fix(ci): make bootstrap deterministic and align CI installs

- Change package.json bootstrap to use 'npm ci --prefix packages/hooklib'
- Change k8s-tests workflow to use 'npm ci' instead of 'npm install'
- All three packages (hooklib, k8s, docker) now use deterministic installs
- All three CI jobs (format-and-lint, docker-tests, k8s-tests) now use npm ci

.github/workflows/build.yaml

@@ -13,7 +13,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - run: npm install
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+      - run: node --version && npm --version
+        name: Log Node and npm versions
+      - run: npm ci
         name: Install dependencies
       - run: npm run bootstrap
         name: Bootstrap the packages
@@ -32,7 +38,13 @@ jobs:
     needs: format-and-lint
     steps:
       - uses: actions/checkout@v5
-      - run: npm install
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+      - run: node --version && npm --version
+        name: Log Node and npm versions
+      - run: npm ci
         name: Install dependencies
       - run: npm run bootstrap
         name: Bootstrap the packages
@@ -47,12 +59,18 @@ jobs:
     needs: format-and-lint
     steps:
       - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
       - run: sed -i "s|{{PATHTOREPO}}|$(pwd)|" packages/k8s/tests/test-kind.yaml
         name: Setup kind cluster yaml config
       - uses: helm/[email protected]
         with:
           config: packages/k8s/tests/test-kind.yaml
-      - run: npm install
+      - run: node --version && npm --version
+        name: Log Node and npm versions
+      - run: npm ci
         name: Install dependencies
       - run: npm run bootstrap
         name: Bootstrap the packages

.github/workflows/release.yaml

@@ -12,6 +12,10 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
       - name: Install dependencies
         run: npm install
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hooks",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hooks",
-      "version": "0.8.0",
+      "version": "0.8.1",
       "license": "MIT",
       "dependencies": {
         "eslint-plugin-jest": "^29.0.1"
@@ -560,6 +560,7 @@
       "integrity": "sha512-HC3y9CVuevvWCl/oyZuI47dOeDF9ztdMEfMH8/DW/Mhwa9cCLnK1oD7JoTVGW/u7kFzNZUKUoyJEqkaJh5y3Wg==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/regexpp": "^4.10.0",
         "@typescript-eslint/scope-manager": "8.45.0",
@@ -590,6 +591,7 @@
       "integrity": "sha512-TGf22kon8KW+DeKaUmOibKWktRY8b2NSAZNdtWh798COm1NWx8+xJ6iFBtk3IvLdv6+LGLJLRlyhrhEDZWargQ==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.45.0",
         "@typescript-eslint/types": "8.45.0",
@@ -786,6 +788,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1081,6 +1084,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.8.9",
         "caniuse-lite": "^1.0.30001746",
@@ -1583,6 +1587,7 @@
       "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.36.0.tgz",
       "integrity": "sha512-hB4FIzXovouYzwzECDcUkJ4OcfOEkXTv2zRY6B9bkwjx/cprAq0uvm1nl7zvQ0/TsUk0zQiN4uPfJpB9m+rPMQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -1644,6 +1649,7 @@
       "integrity": "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "eslint-config-prettier": "bin/cli.js"
       },
@@ -3646,6 +3652,7 @@
       "integrity": "sha512-I7AIg5boAr5R0FFtJ6rCfD+LFsWHp81dolrFD8S79U9tb8Az2nGrJncnMSnys+bpQJfRUzqs9hnA81OAA3hCuQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "prettier": "bin/prettier.cjs"
       },
@@ -4380,6 +4387,7 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hooks",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Three projects are included - k8s: a kubernetes hook implementation that spins up pods dynamically to run a job - docker: A hook implementation of the runner's docker implementation  - A hook lib, which contains shared typescript definitions and utilities that the other packages consume",
   "main": "",
   "directories": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "test": "npm run test --prefix packages/docker && npm run test --prefix packages/k8s",
-    "bootstrap": "npm install --prefix packages/hooklib && npm install --prefix packages/k8s && npm install --prefix packages/docker",
+    "bootstrap": "npm ci --prefix packages/hooklib && npm ci --prefix packages/k8s && npm ci --prefix packages/docker",
     "format": "prettier --write '**/*.ts'",
     "format-check": "prettier --check '**/*.ts'",
     "lint": "eslint packages/**/*.ts",

packages/docker/package.json

@@ -13,8 +13,8 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.11.1",
+    "@actions/core": "^2.0.2",
-    "@actions/exec": "^1.1.1",
+    "@actions/exec": "^2.0.0",
     "hooklib": "file:../hooklib",
     "shlex": "^3.0.0",
     "uuid": "^11.1.0"

packages/hooklib/package.json

@@ -22,6 +22,6 @@
     "typescript": "^5.8.3"
   },
   "dependencies": {
-    "@actions/core": "^1.11.1"
+    "@actions/core": "^2.0.2"
   }
 }

packages/k8s/package.json

@@ -13,9 +13,9 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.11.1",
+    "@actions/core": "^2.0.2",
-    "@actions/exec": "^1.1.1",
+    "@actions/exec": "^2.0.0",
-    "@actions/io": "^1.1.3",
+    "@actions/io": "^2.0.0",
     "@kubernetes/client-node": "^1.3.0",
     "hooklib": "file:../hooklib",
     "js-yaml": "^4.1.0",

packages/k8s/src/hooks/run-script-step.ts

@@ -48,6 +48,7 @@ export async function runScriptStep(
     'SRC=/__w/_temp_pre',
     'DST=/__w/_temp',
     // Overwrite _runner_file_commands
+    'cp -a "$SRC/_runner_file_commands/." "$DST/_runner_file_commands"',
     `find "$SRC" -type f ! -path "*/_runner_file_commands/*" -exec sh -c '
     rel="\${1#$2/}"
     target="$3/$rel"

packages/k8s/src/k8s/utils.ts

@@ -301,5 +301,5 @@ export async function sleep(ms: number): Promise<void> {
 }
 
 export function listDirAllCommand(dir: string): string {
-  return `cd ${shlex.quote(dir)} && find . -not -path '*/_runner_hook_responses*' -exec stat -c '%s %n' {} \\;`
+  return `cd ${shlex.quote(dir)} && find . -type f -not -path '*/_runner_hook_responses*' -exec stat -c '%s %n' {} \\;`
 }

releaseNotes.md

@@ -1,15 +1,21 @@
-## Features
+<!-- ## Features -->
-
-- k8s: remove dependency on the runner's volume [#244]
 
 ## Bugs
 
-- docker: fix readOnly volumes in createContainer [#236]
+- Change command to remove sudo to fix fs-init initial container [#263]
+- Sort 'find' output before hashing for consistency [#267]
+- feat: check if required binaries are present [#272]
+- Allow non-root container [#264]
+- Improve validation checks after copying [#285]
+- Fix workingDir permissions issue by creating it within init container [#283]
+- Fix event.json not being copied to /github/workflow in kubernetes-novolume mode [#287]
+- Reduce the amount of data copied to the workflow pod [#293]
+- Overwrite runner file commands [#298]
 
 ## Misc
 
-- bump all dependencies [#234] [#240] [#239] [#238]
+- Dependency updates [#276] [#277] [#278] [#279] [#304]
-- bump actions [#254]
+- Group dependabot updates [#289]
 
 ## SHA-256 Checksums