refactor(k8s): invert scheduler env var to make affinity default

Change ACTIONS_RUNNER_USE_KUBE_SCHEDULER to ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER to make affinity-based scheduling the first-class (default) implementation. Breaking Change: - OLD: Set ACTIONS_RUNNER_USE_KUBE_SCHEDULER=true to enable affinity (opt-in) - NEW: Affinity is enabled by default, set ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER=true to disable (opt-out) Code changes: - utils.ts: Rename constant and invert useKubeScheduler() logic - rwo-affinity-test.ts: Update tests to verify default affinity behavior - ADR 0135: Update to reflect opt-out model - README: Update guidance to reflect default behavior Co-authored-by: Sisyphus <[email protected]>
docs(adr,k8s): clarify RWX enables free scheduling, RWO requires affinity
2026-04-23 00:23:47 +02:00 · 2026-04-23 00:09:05 +02:00 · 2026-04-22 22:59:40 +02:00 · 2026-04-22 22:55:49 +02:00 · 2026-02-13 22:47:15 +01:00 · 2026-02-04 11:13:03 +01:00
50 changed files with 16336 additions and 19521 deletions
@@ -1,4 +0,0 @@
-dist/
-lib/
-node_modules/
-**/tests/**
@@ -1,56 +0,0 @@
-{
-  "plugins": ["@typescript-eslint"],
-  "extends": ["plugin:github/recommended"],
-  "parser": "@typescript-eslint/parser",
-  "parserOptions": {
-    "ecmaVersion": 9,
-    "sourceType": "module",
-    "project": "./tsconfig.json"
-  },
-  "rules": {
-    "eslint-comments/no-use": "off",
-    "import/no-namespace": "off",
-    "no-constant-condition": "off",
-    "no-unused-vars": "off",
-    "i18n-text/no-en": "off",
-    "@typescript-eslint/no-unused-vars": "error",
-    "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
-    "@typescript-eslint/no-require-imports": "error",
-    "@typescript-eslint/array-type": "error",
-    "@typescript-eslint/await-thenable": "error",
-    "camelcase": "off",
-    "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
-    "@typescript-eslint/func-call-spacing": ["error", "never"],
-    "@typescript-eslint/no-array-constructor": "error",
-    "@typescript-eslint/no-empty-interface": "error",
-    "@typescript-eslint/no-explicit-any": "warn",
-    "@typescript-eslint/no-extraneous-class": "error",
-    "@typescript-eslint/no-floating-promises": "error",
-    "@typescript-eslint/no-for-in-array": "error",
-    "@typescript-eslint/no-inferrable-types": "error",
-    "@typescript-eslint/no-misused-new": "error",
-    "@typescript-eslint/no-namespace": "error",
-    "@typescript-eslint/no-non-null-assertion": "warn",
-    "@typescript-eslint/no-unnecessary-qualifier": "error",
-    "@typescript-eslint/no-unnecessary-type-assertion": "error",
-    "@typescript-eslint/no-useless-constructor": "error",
-    "@typescript-eslint/no-var-requires": "error",
-    "@typescript-eslint/prefer-for-of": "warn",
-    "@typescript-eslint/prefer-function-type": "warn",
-    "@typescript-eslint/prefer-includes": "error",
-    "@typescript-eslint/prefer-string-starts-ends-with": "error",
-    "@typescript-eslint/promise-function-async": "error",
-    "@typescript-eslint/require-array-sort-compare": "error",
-    "@typescript-eslint/restrict-plus-operands": "error",
-    "semi": "off",
-    "@typescript-eslint/semi": ["error", "never"],
-    "@typescript-eslint/type-annotation-spacing": "error",
-    "@typescript-eslint/unbound-method": "error",
-    "no-shadow": "off",
-    "@typescript-eslint/no-shadow": ["error"]
-  },
-  "env": {
-    "node": true,
-    "es6": true
-  }
-}
@@ -0,0 +1,28 @@
+version: 2
+
+updates:
+  # Group updates into a single PR per workspace package
+  - package-ecosystem: npm
+    directory: "/packages/docker"
+    schedule:
+      interval: weekly
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+  - package-ecosystem: npm
+    directory: "/packages/hooklib"
+    schedule:
+      interval: weekly
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+  - package-ecosystem: npm
+    directory: "/packages/k8s"
+    schedule:
+      interval: weekly
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
@@ -6,14 +6,62 @@ on:
    paths-ignore:
    - '**.md'
  workflow_dispatch:
+
 jobs:
-  build:
+  format-and-lint:
+    name: Format & Lint Checks
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+        name: Install dependencies
+      - run: npm run bootstrap
+        name: Bootstrap the packages
+      - run: npm run build-all
+        name: Build packages
+      - run: npm run format-check
+        name: Check formatting
+      - name: Check linter
+        run: |
+          npm run lint
+          git diff --exit-code -- . ':!packages/k8s/tests/test-kind.yaml'
+
+  docker-tests:
+    name: Docker Hook Tests
+    runs-on: ubuntu-latest
+    needs: format-and-lint
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+        name: Install dependencies
+      - run: npm run bootstrap
+        name: Bootstrap the packages
+      - run: npm run build-all
+        name: Build packages
+      - name: Run Docker tests
+        run: npm run test --prefix packages/docker
+
+  k8s-tests:
+    name: Kubernetes Hook Tests
+    runs-on: ubuntu-latest
+    needs: format-and-lint
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
      - run: sed -i "s|{{PATHTOREPO}}|$(pwd)|" packages/k8s/tests/test-kind.yaml
        name: Setup kind cluster yaml config
-      - uses: helm/[email protected]
+      - uses: helm/kind-action@v1.12.0
        with:
          config: packages/k8s/tests/test-kind.yaml
      - run: npm install
@@ -22,10 +70,5 @@ jobs:
        name: Bootstrap the packages
      - run: npm run build-all
        name: Build packages
-      - run: npm run format-check
-      - name: Check linter
-        run: |
-          npm run lint
-          git diff --exit-code -- ':!packages/k8s/tests/test-kind.yaml'
-      - name: Run tests
-        run: npm run test
+      - name: Run Kubernetes tests
+        run: npm run test --prefix packages/k8s
@@ -38,11 +38,11 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v5

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +69,4 @@ jobs:
    #   ./location_of_script_within_repo/buildscript.sh

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
@@ -1,76 +1,74 @@
 name: CD - Release new version
+
 on:
  workflow_dispatch:
+
+permissions:
+  contents: write
+
 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
-      - run: npm install
-        name: Install dependencies
-      - run: npm run bootstrap
-        name: Bootstrap the packages
-      - run: npm run build-all
-        name: Build packages
-      - uses: actions/github-script@v6
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+      - name: Install dependencies
+        run: npm install
+
+      - name: Bootstrap the packages
+        run: npm run bootstrap
+
+      - name: Build packages
+        run: npm run build-all
+
+      - uses: actions/github-script@v8
        id: releaseVersion
        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          result-encoding: string
          script: |
            const fs = require('fs');
-            const hookVersion = require('./package.json').version
-            core.setOutput('version', hookVersion);
+            return require('./package.json').version
+
      - name: Zip up releases
        run: |
-          zip -r -j actions-runner-hooks-docker-${{ steps.releaseVersion.outputs.version }}.zip packages/docker/dist
-          zip -r -j actions-runner-hooks-k8s-${{ steps.releaseVersion.outputs.version }}.zip packages/k8s/dist
+          zip -r -j actions-runner-hooks-docker-${{ steps.releaseVersion.outputs.result }}.zip packages/docker/dist
+          zip -r -j actions-runner-hooks-k8s-${{ steps.releaseVersion.outputs.result }}.zip packages/k8s/dist
+
      - name: Calculate SHA
        id: sha
        shell: bash
        run: |
-          sha_docker=$(sha256sum actions-runner-hooks-docker-${{ steps.releaseVersion.outputs.version }}.zip | awk '{print $1}')
+          sha_docker=$(sha256sum actions-runner-hooks-docker-${{ steps.releaseVersion.outputs.result }}.zip | awk '{print $1}')
          echo "Docker SHA: $sha_docker"
          echo "docker-sha=$sha_docker" >> $GITHUB_OUTPUT
-          sha_k8s=$(sha256sum actions-runner-hooks-k8s-${{ steps.releaseVersion.outputs.version }}.zip | awk '{print $1}')
+          sha_k8s=$(sha256sum actions-runner-hooks-k8s-${{ steps.releaseVersion.outputs.result }}.zip | awk '{print $1}')
          echo "K8s SHA: $sha_k8s"
          echo "k8s-sha=$sha_k8s" >> $GITHUB_OUTPUT
-      - name: replace SHA
+
+      - name: Create release notes
        id: releaseNotes
-        uses: actions/github-script@v6
+        uses: actions/github-script@v8
        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('fs');
-            var releaseNotes = fs.readFileSync('${{ github.workspace }}/releaseNotes.md', 'utf8').replace(/<HOOK_VERSION>/g, '${{ steps.releaseVersion.outputs.version }}')
+            var releaseNotes = fs.readFileSync('${{ github.workspace }}/releaseNotes.md', 'utf8').replace(/<HOOK_VERSION>/g, '${{ steps.releaseVersion.outputs.result }}')
            releaseNotes = releaseNotes.replace(/<DOCKER_SHA>/g, '${{ steps.sha.outputs.docker-sha }}')
            releaseNotes = releaseNotes.replace(/<K8S_SHA>/g, '${{ steps.sha.outputs.k8s-sha }}')
            console.log(releaseNotes)
-            core.setOutput('note', releaseNotes);
-      - uses: actions/create-release@v1
-        id: createRelease
-        name: Create ${{ steps.releaseVersion.outputs.version }} Hook Release
+            fs.writeFileSync('${{ github.workspace }}/finalReleaseNotes.md', releaseNotes);
+
+      - name: Create ${{ steps.releaseVersion.outputs.result }} Hook Release
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: "v${{ steps.releaseVersion.outputs.version }}"
-          release_name: "v${{ steps.releaseVersion.outputs.version }}"
-          body: |
-            ${{ steps.releaseNotes.outputs.note }}
-      - name: Upload K8s hooks
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.createRelease.outputs.upload_url }}
-          asset_path: ${{ github.workspace }}/actions-runner-hooks-k8s-${{ steps.releaseVersion.outputs.version }}.zip
-          asset_name: actions-runner-hooks-k8s-${{ steps.releaseVersion.outputs.version }}.zip
-          asset_content_type: application/octet-stream
-      - name: Upload docker hooks
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.createRelease.outputs.upload_url }}
-          asset_path: ${{ github.workspace }}/actions-runner-hooks-docker-${{ steps.releaseVersion.outputs.version }}.zip
-          asset_name: actions-runner-hooks-docker-${{ steps.releaseVersion.outputs.version }}.zip
-          asset_content_type: application/octet-stream
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create v${{ steps.releaseVersion.outputs.result }} \
+            --title "v${{ steps.releaseVersion.outputs.result }}" \
+            --repo ${{ github.repository }} \
+            --notes-file ${{ github.workspace }}/finalReleaseNotes.md \
+            --latest \
+            ${{ github.workspace }}/actions-runner-hooks-k8s-${{ steps.releaseVersion.outputs.result }}.zip \
+            ${{ github.workspace }}/actions-runner-hooks-docker-${{ steps.releaseVersion.outputs.result }}.zip
@@ -1 +1 @@
-* @actions/actions-launch @actions/runner-akvelon
+* @actions/actions-compute @nikola-jokic
@@ -3,6 +3,24 @@ The Runner Container Hooks repo provides a set of packages that implement the co

 More information on how to implement your own hooks can be found in the [adr](https://github.com/actions/runner/pull/1891). The `examples` folder provides example inputs for each hook.

