0.6.1

• Do not persist AWS access keys in extra_env (AWS_ACCESS_KEY_ID / secret / session token). Skip those keys if already stored. The manager does not disable IMDS and does not reserve AWS_PROFILE / AWS_CONFIG_FILE. See 0008
• Operator lifecycle logs at info: create/recreate/apply/start/stop/restart/delete and Recreate missing (phases plus done/fail). Image pulls and PAT token minting are logged; list/health polls stay quiet. Use debug for inspect/helpers

0.6.0

• Reset-resilient recreate: configure phase no longer uses DEBUG_ONLY (upstream skips config.sh when that flag is set and .runner is missing). Configure uses RUNNER_TOKEN + CMD true + restart=no, then a tokenless listener. Recreate works after a Docker wipe with a token/PAT — see 0007
• Do not 409 RUNNER_BUSY when the managed container is missing or exited (leftover host status.json after a Docker reset); inspect failures fail closed as 503; a running container with missing/unreadable/unknown status.json is 409
• Create rollback keeps the store row and data volume when .runner or a managed container exists; recreate restores .runner from backup if start fails; Save & apply persists only after a successful recreate
• Create/recreate rate-limit quota is consumed only after validation (400/404 do not count); extra_env values, CPU/memory caps, and network_mode are validated
• Operator Recreate missing (POST /api/v1/runners/recreate-missing) restores a Docker-reset fleet; Start/restart/logs on a missing container return 400
• Listen wait timeout while the container is still running fails create/recreate (never 201); leftover configure containers with RUNNER_TOKEN are not adopted as the listener
• GET /runners/{id} reads .runner via CopyFromContainer while running and skips volume helpers when missing; configure wait does not alpine-poll on file-not-found; ReadVolumeFile does not auto-create missing volumes and shares the helper semaphore
• List after a successful ListManaged marks absent names missing without InspectByName
• Clear error when image is missing (:local tags are not pulled, 400); registry pull failures are 502 IMAGE_PULL_ERROR
• Health status is ok or degraded (HTTP stays 200); empty HA github_pat unsets inherited GITHUB_PAT; host binaries bind 127.0.0.1 unless LISTEN_ADDR / Docker / Supervisor
• WebSocket Origin no longer trusts X-Ingress-Path alone; log lines and errors are token-redacted
• UI: list poll no longer clears recreate errors; failed mutations refresh the list; Recreate / Recreate missing / Edit apply always offer a token field and show the API error

0.5.3

What's changed

• Same-path build cache: bind mounts always use host_path as the container target; inject RUNNER_CACHE / expose cache_effective for workflows and Buildx type=local (see 0006)
• Remove bind host_path ≠ target mismatch warning (coerced instead); named-volume sibling advisory retained
• UI: Persistent cache defaults to host path (bind); single host-path field; prefer $RUNNER_CACHE in help copy
• EnsureHostDir binds the path’s top-level directory so any absolute host path works (USB, SSD, custom mounts) — no allowlist
• Concurrent API scalability: parallel List enrich, batched ListManaged, inspect singleflight + generation-gated TTL cache, capped helper concurrency, per-runner lifecycle locks, cheap Health StatusCounts, List job-status without host helpers, timeout-safe response writer
• API rejects recreate / delete / patch-apply while job_state=busy (409 RUNNER_BUSY)
• Stop/restart remain available for emergency intervention; UI busy gating unchanged

Install

Home Assistant addon image: ghcr.io/dchote/github-runner-addon:0.5.3

0.5.2

What's Changed

• Soft advisories on runner API/UI as warnings[] (create/patch still succeed):
  • cache bind with host_path ≠ target (sibling Docker / Buildx type=local miss)
  • cache named volume (never visible to sibling host binds of the target path)
• Docs/UI: same-path cache bind recipe (prefer host_path = mount path, commonly both /cache)
• UI: selecting host-path cache prefills Host path from the mount path when empty; details use warning alerts

Image: ghcr.io/dchote/github-runner-addon:0.5.2

0.5.1

What's Changed

• Register runners with a configure-only (DEBUG_ONLY) container, then start the long-running listener without RUNNER_TOKEN — avoids killing a live GitHub session to scrub the token (fixes “session already exists” races)
• Recreate reuses volume credentials without minting a fresh token unless workdir/volume reconfigure is required
• UI: only the action that was clicked shows a loading spinner; other controls are disabled while it runs
• UI: disable Edit / Delete / Recreate while a runner is busy (job_state=busy); start/stop/restart/logs stay available (UI-only; API unchanged)

Image: ghcr.io/dchote/github-runner-addon:0.5.1

0.5.0

What's Changed

• Show runner idle/busy job activity (and current job fields while busy) from local Actions job hooks — no PAT required; see 0005
• Status column shows idle/busy/unknown when the container is running; details pane lists current job metadata
• After upgrade, Recreate existing runners so ACTIONS_RUNNER_HOOK_JOB_* env is applied

Image: ghcr.io/dchote/github-runner-addon:0.5.0 (published by CI Builder)

0.4.4

Summary

• Harden Docker lifecycle against client/ingress cancel: detached create/recreate/scrub contexts; fail closed on workdir verify (return error, keep runner for recovery); do not clear .runner on transient read cancel
• List skips live .runner reads (cache-only); Get/details fetch live diagnostics; short-lived volume helper; longer PATCH/stop/delete API timeouts
• Docs: workdir diagnostics List vs Get; consuming-repo Actions RUNNER_TOKEN note

Install

ghcr.io/dchote/github-runner-addon:0.4.4

0.4.3

What's fixed

• .runner workFolder reads no longer go through cat + container logs (multiplex framing could corrupt JSON and surface as invalid character 'ï'…)
• Use CopyFromContainer + UTF-8 BOM strip so create/verify completes quickly

Home Assistant users: update to ghcr.io/dchote/github-runner-addon:0.4.3, then recreate the runner if create previously failed verification.

See CHANGELOG.

0.4.2

What's fixed

• Stop the runner container before clearing .runner for workdir reconfigure
• Fail closed if agent workFolder does not match the host bind after start
• Create missing host dirs via the narrowest bind root (/srv, /mnt, …) instead of always mounting /
• Typed ErrVolumeFileNotFound (no fragile exit 1 string matching); hard read errors are not cached
• UI default workdir hint uses the same normalized name as the backend
• Pipeline unit tests via a workdirHost seam; remove unused VolumeMountpoint

Home Assistant users: update to ghcr.io/dchote/github-runner-addon:0.4.2.

See CHANGELOG.

0.4.1

What's fixed

• Create missing workdir (and cache bind) host directories before bind-mount so runner create no longer fails when /srv/gha-work/<name> does not exist yet

Home Assistant users: update to ghcr.io/dchote/github-runner-addon:0.4.1, then create/recreate the runner.

See CHANGELOG.