data, a named cache:/cache) run on the native backend: each is made in the base, root's, there for every step and gone with the job. Host paths, read-only volumes, a named volume a service also lists and odd targets still go to Dagger with the volume named, as does ports: (publishing to the host needs a network rule the runner does not have); the reasons say Dagger ignores them too.
• The engine container can be set with --engine-container, as RUNNER_ENGINE_CONTAINER does.

Changed

• The helpers loop.zig and loop/job.zig share (say, fail, failBody, mintToken, jsonString) moved to loop/exchange.zig, so the two files share little more than Runner, Cycle, Registering and handleJob (#148).
• The part of the dagger.zig overview about markers and reading the log moved to dagger/JobLog.zig, next to the code it describes (#148).
• The README links the SPEC, DESIGN and STUDY documents that the code comments cite, at the commit the runner was split from.
• Declarations in dagger.zig and dagger/ that other files use got doc comments, ten that no other file uses are private again, and docker.dockerRunFor is now docker.runFor (#148).
• The select that runs a function next to a timer and closes a result that arrives late, repeated in pg.Client.connect and feed.Socket.openWithin, is one helper, http.withinClosing, beside http.within (#148).
• The database store and the log sink share one record of their last failure and back-off, and one close-wait, instead of two copies.
• The job message and results-service code share one reader for a mapping's Key/Value entries and one wrapper that turns a failed try into a Result.
• The corpus comparison tools share unhex and the reference loader in runner/tools/corpus.zig.
• BENCHMARKS.md, THIRD_PARTY.md and CHANGELOG.md moved into docs/, with every link and reference to them updated; README.md stays at the root
• CI runs the native tests as root in two parts per architecture, side by side, and the arm64 release builds apart from its tests; the required checks are now gates over those jobs
• The required checks are the test jobs themselves (Tests on both architectures, Release builds (arm64) and the four parts of the native tests as root) instead of two gate jobs, which waited up to 14 minutes for a runner in a busy merge queue

Fixed

• A native step that is cancelled, times out or is stopped with the runner now gets GitHub's warning before it is killed: SIGINT to every process of the step, SIGTERM 7.5 s later, the kill 2.5 s after that, all inside the job's cancel limit, and the step's log says why it was stopped. A second cancel from GitHub can now shorten the limit.
• A native exec stopped during a cancel never counts as exiting 0, so a Dockerfile RUN cut short stores no layer, however its script ended. A step stopped is reported cancelled, or failed on a timeout, whatever it exited with. GitHub's cancel limit is taken as its runner takes it: at least 60 s, less 15 s.
• A pull request based on another branch no longer turns on auto-merge, which merged a stacked pull request as it opened, before CI ran.
• A native pool no longer holds small jobs behind a heavy one that is not there (#361): a runner polling reserves RUNNER_NATIVE_MEM_PER_JOB_MB instead of the heaviest job learned, and a job waits for room for its own estimate once GitHub has handed it out and named it, kept by the renewed lock, one at a time under the gate so a burst of heavy jobs starts only as far as there is room.
• The tests of loop/job.zig (the job's log spool, the cancel watch, the stop deadline) were never part of the test build; they run now.
• The README says automerge skips pull requests based on another branch, as automerge.yml does.
• Native eviction's floor is now tested on a really full disk (a tmpfs filled until writes fail with ENOSPC, in a bubblewrap mount namespace) as well as on simulated shortages.
• The unsupported-step-reference message names the types the runner supports, and inspect no longer crashes on an unexpected job message.
• The test of an abort that comes as the answer does no longer races a 10 ms timer, which a busy CI machine could pause past and fail