+### Note
+
+Thank you for your interest in this GitHub action, however, right now we are not taking contributions. 
+
+We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.
+
+We are taking the following steps to better direct requests related to GitHub Actions, including:
+
+1. We will be directing questions and support requests to our [Community Discussions area](https://github.com/orgs/community/discussions/categories/actions)
+
+2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report.
+
+3. Security Issues should be handled as per our [security.md](security.md)
+
+We will still provide security updates for this project and fix major breaking changes during this time.
+
+You are welcome to still raise bugs in this repo.
+
 ## Background 

 Three projects are included in the `packages` folder
@@ -10,10 +28,6 @@ Three projects are included in the `packages` folder
 - docker: A hook implementation of the runner's docker implementation. More details can be found in the [readme](./packages/docker/README.md)
 - hooklib: a shared library which contains typescript definitions and utilities that the other projects consume

-### Requirements
-
-We welcome contributions.  See [how to contribute to get started](./CONTRIBUTING.md).
-
 ## License 

 This project is licensed under the terms of the MIT open source license. Please refer to [MIT](./LICENSE.md) for the full terms.
@@ -28,4 +42,4 @@ Find a bug? Please file an issue in this repository using the issue templates.

 ## Code of Conduct

-See our [Code of Conduct](./CODE_OF_CONDUCT.MD)
+See our [Code of Conduct](./CODE_OF_CONDUCT.MD)
@@ -0,0 +1,55 @@
+# ADR 0135: RWX volume strategy and RWO affinity fallback
+
+**Date:** 22 April 2026
+
+**Status**: Accepted
+
+## Context
+
+The Kubernetes hook implementation for GitHub Actions runners requires access to the runner's working directory (`_work`) within the dynamically created job pods. This shared access is typically managed via Persistent Volume Claims (PVCs).
+
+The choice of storage strategy significantly impacts pod scheduling. While ReadWriteOnce (RWO) volumes require job pods to be co-located on the same node as the runner pod, ReadWriteMany (RWX) volumes allow job pods to be scheduled freely across the cluster.
+
+Depending on the storage provider and cluster configuration, operators may choose between `ReadWriteMany` (RWX) or `ReadWriteOnce` (RWO) access modes. RWX is preferred because it allows the Kubernetes scheduler to place job pods on any available node, improving resource utilization and cluster flexibility. RWO restricts volume access to a single node at a time, requiring all pods using the volume to be pinned to that specific node.
+
+## Decision
+
+We have decided to establish `ReadWriteMany` (RWX) as the preferred storage strategy for the Kubernetes hook. RWX provides superior operational flexibility by enabling free scheduling of job pods across the cluster, as the shared volume is accessible from any node. This decoupling of job pods from the runner's node allows for better resource distribution and reduces the risk of node-level resource exhaustion.
+
+For environments where RWX is unavailable or undesirable, we support a `ReadWriteOnce` (RWO) fallback strategy. This fallback is implemented using node affinity to ensure that job pods are scheduled onto the same node as the runner pod that holds the RWO volume.
+
+### Operational Guidance
+
+1. **Preferred Model (RWX):** Operators should configure the runner with a PVC supporting `ReadWriteMany`.
+2. **Fallback Model (RWO):** If using `ReadWriteOnce`, the Kubernetes scheduler integration is enabled by default. Operators can optionally disable it by setting `ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER=true` (not recommended).
+3. **Node Selection:** By default, the hook applies a `requiredDuringSchedulingIgnoredDuringExecution` node affinity targeting the runner's current node (`kubernetes.io/hostname`).
+4. **Implementation Details:** 
+   - The hook determines the node name via `getCurrentNodeName()` and applies affinity in `packages/k8s/src/k8s/index.ts` (lines 101, 165).
+   - The scheduler is enabled by default. Setting `ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER=true` disables it, as defined in `packages/k8s/src/k8s/utils.ts` (line 16).
+   - The PVC claim name defaults to `${ACTIONS_RUNNER_POD_NAME}-work` unless overridden by `ACTIONS_RUNNER_CLAIM_NAME` (`packages/k8s/src/hooks/constants.ts`, lines 27-33).
+
+### Non-Recommendations
+
+We explicitly do **not** recommend the use of `spec.nodeName` for operator-driven scheduling. While the hook uses `nodeName` as a legacy fallback when `ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER` is set to `true` (`packages/k8s/src/k8s/index.ts`, lines 103, 167), this bypasses the Kubernetes scheduler and can lead to scheduling failures or resource imbalances. Operators should prefer the default affinity-based approach for RWO volumes.
+
+## Alternatives
+
+- **nodeName Bypass:** Directly setting `nodeName` bypasses the scheduler entirely. This was rejected as a recommendation because it prevents the scheduler from accounting for taints, tolerations, and resource pressure.
+- **Local Volumes:** Using local volumes tied to specific nodes. This is a subset of the RWO fallback and is supported via the affinity mechanism.
+
+## Consequences
+
+- **Flexibility:** RWX users benefit from the ability to schedule job pods on any node in the cluster, maximizing resource utilization.
+- **Node Coupling:** RWO users remain coupled to the node where the runner pod is running. The hook ensures job pods are scheduled on the same node via affinity (enabled by default) to maintain workspace integrity.
+- **Configuration:** Operators using RWO can rely on the default affinity-based scheduling. Setting `ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER=true` will fall back to legacy `nodeName` pinning (not recommended). RWX configurations do not require any special configuration for basic operation.
+
+## Migration Guidance
+
+Operators migrating from an RWO setup that relied on legacy `nodeName` behavior can continue by setting `ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER=true`, but should migrate to the default affinity-based scheduling for better scheduler integration:
+1. Remove the `ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER` environment variable to use the default affinity-based scheduling.
+2. Verify that the runner's ServiceAccount has the necessary permissions to list pods (to determine its own node).
+
+## Non-Goals
+
+- This ADR does not recommend `nodeName` as a primary or secondary configuration path for operators.
+- This ADR does not dictate specific storage providers (e.g., EBS vs. EFS vs. Azure Files), but rather the access mode strategy.
@@ -0,0 +1,122 @@
+const eslint = require('@eslint/js');
+const tseslint = require('@typescript-eslint/eslint-plugin');
+const tsparser = require('@typescript-eslint/parser');
+const globals = require('globals');
+const pluginJest = require('eslint-plugin-jest');
+
+module.exports = [
+  eslint.configs.recommended,
+  {
+    files: ['**/*.ts'],
+    languageOptions: {
+      parser: tsparser,
+      parserOptions: {
+        ecmaVersion: 2018,
+        sourceType: 'module',
+        project: ['./tsconfig.json', './packages/*/tsconfig.json']
+      },
+      globals: {
+        ...globals.node,
+        ...globals.es6
+      }
+    },
+    plugins: {
+      '@typescript-eslint': tseslint,
+    },
+    rules: {
+      // Disabled rules from original config
+      'eslint-comments/no-use': 'off',
+      'import/no-namespace': 'off',
+      'no-constant-condition': 'off',
+      'no-unused-vars': 'off',
+      'i18n-text/no-en': 'off',
+      'camelcase': 'off',
+      'semi': 'off',
+      'no-shadow': 'off',
+
+      // TypeScript ESLint rules
+      '@typescript-eslint/no-unused-vars': 'error',
+      '@typescript-eslint/explicit-member-accessibility': ['error', { accessibility: 'no-public' }],
+      '@typescript-eslint/no-require-imports': 'error',
+      '@typescript-eslint/array-type': 'error',
+      '@typescript-eslint/await-thenable': 'error',
+      '@typescript-eslint/explicit-function-return-type': ['error', { allowExpressions: true }],
+      '@typescript-eslint/no-array-constructor': 'error',
+      '@typescript-eslint/no-empty-interface': 'error',
+      '@typescript-eslint/no-explicit-any': 'off', // Fixed: removed duplicate and kept only this one
+      '@typescript-eslint/no-extraneous-class': 'error',
+      '@typescript-eslint/no-floating-promises': 'error',
+      '@typescript-eslint/no-for-in-array': 'error',
+      '@typescript-eslint/no-inferrable-types': 'error',
+      '@typescript-eslint/no-misused-new': 'error',
+      '@typescript-eslint/no-namespace': 'error',
+      '@typescript-eslint/no-non-null-assertion': 'warn',
+      '@typescript-eslint/no-unnecessary-qualifier': 'error',
+      '@typescript-eslint/no-unnecessary-type-assertion': 'error',
+      '@typescript-eslint/no-useless-constructor': 'error',
+      '@typescript-eslint/no-var-requires': 'error',
+      '@typescript-eslint/prefer-for-of': 'warn',
+      '@typescript-eslint/prefer-function-type': 'warn',
+      '@typescript-eslint/prefer-includes': 'error',
+      '@typescript-eslint/prefer-string-starts-ends-with': 'error',
+      '@typescript-eslint/promise-function-async': 'error',
+      '@typescript-eslint/require-array-sort-compare': 'error',
+      '@typescript-eslint/restrict-plus-operands': 'error',
+      '@typescript-eslint/unbound-method': 'error',
+      '@typescript-eslint/no-shadow': ['error']
+    }
+  },
+  {
+    // Test files configuration - Fixed file pattern to match .ts files
+    files: ['**/*test*.ts', '**/*spec*.ts', '**/tests/**/*.ts'],
+    languageOptions: {
+      parser: tsparser,
+      parserOptions: {
+        ecmaVersion: 2018,
+        sourceType: 'module',
+        project: ['./tsconfig.json', './packages/*/tsconfig.json']
+      },
+      globals: {
+        ...globals.node,
+        ...globals.es6,
+        // Fixed Jest globals
+        describe: 'readonly',
+        it: 'readonly',
+        test: 'readonly',
+        expect: 'readonly',
+        beforeEach: 'readonly',
+        afterEach: 'readonly',
+        beforeAll: 'readonly',
+        afterAll: 'readonly',
+        jest: 'readonly'
+      }
+    },
+    plugins: {
+      '@typescript-eslint': tseslint,
+      jest: pluginJest
+    },
+    rules: {
+      // Disable no-undef for test files since Jest globals are handled above
+      'no-undef': 'off',
+      // Relax some rules for test files
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-non-null-assertion': 'off',
+      '@typescript-eslint/explicit-function-return-type': 'off'
+    }
+  },
+  {
+    files: ['**/jest.config.js', '**/jest.setup.js'],
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        jest: 'readonly',
+        module: 'writable'
+      }
+    },
+    rules: {
+      '@typescript-eslint/no-require-imports': 'off',
+      '@typescript-eslint/no-var-requires': 'off',
+      'import/no-commonjs': 'off'
+    }
+  }
+];
@@ -4,9 +4,6 @@ metadata:
  labels:
    labeled-by: "extension"
 spec:
-  securityContext:
-    runAsUser: 1000
-    runAsGroup: 3000
  restartPolicy: Never
  containers:
  - name: $job # overwrites job container
@@ -4,7 +4,7 @@
  "state": {},
  "args": {
    "container": {
-      "image": "node:14.16",
+      "image": "node:22",
      "workingDirectory": "/__w/repo/repo",
      "createOptions": "--cpus 1",
      "environmentVariables": {
@@ -9,7 +9,7 @@
    }
  },
  "args": {
-    "image": "node:14.16",
+    "image": "node:22",
    "dockerfile": null,
    "entryPointArgs": [
      "-e",
@@ -1,6 +1,6 @@
 {
  "name": "hooks",
-  "version": "0.6.1",
+  "version": "0.8.1",
  "description": "Three projects are included - k8s: a kubernetes hook implementation that spins up pods dynamically to run a job - docker: A hook implementation of the runner's docker implementation  - A hook lib, which contains shared typescript definitions and utilities that the other packages consume",
  "main": "",
  "directories": {
@@ -8,10 +8,11 @@
  },
  "scripts": {
    "test": "npm run test --prefix packages/docker && npm run test --prefix packages/k8s",
-    "bootstrap": "npm install --prefix packages/hooklib && npm install --prefix packages/k8s && npm install --prefix packages/docker",
+    "bootstrap": "npm install --prefix packages/hooklib && npm ci --prefix packages/k8s && npm ci --prefix packages/docker",
    "format": "prettier --write '**/*.ts'",
    "format-check": "prettier --check '**/*.ts'",
    "lint": "eslint packages/**/*.ts",
+    "lint:fix": "eslint packages/**/*.ts --fix",
    "build-all": "npm run build --prefix packages/hooklib && npm run build --prefix packages/k8s && npm run build --prefix packages/docker"
  },
  "repository": {
@@ -25,12 +26,18 @@
  },
  "homepage": "https://github.com/actions/runner-container-hooks#readme",
  "devDependencies": {
-    "@types/jest": "^27.5.1",
-    "@types/node": "^17.0.23",
-    "@typescript-eslint/parser": "^5.18.0",
-    "eslint": "^8.12.0",
-    "eslint-plugin-github": "^4.3.6",
-    "prettier": "^2.6.2",
-    "typescript": "^4.6.3"
+    "@eslint/js": "^9.31.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.0.14",
+    "@typescript-eslint/eslint-plugin": "^8.37.0",
+    "@typescript-eslint/parser": "^8.37.0",
+    "eslint": "^9.31.0",
+    "eslint-plugin-github": "^6.0.0",
+    "globals": "^15.12.0",
+    "prettier": "^3.6.2",
+    "typescript": "^5.8.3"
+  },
+  "dependencies": {
+    "eslint-plugin-jest": "^29.0.1"
  }
 }
@@ -1,13 +1,26 @@
-// eslint-disable-next-line import/no-commonjs
 module.exports = {
  clearMocks: true,
+  preset: 'ts-jest',
  moduleFileExtensions: ['js', 'ts'],
  testEnvironment: 'node',
  testMatch: ['**/*-test.ts'],
  testRunner: 'jest-circus/runner',
+  verbose: true,
  transform: {
-    '^.+\\.ts$': 'ts-jest'
+    '^.+\\.ts$': [
+      'ts-jest',
+      {
+        tsconfig: 'tsconfig.test.json'
+      }
+    ],
+    // Transform ESM modules to CommonJS
+    '^.+\\.(js|mjs)$': ['babel-jest', {
+      presets: [['@babel/preset-env', { targets: { node: 'current' } }]]
+    }]
  },
-  setupFilesAfterEnv: ['./jest.setup.js'],
-  verbose: true
+  transformIgnorePatterns: [
+    // Transform these ESM packages
+    'node_modules/(?!(shlex|@kubernetes/client-node|openid-client|oauth4webapi|jose|uuid)/)'
+  ],
+  setupFilesAfterEnv: ['./jest.setup.js']
 }
@@ -5,26 +5,31 @@
  "main": "lib/index.js",
  "scripts": {
    "test": "jest --runInBand",
-    "build": "npx tsc && npx ncc build"
+    "build": "npx tsc && npx ncc build",
+    "format": "prettier --write '**/*.ts'",
+    "format-check": "prettier --check '**/*.ts'",
+    "lint": "eslint src/**/*.ts"
  },
  "author": "",
  "license": "MIT",
  "dependencies": {
-    "@actions/core": "^1.9.1",
-    "@actions/exec": "^1.1.1",
+    "@actions/core": "^2.0.2",
+    "@actions/exec": "^2.0.0",
    "hooklib": "file:../hooklib",
-    "shlex": "^2.1.2",
-    "uuid": "^8.3.2"
+    "shlex": "^3.0.0",
+    "uuid": "^11.1.0"
  },
  "devDependencies": {
-    "@types/jest": "^27.4.1",
-    "@types/node": "^17.0.23",
-    "@typescript-eslint/parser": "^5.18.0",
-    "@vercel/ncc": "^0.33.4",
-    "jest": "^27.5.1",
-    "ts-jest": "^27.1.4",
-    "ts-node": "^10.7.0",
-    "tsconfig-paths": "^3.14.1",
-    "typescript": "^4.6.3"
+    "@babel/core": "^7.25.2",
+    "@babel/preset-env": "^7.25.4",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.0.14",
+    "@typescript-eslint/parser": "^8.37.0",
+    "@vercel/ncc": "^0.38.3",
+    "jest": "^30.0.4",
+    "ts-jest": "^29.4.0",
+    "ts-node": "^10.9.2",
+    "tsconfig-paths": "^4.2.0",
+    "typescript": "^5.8.3"
  }
 }
@@ -43,18 +43,25 @@ export async function createContainer(

  if (args.environmentVariables) {
    for (const [key] of Object.entries(args.environmentVariables)) {
-      dockerArgs.push('-e')
-      dockerArgs.push(key)
+      dockerArgs.push('-e', key)
    }
  }

+  dockerArgs.push('-e', 'GITHUB_ACTIONS=true')
+  // Use same behavior as the runner https://github.com/actions/runner/blob/27d9c886ab9a45e0013cb462529ac85d581f8c41/src/Runner.Worker/Container/DockerCommandManager.cs#L150
+  if (!('CI' in (args.environmentVariables ?? {}))) {
+    dockerArgs.push('-e', 'CI=true')
+  }
+
  const mountVolumes = [
    ...(args.userMountVolumes || []),
    ...(args.systemMountVolumes || [])
  ]
  for (const mountVolume of mountVolumes) {
    dockerArgs.push(
-      `-v=${mountVolume.sourceVolumePath}:${mountVolume.targetVolumePath}`
+      `-v=${mountVolume.sourceVolumePath}:${mountVolume.targetVolumePath}${
+        mountVolume.readOnly ? ':ro' : ''
+      }`
    )
  }
  if (args.entryPoint) {
@@ -403,11 +410,16 @@ export async function containerRun(
  }
  if (args.environmentVariables) {
    for (const [key] of Object.entries(args.environmentVariables)) {
-      dockerArgs.push('-e')
-      dockerArgs.push(key)
+      dockerArgs.push('-e', key)
    }
  }

+  dockerArgs.push('-e', 'GITHUB_ACTIONS=true')
+  // Use same behavior as the runner https://github.com/actions/runner/blob/27d9c886ab9a45e0013cb462529ac85d581f8c41/src/Runner.Worker/Container/DockerCommandManager.cs#L150
+  if (!('CI' in (args.environmentVariables ?? {}))) {
+    dockerArgs.push('-e', 'CI=true')
+  }
+
  const mountVolumes = [
    ...(args.userMountVolumes || []),
    ...(args.systemMountVolumes || [])
@@ -31,9 +31,13 @@ export async function prepareJob(
    core.info('No containers exist, skipping hook invocation')
    exit(0)
  }
-  const networkName = generateNetworkName()
-  // Create network
-  await networkCreate(networkName)
+
+  let networkName = process.env.ACTIONS_RUNNER_NETWORK_DRIVER
+  if (!networkName) {
+    networkName = generateNetworkName()
+    // Create network
+    await networkCreate(networkName)
+  }

  // Create Job Container
  let containerMetadata: ContainerMetadata | undefined = undefined
@@ -1,6 +1,5 @@
 /* eslint-disable @typescript-eslint/no-var-requires */
 /* eslint-disable @typescript-eslint/no-require-imports */
-/* eslint-disable import/no-commonjs */
 import * as core from '@actions/core'
 import { env } from 'process'
 // Import this way otherwise typescript has errors
@@ -75,4 +75,22 @@ describe('run script step', () => {
      runScriptStep(definitions.runScriptStep.args, prepareJobResponse.state)
    ).resolves.not.toThrow()
  })
+
+  it('Should confirm that CI and GITHUB_ACTIONS are set', async () => {
+    definitions.runScriptStep.args.entryPoint = '/bin/bash'
+    definitions.runScriptStep.args.entryPointArgs = [
+      '-c',
+      `'if [[ ! $(env | grep "^CI=") = "CI=true" ]]; then exit 1; fi'`
+    ]
+    await expect(
+      runScriptStep(definitions.runScriptStep.args, prepareJobResponse.state)
+    ).resolves.not.toThrow()
+    definitions.runScriptStep.args.entryPointArgs = [
+      '-c',
+      `'if [[ ! $(env | grep "^GITHUB_ACTIONS=") = "GITHUB_ACTIONS=true" ]]; then exit 1; fi'`
+    ]
+    await expect(
+      runScriptStep(definitions.runScriptStep.args, prepareJobResponse.state)
+    ).resolves.not.toThrow()
+  })
 })
@@ -31,7 +31,7 @@ export default class TestSetup {
  private get allTestDirectories() {
    const resp = [this.testdir, this.runnerMockDir, this.runnerOutputDir]

-    for (const [key, value] of Object.entries(this.runnerMockSubdirs)) {
+    for (const [, value] of Object.entries(this.runnerMockSubdirs)) {
      resp.push(`${this.runnerMockDir}/${value}`)
    }

@@ -42,12 +42,11 @@ export default class TestSetup {
    return resp
  }

-  public initialize(): void {
+  initialize(): void {
    env['GITHUB_WORKSPACE'] = this.workingDirectory
    env['RUNNER_NAME'] = 'test'
-    env[
-      'RUNNER_TEMP'
-    ] = `${this.runnerMockDir}/${this.runnerMockSubdirs.workTemp}`
+    env['RUNNER_TEMP'] =
+      `${this.runnerMockDir}/${this.runnerMockSubdirs.workTemp}`

    for (const dir of this.allTestDirectories) {
      fs.mkdirSync(dir, { recursive: true })
@@ -59,7 +58,7 @@ export default class TestSetup {
    )
  }

-  public teardown(): void {
+  teardown(): void {
    fs.rmdirSync(this.testdir, { recursive: true })
  }

@@ -108,21 +107,21 @@ export default class TestSetup {
    ]
  }

-  public createOutputFile(name: string): string {
+  createOutputFile(name: string): string {
    let filePath = path.join(this.runnerOutputDir, name || `${uuidv4()}.json`)
    fs.writeFileSync(filePath, '')
    return filePath
  }

-  public get workingDirectory(): string {
+  get workingDirectory(): string {
    return `${this.runnerMockDir}/_work/${this.projectName}/${this.projectName}`
  }

-  public get containerWorkingDirectory(): string {
+  get containerWorkingDirectory(): string {
    return `/__w/${this.projectName}/${this.projectName}`
  }

-  public initializeDockerAction(): string {
+  initializeDockerAction(): string {
    const actionPath = `${this.testdir}/_actions/example-handle/example-repo/example-branch/mock-directory`
    fs.mkdirSync(actionPath, { recursive: true })
    this.writeDockerfile(actionPath)
@@ -147,7 +146,7 @@ echo "::set-output name=time::$time"`
    fs.chmodSync(entryPointPath, 0o755)
  }

-  public getPrepareJobDefinition(): HookData {
+  getPrepareJobDefinition(): HookData {
    const prepareJob = JSON.parse(
      fs.readFileSync(
        path.resolve(__dirname + '/../../../examples/prepare-job.json'),
@@ -166,7 +165,7 @@ echo "::set-output name=time::$time"`
    return prepareJob
  }

-  public getRunScriptStepDefinition(): HookData {
+  getRunScriptStepDefinition(): HookData {
    const runScriptStep = JSON.parse(
      fs.readFileSync(
        path.resolve(__dirname + '/../../../examples/run-script-step.json'),
@@ -178,7 +177,7 @@ echo "::set-output name=time::$time"`
    return runScriptStep
  }

-  public getRunContainerStepDefinition(): HookData {
+  getRunContainerStepDefinition(): HookData {
    const runContainerStep = JSON.parse(
      fs.readFileSync(
        path.resolve(__dirname + '/../../../examples/run-container-step.json'),
@@ -0,0 +1,6 @@
+{
+  "compilerOptions": {
+    "allowJs": true
+  },
+  "extends": "./tsconfig.json"
+}
@@ -3,7 +3,7 @@
  "version": "0.1.0",
  "description": "",
  "main": "lib/index.js",
-  "types": "index.d.ts",
+  "types": "lib/index.d.ts",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "build": "tsc",
@@ -14,15 +14,14 @@
  "author": "",
  "license": "MIT",
  "devDependencies": {
-    "@types/node": "^17.0.23",
-    "@typescript-eslint/parser": "^5.18.0",
+    "@types/node": "^24.0.14",
    "@zeit/ncc": "^0.22.3",
-    "eslint": "^8.12.0",
-    "eslint-plugin-github": "^4.3.6",
-    "prettier": "^2.6.2",
-    "typescript": "^4.6.3"
+    "eslint": "^9.31.0",
+    "eslint-plugin-github": "^6.0.0",
+    "prettier": "^3.6.2",
+    "typescript": "^5.8.3"
  },
  "dependencies": {
-    "@actions/core": "^1.9.1"
+    "@actions/core": "^2.0.2"
  }
 }
@@ -22,9 +22,6 @@ rules:
 - apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get", "list", "watch",]
- apiGroups: ["batch"]
-  resources: ["jobs"]
-  verbs: ["get", "list", "create", "delete"]
 - apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create", "delete"]
@@ -33,6 +30,27 @@ rules:
 - The `ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER` env should be set to true to prevent the runner from running any jobs outside of a container
 - The runner pod should map a persistent volume claim into the `_work` directory
    - The `ACTIONS_RUNNER_CLAIM_NAME` env should be set to the persistent volume claim that contains the runner's working directory, otherwise it defaults to `${ACTIONS_RUNNER_POD_NAME}-work`
+- By default, the hook uses the Kubernetes scheduler with `nodeAffinity` to ensure job pods are scheduled correctly (essential for `ReadWriteOnce` volumes). Setting `ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER=true` will fall back to legacy `nodeName` pinning (not recommended).
+
+## Storage Guidance
+The K8s hooks require a shared volume between the runner pod and the job pods to share the workspace and other internal directories.
+
+### RWX (Recommended)
+The preferred way to configure storage is using a `ReadWriteMany` (RWX) Persistent Volume Claim. RWX allows the Kubernetes scheduler to place job pods on any node in the cluster, maximizing resource availability and flexibility.
+
+To migrate from RWO to RWX:
+1. Provision a new `ReadWriteMany` StorageClass if one is not available.
+2. Update your PVC definition to use `accessModes: [ReadWriteMany]`.
+3. No additional environment variables are needed - affinity-based scheduling is the default.
+
+### RWO Fallback (Affinity-based)
+If `ReadWriteMany` storage is not available, you can use `ReadWriteOnce` (RWO) storage. In this mode, all job pods must be scheduled on the same node as the runner pod that owns the PVC.
+
+To enable this safely:
+1. The default affinity-based scheduling works automatically. Do not set `ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER`.
+2. The hooks will automatically add a `nodeAffinity` to the job pods, ensuring they are scheduled on the same node as the runner pod (`kubernetes.io/hostname` match).
+
+> **Note:** We do not recommend manually setting `nodeName` in the pod template, as the hooks handle node placement automatically via affinity when the scheduler is enabled.
 - Some actions runner env's are expected to be set. These are set automatically by the runner.
    - `RUNNER_WORKSPACE` is expected to be set to the workspace of the runner
    - `GITHUB_WORKSPACE` is expected to be set to the workspace of the job
@@ -43,3 +61,5 @@ rules:
 - Building container actions from a dockerfile is not supported at this time
 - Container actions will not have access to the services network or job container network
 - Docker [create options](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idcontaineroptions) are not supported
+- Container actions will have to specify the entrypoint, since the default entrypoint will be overridden to run the commands from the workflow.
+- Container actions need to have the following binaries in their container image: `sh`, `env`, `tail`.
@@ -1,13 +1,26 @@
-// eslint-disable-next-line import/no-commonjs
 module.exports = {
  clearMocks: true,
+  preset: 'ts-jest',
  moduleFileExtensions: ['js', 'ts'],
  testEnvironment: 'node',
  testMatch: ['**/*-test.ts'],
  testRunner: 'jest-circus/runner',
+  verbose: true,
  transform: {
-    '^.+\\.ts$': 'ts-jest'
+    '^.+\\.ts$': [
+      'ts-jest',
+      {
+        tsconfig: 'tsconfig.test.json'
+      }
+    ],
+    // Transform ESM modules to CommonJS
+    '^.+\\.(js|mjs)$': ['babel-jest', {
+      presets: [['@babel/preset-env', { targets: { node: 'current' } }]]
+    }]
  },
-  setupFilesAfterEnv: ['./jest.setup.js'],
-  verbose: true
+  transformIgnorePatterns: [
+    // Transform these ESM packages
+    'node_modules/(?!(shlex|@kubernetes/client-node|openid-client|oauth4webapi|jose|uuid)/)'
+  ],
+  setupFilesAfterEnv: ['./jest.setup.js']
 }
@@ -1 +1,2 @@
+// eslint-disable-next-line filenames/match-regex, no-undef
 jest.setTimeout(500000)
@@ -13,20 +13,25 @@
  "author": "",
  "license": "MIT",
  "dependencies": {
-    "@actions/core": "^1.9.1",
-    "@actions/exec": "^1.1.1",
-    "@actions/io": "^1.1.2",
-    "@kubernetes/client-node": "^0.18.1",
+    "@actions/core": "^2.0.2",
+    "@actions/exec": "^2.0.0",
+    "@actions/io": "^2.0.0",
+    "@kubernetes/client-node": "^1.3.0",
    "hooklib": "file:../hooklib",
    "js-yaml": "^4.1.0",
-    "shlex": "^2.1.2"
+    "shlex": "^3.0.0",
+    "tar-fs": "^3.1.0",
+    "uuid": "^11.1.0"
  },
  "devDependencies": {
-    "@types/jest": "^27.4.1",
-    "@types/node": "^17.0.23",
-    "@vercel/ncc": "^0.33.4",
-    "jest": "^27.5.1",
-    "ts-jest": "^27.1.4",
-    "typescript": "^4.6.3"
+    "@babel/core": "^7.28.3",
+    "@babel/preset-env": "^7.28.3",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.3.0",
+    "@vercel/ncc": "^0.38.3",
+    "babel-jest": "^30.1.1",
+    "jest": "^30.1.1",
+    "ts-jest": "^29.4.1",
+    "typescript": "^5.9.2"
  }
 }
@@ -5,7 +5,8 @@ import {
  JobContainerInfo,
  ContextPorts,
  PrepareJobArgs,
-  writeToResponseFile
+  writeToResponseFile,
+  ServiceContainerInfo
 } from 'hooklib'
 import path from 'path'
 import {
@@ -43,7 +44,6 @@ export async function prepareJob(

  let container: k8s.V1Container | undefined = undefined
  if (args.container?.image) {
-    core.debug(`Using image '${args.container.image}' for job image`)
    container = createContainerSpec(
      args.container,
      JOB_CONTAINER_NAME,
@@ -55,7 +55,6 @@ export async function prepareJob(
  let services: k8s.V1Container[] = []
  if (args.services?.length) {
    services = args.services.map(service => {
-      core.debug(`Adding service '${service.image}' to pod definition`)
      return createContainerSpec(
        service,
        generateContainerName(service.image),
@@ -126,7 +125,7 @@ function generateResponseFile(
  responseFile: string,
  args: PrepareJobArgs,
  appPod: k8s.V1Pod,
-  isAlpine
+  isAlpine: boolean
 ): void {
  if (!appPod.metadata?.name) {
    throw new Error('app pod must have metadata.name specified')
@@ -146,8 +145,10 @@ function generateResponseFile(
    const mainContainerContextPorts: ContextPorts = {}
    if (mainContainer?.ports) {
      for (const port of mainContainer.ports) {
-        mainContainerContextPorts[port.containerPort] =
-          mainContainerContextPorts.hostPort
+        if (port.containerPort && port.hostPort) {
+          mainContainerContextPorts[port.containerPort.toString()] =
+            port.hostPort.toString()
+        }
      }
    }

@@ -167,7 +168,9 @@ function generateResponseFile(
        const ctxPorts: ContextPorts = {}
        if (c.ports?.length) {
          for (const port of c.ports) {
-            ctxPorts[port.containerPort] = port.hostPort
+            if (port.containerPort && port.hostPort) {
+              ctxPorts[port.containerPort.toString()] = port.hostPort.toString()
+            }
          }
        }

@@ -193,7 +196,7 @@ async function copyExternalsToRoot(): Promise<void> {
 }

 export function createContainerSpec(
-  container: JobContainerInfo,
+  container: JobContainerInfo | ServiceContainerInfo,
  name: string,
  jobContainer = false,
  extension?: k8s.V1PodTemplateSpec
@@ -208,29 +211,41 @@ export function createContainerSpec(
    image: container.image,
    ports: containerPorts(container)
  } as k8s.V1Container
-  if (container.workingDirectory) {
-    podContainer.workingDir = container.workingDirectory
+  if (container['workingDirectory']) {
+    podContainer.workingDir = container['workingDirectory']
  }

  if (container.entryPoint) {
    podContainer.command = [container.entryPoint]
  }

-  if (container.entryPointArgs?.length > 0) {
+  if (container.entryPointArgs && container.entryPointArgs.length > 0) {
    podContainer.args = fixArgs(container.entryPointArgs)
  }

  podContainer.env = []
  for (const [key, value] of Object.entries(
-    container['environmentVariables']
+    container['environmentVariables'] || {}
  )) {
    if (value && key !== 'HOME') {
-      podContainer.env.push({ name: key, value: value as string })
+      podContainer.env.push({ name: key, value: value })
    }
  }

+  podContainer.env.push({
+    name: 'GITHUB_ACTIONS',
+    value: 'true'
+  })
+
+  if (!('CI' in (container['environmentVariables'] || {}))) {
+    podContainer.env.push({
+      name: 'CI',
+      value: 'true'
+    })
+  }
+
  podContainer.volumeMounts = containerVolumes(
-    container.userMountVolumes,
+    container['userMountVolumes'],
    jobContainer
  )

@@ -28,7 +28,20 @@ export async function runContainerStep(

  let secretName: string | undefined = undefined
  if (stepContainer.environmentVariables) {
-    secretName = await createSecretForEnvs(stepContainer.environmentVariables)
+    try {
+      const envs = JSON.parse(
+        JSON.stringify(stepContainer.environmentVariables)
+      )
+      envs['GITHUB_ACTIONS'] = 'true'
+      if (!('CI' in envs)) {
+        envs.CI = 'true'
+      }
+      secretName = await createSecretForEnvs(envs)
+    } catch (err) {
+      core.debug(`createSecretForEnvs failed: ${JSON.stringify(err)}`)
+      const message = (err as any)?.response?.body?.message || err
+      throw new Error(`failed to create script environment: ${message}`)
+    }
  }

  const extension = readExtensionFromFile()
@@ -80,7 +93,6 @@ export async function runContainerStep(
  core.debug('Waiting for container job to complete')
  await waitForJobToComplete(job.metadata.name)

-  // pod has failed so pull the status code from the container
  const status = await getPodStatus(podName)
  if (status?.phase === 'Succeeded') {
    return 0
@@ -9,7 +9,7 @@ import { JOB_CONTAINER_NAME } from './constants'
 export async function runScriptStep(
  args: RunScriptStepArgs,
  state,
-  responseFile
+  responseFile?
 ): Promise<void> {
  const { entryPoint, entryPointArgs, environmentVariables } = args
  const { containerPath, runnerPath } = writeEntryPointScript(
@@ -1,5 +1,11 @@
 import * as core from '@actions/core'
-import { Command, getInputFromStdin, prepareJobArgs } from 'hooklib'
+import {
+  Command,
+  getInputFromStdin,
+  PrepareJobArgs,
+  RunContainerStepArgs,
+  RunScriptStepArgs
+} from 'hooklib'
 import {
  cleanupJob,
  prepareJob,
@@ -27,16 +33,16 @@ async function run(): Promise<void> {
    let exitCode = 0
    switch (command) {
      case Command.PrepareJob:
-        await prepareJob(args as prepareJobArgs, responseFile)
+        await prepareJob(args as PrepareJobArgs, responseFile)
        return process.exit(0)
      case Command.CleanupJob:
        await cleanupJob()
        return process.exit(0)
      case Command.RunScriptStep:
-        await runScriptStep(args, state, null)
+        await runScriptStep(args as RunScriptStepArgs, state)
        return process.exit(0)
      case Command.RunContainerStep:
-        exitCode = await runContainerStep(args)
+        exitCode = await runContainerStep(args as RunContainerStepArgs)
        return process.exit(exitCode)
      default:
        throw new Error(`Command not recognized: ${command}`)
@@ -1,7 +1,7 @@
 import * as core from '@actions/core'
 import * as k8s from '@kubernetes/client-node'
-import { ContainerInfo, Registry } from 'hooklib'
 import * as stream from 'stream'
+import type { ContainerInfo, Registry } from 'hooklib'
 import {
  getJobPodName,
  getRunnerPodName,
@@ -95,14 +95,16 @@ export async function createPod(
  appPod.spec.containers = containers
  appPod.spec.restartPolicy = 'Never'

-  if (!useKubeScheduler()) {
-    appPod.spec.nodeName = await getCurrentNodeName()
+  const nodeName = await getCurrentNodeName()
+  if (useKubeScheduler()) {
+    appPod.spec.affinity = await getPodAffinity(nodeName)
+  } else {
+    appPod.spec.nodeName = nodeName
  }
-
  const claimName = getVolumeClaimName()
  appPod.spec.volumes = [
    {
-      name: 'work',
+      name: POD_VOLUME_NAME,
      persistentVolumeClaim: { claimName }
    }
  ]
@@ -125,8 +127,10 @@ export async function createPod(
    mergePodSpecWithOptions(appPod.spec, extension.spec)
  }

-  const { body } = await k8sApi.createNamespacedPod(namespace(), appPod)
-  return body
+  return await k8sApi.createNamespacedPod({
+    namespace: namespace(),
+    body: appPod
+  })
 }

 export async function createJob(
@@ -155,21 +159,23 @@ export async function createJob(
  job.spec.template.spec.containers = [container]
  job.spec.template.spec.restartPolicy = 'Never'

-  if (!useKubeScheduler()) {
-    job.spec.template.spec.nodeName = await getCurrentNodeName()
+  const nodeName = await getCurrentNodeName()
+  if (useKubeScheduler()) {
+    job.spec.template.spec.affinity = await getPodAffinity(nodeName)
+  } else {
+    job.spec.template.spec.nodeName = nodeName
  }

  const claimName = getVolumeClaimName()
  job.spec.template.spec.volumes = [
    {
-      name: 'work',
+      name: POD_VOLUME_NAME,
      persistentVolumeClaim: { claimName }
    }
  ]

  if (extension) {
    if (extension.metadata) {
-      // apply metadata both to the job and the pod created by the job
      mergeObjectMeta(job, extension.metadata)
      mergeObjectMeta(job.spec.template, extension.metadata)
    }
@@ -178,46 +184,42 @@ export async function createJob(
    }
  }

-  const { body } = await k8sBatchV1Api.createNamespacedJob(namespace(), job)
-  return body
+  return await k8sBatchV1Api.createNamespacedJob({
+    namespace: namespace(),
+    body: job
+  })
 }

 export async function getContainerJobPodName(jobName: string): Promise<string> {
  const selector = `job-name=${jobName}`
  const backOffManager = new BackOffManager(60)
  while (true) {
-    const podList = await k8sApi.listNamespacedPod(
-      namespace(),
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      selector,
-      1
-    )
+    const podList = await k8sApi.listNamespacedPod({
+      namespace: namespace(),
+      labelSelector: selector,
+      limit: 1
+    })

-    if (!podList.body.items?.length) {
+    if (!podList.items?.length) {
      await backOffManager.backOff()
      continue
    }

-    if (!podList.body.items[0].metadata?.name) {
+    if (!podList.items[0].metadata?.name) {
      throw new Error(
        `Failed to determine the name of the pod for job ${jobName}`
      )
    }
-    return podList.body.items[0].metadata.name
+    return podList.items[0].metadata.name
  }
 }

 export async function deletePod(podName: string): Promise<void> {
-  await k8sApi.deleteNamespacedPod(
-    podName,
-    namespace(),
-    undefined,
-    undefined,
-    0
-  )
+  await k8sApi.deleteNamespacedPod({
+    name: podName,
+    namespace: namespace(),
+    gracePeriodSeconds: 0
+  })
 }

 export async function execPodStep(
@@ -225,11 +227,11 @@ export async function execPodStep(
  podName: string,
  containerName: string,
  stdin?: stream.Readable
-): Promise<void> {
+): Promise<number> {
  const exec = new k8s.Exec(kc)
+
  command = fixArgs(command)
-  // Exec returns a websocket. If websocket fails, we should reject the promise. Otherwise, websocket will call a callback. Since at that point, websocket is not failing, we can safely resolve or reject the promise.
-  await new Promise(function (resolve, reject) {
+  return await new Promise(function (resolve, reject) {
    exec
      .exec(
        namespace(),
@@ -241,9 +243,8 @@ export async function execPodStep(
        stdin ?? null,
        false /* tty */,
        resp => {
-          // kube.exec returns an error if exit code is not 0, but we can't actually get the exit code
          if (resp.status === 'Success') {
-            resolve(resp.code)
+            resolve(resp.code || 0)
          } else {
            core.debug(
              JSON.stringify({
@@ -251,12 +252,10 @@ export async function execPodStep(
                details: resp?.details
              })
            )
-            reject(resp?.message)
+            reject(new Error(resp?.message || 'execPodStep failed'))
          }
        }
      )
-      // If exec.exec fails, explicitly reject the outer promise
-      // eslint-disable-next-line github/no-then
      .catch(e => reject(e))
  })
 }
@@ -269,7 +268,7 @@ export async function waitForJobToComplete(jobName: string): Promise<void> {
        return
      }
    } catch (error) {
-      throw new Error(`job ${jobName} has failed`)
+      throw new Error(`job ${jobName} has failed: ${JSON.stringify(error)}`)
    }
    await backOffManager.backOff()
  }
@@ -310,8 +309,10 @@ export async function createDockerSecret(
    )
  }

-  const { body } = await k8sApi.createNamespacedSecret(namespace(), secret)
-  return body
+  return await k8sApi.createNamespacedSecret({
+    namespace: namespace(),
+    body: secret
+  })
 }

 export async function createSecretForEnvs(envs: {
@@ -335,30 +336,33 @@ export async function createSecretForEnvs(envs: {
    secret.data[key] = Buffer.from(value).toString('base64')
  }

-  await k8sApi.createNamespacedSecret(namespace(), secret)
+  await k8sApi.createNamespacedSecret({
+    namespace: namespace(),
+    body: secret
+  })
  return secretName
 }

 export async function deleteSecret(secretName: string): Promise<void> {
-  await k8sApi.deleteNamespacedSecret(secretName, namespace())
+  await k8sApi.deleteNamespacedSecret({
+    name: secretName,
+    namespace: namespace()
+  })
 }

 export async function pruneSecrets(): Promise<void> {
-  const secretList = await k8sApi.listNamespacedSecret(
-    namespace(),
-    undefined,
-    undefined,
-    undefined,
-    undefined,
-    new RunnerInstanceLabel().toString()
-  )
-  if (!secretList.body.items.length) {
+  const secretList = await k8sApi.listNamespacedSecret({
+    namespace: namespace(),
+    labelSelector: new RunnerInstanceLabel().toString()
+  })
+  if (!secretList.items.length) {
    return
  }

  await Promise.all(
-    secretList.body.items.map(
-      secret => secret.metadata?.name && deleteSecret(secret.metadata.name)
+    secretList.items.map(
+      async secret =>
+        secret.metadata?.name && deleteSecret(secret.metadata.name)
    )
  )
 }
@@ -386,7 +390,9 @@ export async function waitForPodPhases(
      await backOffManager.backOff()
    }
  } catch (error) {
-    throw new Error(`Pod ${podName} is unhealthy with phase status ${phase}`)
+    throw new Error(
+      `Pod ${podName} is unhealthy with phase status ${phase}: ${JSON.stringify(error)}`
+    )
  }
 }

@@ -409,7 +415,7 @@ export function getPrepareJobTimeoutSeconds(): number {
  return timeoutSeconds
 }

-async function getPodPhase(podName: string): Promise<PodPhase> {
+async function getPodPhase(name: string): Promise<PodPhase> {
  const podPhaseLookup = new Set<string>([
    PodPhase.PENDING,
    PodPhase.RUNNING,
@@ -417,8 +423,10 @@ async function getPodPhase(podName: string): Promise<PodPhase> {
    PodPhase.FAILED,
    PodPhase.UNKNOWN
  ])
-  const { body } = await k8sApi.readNamespacedPod(podName, namespace())
-  const pod = body
+  const pod = await k8sApi.readNamespacedPod({
+    name,
+    namespace: namespace()
+  })

  if (!pod.status?.phase || !podPhaseLookup.has(pod.status.phase)) {
    return PodPhase.UNKNOWN
@@ -426,11 +434,13 @@ async function getPodPhase(podName: string): Promise<PodPhase> {
  return pod.status?.phase as PodPhase
 }

-async function isJobSucceeded(jobName: string): Promise<boolean> {
-  const { body } = await k8sBatchV1Api.readNamespacedJob(jobName, namespace())
-  const job = body
+async function isJobSucceeded(name: string): Promise<boolean> {
+  const job = await k8sBatchV1Api.readNamespacedJob({
+    name,
+    namespace: namespace()
+  })
  if (job.status?.failed) {
-    throw new Error(`job ${jobName} has failed`)
+    throw new Error(`job ${name} has failed`)
  }
  return !!job.status?.succeeded
 }
@@ -450,31 +460,26 @@ export async function getPodLogs(
    process.stderr.write(err.message)
  })

-  const r = await log.log(namespace(), podName, containerName, logStream, {
+  await log.log(namespace(), podName, containerName, logStream, {
    follow: true,
-    tailLines: 50,
    pretty: false,
    timestamps: false
  })
-  await new Promise(resolve => r.on('close', () => resolve(null)))
+  await new Promise(resolve => logStream.on('end', () => resolve(null)))
 }

 export async function prunePods(): Promise<void> {
-  const podList = await k8sApi.listNamespacedPod(
-    namespace(),
-    undefined,
-    undefined,
-    undefined,
-    undefined,
-    new RunnerInstanceLabel().toString()
-  )
-  if (!podList.body.items.length) {
+  const podList = await k8sApi.listNamespacedPod({
+    namespace: namespace(),
+    labelSelector: new RunnerInstanceLabel().toString()
+  })
+  if (!podList.items.length) {
    return
  }

  await Promise.all(
-    podList.body.items.map(
-      pod => pod.metadata?.name && deletePod(pod.metadata.name)
+    podList.items.map(
+      async pod => pod.metadata?.name && deletePod(pod.metadata.name)
    )
  )
 }
@@ -482,16 +487,16 @@ export async function prunePods(): Promise<void> {
 export async function getPodStatus(
  name: string
 ): Promise<k8s.V1PodStatus | undefined> {
-  const { body } = await k8sApi.readNamespacedPod(name, namespace())
-  return body.status
+  const pod = await k8sApi.readNamespacedPod({
+    name,
+    namespace: namespace()
+  })
+  return pod.status
 }

 export async function isAuthPermissionsOK(): Promise<boolean> {
  const sar = new k8s.V1SelfSubjectAccessReview()
-  const asyncs: Promise<{
-    response: unknown
-    body: k8s.V1SelfSubjectAccessReview
-  }>[] = []
+  const asyncs: Promise<k8s.V1SelfSubjectAccessReview>[] = []
  for (const resource of requiredPermissions) {
    for (const verb of resource.verbs) {
      sar.spec = new k8s.V1SelfSubjectAccessReviewSpec()
@@ -501,11 +506,13 @@ export async function isAuthPermissionsOK(): Promise<boolean> {
      sar.spec.resourceAttributes.group = resource.group
      sar.spec.resourceAttributes.resource = resource.resource
      sar.spec.resourceAttributes.subresource = resource.subresource
-      asyncs.push(k8sAuthorizationV1Api.createSelfSubjectAccessReview(sar))
+      asyncs.push(
+        k8sAuthorizationV1Api.createSelfSubjectAccessReview({ body: sar })
+      )
    }
  }
  const responses = await Promise.all(asyncs)
-  return responses.every(resp => resp.body.status?.allowed)
+  return responses.every(resp => resp.status?.allowed)
 }

 export async function isPodContainerAlpine(
@@ -523,23 +530,13 @@ export async function isPodContainerAlpine(
      podName,
      containerName
    )
-  } catch (err) {
+  } catch {
    isAlpine = false
  }

  return isAlpine
 }

-async function getCurrentNodeName(): Promise<string> {
-  const resp = await k8sApi.readNamespacedPod(getRunnerPodName(), namespace())
-
-  const nodeName = resp.body.spec?.nodeName
-  if (!nodeName) {
-    throw new Error('Failed to determine node name')
-  }
-  return nodeName
-}
-
 export function namespace(): string {
  if (process.env['ACTIONS_RUNNER_KUBERNETES_NAMESPACE']) {
    return process.env['ACTIONS_RUNNER_KUBERNETES_NAMESPACE']
@@ -554,6 +551,39 @@ export function namespace(): string {
  return context.namespace
 }

+async function getCurrentNodeName(): Promise<string> {
+  const resp = await k8sApi.readNamespacedPod({
+    name: getRunnerPodName(),
+    namespace: namespace()
+  })
+
+  const nodeName = resp.spec?.nodeName
+  if (!nodeName) {
+    throw new Error('Failed to determine node name')
+  }
+  return nodeName
+}
+
+async function getPodAffinity(nodeName: string): Promise<k8s.V1Affinity> {
+  const affinity = new k8s.V1Affinity()
+  affinity.nodeAffinity = new k8s.V1NodeAffinity()
+  affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution =
+    new k8s.V1NodeSelector()
+  affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms =
+    [
+      {
+        matchExpressions: [
+          {
+            key: 'kubernetes.io/hostname',
+            operator: 'In',
+            values: [nodeName]
+          }
+        ]
+      }
+    ]
+  return affinity
+}
+
 class BackOffManager {
  private backOffSeconds = 1
  totalTime = 0
@@ -622,7 +652,9 @@ export function containerPorts(
  return ports
 }

-export async function getPodByName(name): Promise<k8s.V1Pod> {
-  const { body } = await k8sApi.readNamespacedPod(name, namespace())
-  return body
+export async function getPodByName(name: string): Promise<k8s.V1Pod> {
+  return await k8sApi.readNamespacedPod({
+    name,
+    namespace: namespace()
+  })
 }
@@ -2,18 +2,19 @@ import * as k8s from '@kubernetes/client-node'
 import * as fs from 'fs'
 import * as yaml from 'js-yaml'
 import * as core from '@actions/core'
-import { Mount } from 'hooklib'
-import * as path from 'path'
 import { v1 as uuidv4 } from 'uuid'
-import { POD_VOLUME_NAME } from './index'
 import { CONTAINER_EXTENSION_PREFIX } from '../hooks/constants'
 import * as shlex from 'shlex'
+import { Mount } from 'hooklib'
+import * as path from 'path'
+import { POD_VOLUME_NAME } from './index'

 export const DEFAULT_CONTAINER_ENTRY_POINT_ARGS = [`-f`, `/dev/null`]
 export const DEFAULT_CONTAINER_ENTRY_POINT = 'tail'

 export const ENV_HOOK_TEMPLATE_PATH = 'ACTIONS_RUNNER_CONTAINER_HOOK_TEMPLATE'
-export const ENV_USE_KUBE_SCHEDULER = 'ACTIONS_RUNNER_USE_KUBE_SCHEDULER'
+export const ENV_DISABLE_KUBE_SCHEDULER =
+  'ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER'

 export function containerVolumes(
  userMountVolumes: Mount[] = [],
@@ -42,6 +43,11 @@ export function containerVolumes(
        mountPath: '/github/file_commands',
        subPath: '_temp/_runner_file_commands'
      },
+      {
+        name: POD_VOLUME_NAME,
+        mountPath: '/github/home',
+        subPath: '_temp/_github_home'
+      },
      {
        name: POD_VOLUME_NAME,
        mountPath: '/github/workflow',
@@ -85,7 +91,6 @@ export function containerVolumes(
          'Volume mounts outside of the work folder are not supported'
        )
      }
-      // source volume path should be relative path
      sourceVolumePath = userVolume.sourceVolumePath.slice(
        workspacePath.length + 1
      )
@@ -104,12 +109,66 @@ export function containerVolumes(
  return mounts
 }

+export function prepareJobScript(userVolumeMounts: Mount[]): {
+  containerPath: string
+  runnerPath: string
+} {
+  let mountDirs = userVolumeMounts.map(m => m.targetVolumePath).join(' ')
+
+  const content = `#!/bin/sh -l
+set -e
+cp -R /__w/_temp/_github_home /github/home
+cp -R /__w/_temp/_github_workflow /github/workflow
+mkdir -p ${mountDirs}
+`
+
+  const filename = `${uuidv4()}.sh`
+  const entryPointPath = `${process.env.RUNNER_TEMP}/${filename}`
+  fs.writeFileSync(entryPointPath, content)
+  return {
+    containerPath: `/__w/_temp/${filename}`,
+    runnerPath: entryPointPath
+  }
+}
+
 export function writeEntryPointScript(
  workingDirectory: string,
  entryPoint: string,
  entryPointArgs?: string[],
  prependPath?: string[],
  environmentVariables?: { [key: string]: string }
+): { containerPath: string; runnerPath: string } {
+  let exportPath = ''
+  if (prependPath?.length) {
+    const prepend =
+      typeof prependPath === 'string' ? prependPath : prependPath.join(':')
+    exportPath = `export PATH=${prepend}:$PATH`
+  }
+
+  const environmentPrefix = scriptEnv(environmentVariables)
+
+  const content = `#!/bin/sh -l
+${exportPath}
+cd ${workingDirectory} && \\
+exec ${environmentPrefix} ${entryPoint} ${
+    entryPointArgs?.length ? entryPointArgs.join(' ') : ''
+  }
+`
+  const filename = `${uuidv4()}.sh`
+  const entryPointPath = `${process.env.RUNNER_TEMP}/${filename}`
+  fs.writeFileSync(entryPointPath, content)
+  return {
+    containerPath: `/__w/_temp/${filename}`,
+    runnerPath: entryPointPath
+  }
+}
+
+export function writeRunScript(
+  workingDirectory: string,
+  entryPoint: string,
+  entryPointArgs?: string[],
+  prependPath?: string[],
+  environmentVariables?: { [key: string]: string }
 ): { containerPath: string; runnerPath: string } {
  let exportPath = ''
  if (prependPath?.length) {
@@ -118,33 +177,12 @@ export function writeEntryPointScript(
      typeof prependPath === 'string' ? prependPath : prependPath.join(':')
    exportPath = `export PATH=${prepend}:$PATH`
  }
-  let environmentPrefix = ''

-  if (environmentVariables && Object.entries(environmentVariables).length) {
-    const envBuffer: string[] = []
-    for (const [key, value] of Object.entries(environmentVariables)) {
-      if (
-        key.includes(`=`) ||
-        key.includes(`'`) ||
-        key.includes(`"`) ||
-        key.includes(`$`)
-      ) {
-        throw new Error(
-          `environment key ${key} is invalid - the key must not contain =, $, ', or "`
-        )
-      }
-      envBuffer.push(
-        `"${key}=${value
-          .replace(/\\/g, '\\\\')
-          .replace(/"/g, '\\"')
-          .replace(/\$/g, '\\$')
-          .replace(/`/g, '\\`')}"`
-      )
-    }
-    environmentPrefix = `env ${envBuffer.join(' ')} `
-  }
+  let environmentPrefix = scriptEnv(environmentVariables)

  const content = `#!/bin/sh -l
+set -e
+rm "$0" # remove script after running
 ${exportPath}
 cd ${workingDirectory} && \
 exec ${environmentPrefix} ${entryPoint} ${
@@ -160,9 +198,76 @@ exec ${environmentPrefix} ${entryPoint} ${
  }
 }

+export function writeContainerStepScript(
+  dst: string,
+  workingDirectory: string,
+  entryPoint: string,
+  entryPointArgs?: string[],
+  environmentVariables?: { [key: string]: string }
+): { containerPath: string; runnerPath: string } {
+  let environmentPrefix = scriptEnv(environmentVariables)
+
+  const parts = workingDirectory.split('/').slice(-2)
+  if (parts.length !== 2) {
+    throw new Error(`Invalid working directory: ${workingDirectory}`)
+  }
+
+  const content = `#!/bin/sh -l
+rm "$0" # remove script after running
+mv /__w/_temp/_github_home /github/home && \
+mv /__w/_temp/_github_workflow /github/workflow && \
+mv /__w/_temp/_runner_file_commands /github/file_commands || true && \
+mv /__w/${parts.join('/')}/ /github/workspace && \
+cd /github/workspace && \
+exec ${environmentPrefix} ${entryPoint} ${
+    entryPointArgs?.length ? entryPointArgs.join(' ') : ''
+  }
+`
+  const filename = `${uuidv4()}.sh`
+  const entryPointPath = `${dst}/${filename}`
+  core.debug(`Writing container step script to ${entryPointPath}`)
+  fs.writeFileSync(entryPointPath, content)
+  return {
+    containerPath: `/__w/_temp/${filename}`,
+    runnerPath: entryPointPath
+  }
+}
+
+function scriptEnv(envs?: { [key: string]: string }): string {
+  if (!envs || !Object.entries(envs).length) {
+    return ''
+  }
+  const envBuffer: string[] = []
+  for (const [key, value] of Object.entries(envs)) {
+    if (
+      key.includes(`=`) ||
+      key.includes(`'`) ||
+      key.includes(`"`) ||
+      key.includes(`$`)
+    ) {
+      throw new Error(
+        `environment key ${key} is invalid - the key must not contain =, $, ', or "`
+      )
+    }
+    envBuffer.push(
+      `"${key}=${value
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\$/g, '\\$')
+        .replace(/`/g, '\\`')}"`
+    )
+  }
+
+  if (!envBuffer?.length) {
+    return ''
+  }
+
+  return `env ${envBuffer.join(' ')} `
+}
+
 export function generateContainerName(image: string): string {
  const nameWithTag = image.split('/').pop()
-  const name = nameWithTag?.split(':').at(0)
+  const name = nameWithTag?.split(':')[0]

  if (!name) {
    throw new Error(`Image definition '${image}' is invalid`)
@@ -270,7 +375,7 @@ export function readExtensionFromFile(): k8s.V1PodTemplateSpec | undefined {
 }

 export function useKubeScheduler(): boolean {
-  return process.env[ENV_USE_KUBE_SCHEDULER] === 'true'
+  return process.env[ENV_DISABLE_KUBE_SCHEDULER] !== 'true'
 }

 export enum PodPhase {
@@ -3,6 +3,7 @@ import { cleanupJob, prepareJob } from '../src/hooks'
 import { RunnerInstanceLabel } from '../src/hooks/constants'
 import { namespace } from '../src/k8s'
 import { TestHelper } from './test-setup'
+import { PrepareJobArgs } from 'hooklib'

 let testHelper: TestHelper

@@ -14,7 +15,10 @@ describe('Cleanup Job', () => {
    const prepareJobOutputFilePath = testHelper.createFile(
      'prepare-job-output.json'
    )
-    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+    await prepareJob(
+      prepareJobData.args as PrepareJobArgs,
+      prepareJobOutputFilePath
+    )
  })

  afterEach(async () => {
@@ -32,16 +36,12 @@ describe('Cleanup Job', () => {
    kc.loadFromDefault()
    const k8sApi = kc.makeApiClient(k8s.CoreV1Api)

-    const podList = await k8sApi.listNamespacedPod(
-      namespace(),
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      new RunnerInstanceLabel().toString()
-    )
+    const podList = await k8sApi.listNamespacedPod({
+      namespace: namespace(),
+      labelSelector: new RunnerInstanceLabel().toString()
+    })

-    expect(podList.body.items.length).toBe(0)
+    expect(podList.items.length).toBe(0)
  })

  it('should have no runner linked secrets', async () => {
@@ -51,15 +51,11 @@ describe('Cleanup Job', () => {
    kc.loadFromDefault()
    const k8sApi = kc.makeApiClient(k8s.CoreV1Api)

-    const secretList = await k8sApi.listNamespacedSecret(
-      namespace(),
-      undefined,
-      undefined,
-      undefined,
-      undefined,
-      new RunnerInstanceLabel().toString()
-    )
+    const secretList = await k8sApi.listNamespacedSecret({
+      namespace: namespace(),
+      labelSelector: new RunnerInstanceLabel().toString()
+    })

-    expect(secretList.body.items.length).toBe(0)
+    expect(secretList.items.length).toBe(0)
  })
 })
@@ -6,6 +6,7 @@ import {
  runScriptStep
 } from '../src/hooks'
 import { TestHelper } from './test-setup'
+import { RunContainerStepArgs, RunScriptStepArgs } from 'hooklib'

 jest.useRealTimers()

@@ -25,6 +26,7 @@ describe('e2e', () => {
  afterEach(async () => {
    await testHelper.cleanup()
  })
+
  it('should prepare job, run script step, run container step then cleanup without errors', async () => {
    await expect(
      prepareJob(prepareJobData.args, prepareJobOutputFilePath)
@@ -36,13 +38,16 @@ describe('e2e', () => {
    const prepareJobOutputData = JSON.parse(prepareJobOutputJson.toString())

    await expect(
-      runScriptStep(scriptStepData.args, prepareJobOutputData.state, null)
+      runScriptStep(
+        scriptStepData.args as RunScriptStepArgs,
+        prepareJobOutputData.state
+      )
    ).resolves.not.toThrow()

    const runContainerStepData = testHelper.getRunContainerStepDefinition()

    await expect(
-      runContainerStep(runContainerStepData.args)
+      runContainerStep(runContainerStepData.args as RunContainerStepArgs)
    ).resolves.not.toThrow()

    await expect(cleanupJob()).resolves.not.toThrow()
@@ -1,9 +1,8 @@
 import * as fs from 'fs'
-import { containerPorts, POD_VOLUME_NAME } from '../src/k8s'
+import { containerPorts } from '../src/k8s'
 import {
-  containerVolumes,
  generateContainerName,
-  writeEntryPointScript,
+  writeRunScript,
  mergePodSpecWithOptions,
  mergeContainerWithOptions,
  readExtensionFromFile,
@@ -27,91 +26,55 @@ describe('k8s utils', () => {

    it('should not throw', () => {
      expect(() =>
-        writeEntryPointScript(
-          '/test',
-          'sh',
-          ['-e', 'script.sh'],
-          ['/prepend/path'],
-          {
-            SOME_ENV: 'SOME_VALUE'
-          }
-        )
+        writeRunScript('/test', 'sh', ['-e', 'script.sh'], ['/prepend/path'], {
+          SOME_ENV: 'SOME_VALUE'
+        })
      ).not.toThrow()
    })

    it('should throw if RUNNER_TEMP is not set', () => {
      delete process.env.RUNNER_TEMP
      expect(() =>
-        writeEntryPointScript(
-          '/test',
-          'sh',
-          ['-e', 'script.sh'],
-          ['/prepend/path'],
-          {
-            SOME_ENV: 'SOME_VALUE'
-          }
-        )
+        writeRunScript('/test', 'sh', ['-e', 'script.sh'], ['/prepend/path'], {
+          SOME_ENV: 'SOME_VALUE'
+        })
      ).toThrow()
    })

    it('should throw if environment variable name contains double quote', () => {
      expect(() =>
-        writeEntryPointScript(
-          '/test',
-          'sh',
-          ['-e', 'script.sh'],
-          ['/prepend/path'],
-          {
-            'SOME"_ENV': 'SOME_VALUE'
-          }
-        )
+        writeRunScript('/test', 'sh', ['-e', 'script.sh'], ['/prepend/path'], {
+          'SOME"_ENV': 'SOME_VALUE'
+        })
      ).toThrow()
    })

    it('should throw if environment variable name contains =', () => {
      expect(() =>
-        writeEntryPointScript(
-          '/test',
-          'sh',
-          ['-e', 'script.sh'],
-          ['/prepend/path'],
-          {
-            'SOME=ENV': 'SOME_VALUE'
-          }
-        )
+        writeRunScript('/test', 'sh', ['-e', 'script.sh'], ['/prepend/path'], {
+          'SOME=ENV': 'SOME_VALUE'
+        })
      ).toThrow()
    })

    it('should throw if environment variable name contains single quote', () => {
      expect(() =>
-        writeEntryPointScript(
-          '/test',
-          'sh',
-          ['-e', 'script.sh'],
-          ['/prepend/path'],
-          {
-            "SOME'_ENV": 'SOME_VALUE'
-          }
-        )
+        writeRunScript('/test', 'sh', ['-e', 'script.sh'], ['/prepend/path'], {
+          "SOME'_ENV": 'SOME_VALUE'
+        })
      ).toThrow()
    })

    it('should throw if environment variable name contains dollar', () => {
      expect(() =>
-        writeEntryPointScript(
-          '/test',
-          'sh',
-          ['-e', 'script.sh'],
-          ['/prepend/path'],
-          {
-            SOME_$_ENV: 'SOME_VALUE'
-          }
-        )
+        writeRunScript('/test', 'sh', ['-e', 'script.sh'], ['/prepend/path'], {
+          SOME_$_ENV: 'SOME_VALUE'
+        })
      ).toThrow()
    })

    it('should escape double quote, dollar and backslash in environment variable values', () => {
-      const { runnerPath } = writeEntryPointScript(
+      const { runnerPath } = writeRunScript(
        '/test',
        'sh',
        ['-e', 'script.sh'],
@@ -130,7 +93,7 @@ describe('k8s utils', () => {
    })

    it('should return object with containerPath and runnerPath', () => {
-      const { containerPath, runnerPath } = writeEntryPointScript(
+      const { containerPath, runnerPath } = writeRunScript(
        '/test',
        'sh',
        ['-e', 'script.sh'],
@@ -145,7 +108,7 @@ describe('k8s utils', () => {
    })

    it('should write entrypoint path and the file should exist', () => {
-      const { runnerPath } = writeEntryPointScript(
+      const { runnerPath } = writeRunScript(
        '/test',
        'sh',
        ['-e', 'script.sh'],
@@ -168,88 +131,6 @@ describe('k8s utils', () => {
      await testHelper.cleanup()
    })

-    it('should throw if container action and GITHUB_WORKSPACE env is not set', () => {
-      delete process.env.GITHUB_WORKSPACE
-      expect(() => containerVolumes([], true, true)).toThrow()
-      expect(() => containerVolumes([], false, true)).toThrow()
-    })
-
-    it('should always have work mount', () => {
-      let volumes = containerVolumes([], true, true)
-      expect(volumes.find(e => e.mountPath === '/__w')).toBeTruthy()
-      volumes = containerVolumes([], true, false)
-      expect(volumes.find(e => e.mountPath === '/__w')).toBeTruthy()
-      volumes = containerVolumes([], false, true)
-      expect(volumes.find(e => e.mountPath === '/__w')).toBeTruthy()
-      volumes = containerVolumes([], false, false)
-      expect(volumes.find(e => e.mountPath === '/__w')).toBeTruthy()
-    })
-
-    it('should always have /github/workflow mount if working on container job or container action', () => {
-      let volumes = containerVolumes([], true, true)
-      expect(volumes.find(e => e.mountPath === '/github/workflow')).toBeTruthy()
-      volumes = containerVolumes([], true, false)
-      expect(volumes.find(e => e.mountPath === '/github/workflow')).toBeTruthy()
-      volumes = containerVolumes([], false, true)
-      expect(volumes.find(e => e.mountPath === '/github/workflow')).toBeTruthy()
-
-      volumes = containerVolumes([], false, false)
-      expect(
-        volumes.find(e => e.mountPath === '/github/workflow')
-      ).toBeUndefined()
-    })
-
-    it('should have container action volumes', () => {
-      let volumes = containerVolumes([], true, true)
-      let workspace = volumes.find(e => e.mountPath === '/github/workspace')
-      let fileCommands = volumes.find(
-        e => e.mountPath === '/github/file_commands'
-      )
-      expect(workspace).toBeTruthy()
-      expect(workspace?.subPath).toBe('repo/repo')
-      expect(fileCommands).toBeTruthy()
-      expect(fileCommands?.subPath).toBe('_temp/_runner_file_commands')
-
-      volumes = containerVolumes([], false, true)
-      workspace = volumes.find(e => e.mountPath === '/github/workspace')
-      fileCommands = volumes.find(e => e.mountPath === '/github/file_commands')
-      expect(workspace).toBeTruthy()
-      expect(workspace?.subPath).toBe('repo/repo')
-      expect(fileCommands).toBeTruthy()
-      expect(fileCommands?.subPath).toBe('_temp/_runner_file_commands')
-    })
-
-    it('should have externals, github home mounts if job container', () => {
-      const volumes = containerVolumes()
-      expect(volumes.find(e => e.mountPath === '/__e')).toBeTruthy()
-      expect(volumes.find(e => e.mountPath === '/github/home')).toBeTruthy()
-    })
-
-    it('should throw if user volume source volume path is not in workspace', () => {
-      expect(() =>
-        containerVolumes(
-          [
-            {
-              sourceVolumePath: '/outside/of/workdir'
-            }
-          ],
-          true,
-          false
-        )
-      ).toThrow()
-    })
-
-    it(`all volumes should have name ${POD_VOLUME_NAME}`, () => {
-      let volumes = containerVolumes([], true, true)
-      expect(volumes.every(e => e.name === POD_VOLUME_NAME)).toBeTruthy()
-      volumes = containerVolumes([], true, false)
-      expect(volumes.every(e => e.name === POD_VOLUME_NAME)).toBeTruthy()
-      volumes = containerVolumes([], false, true)
-      expect(volumes.every(e => e.name === POD_VOLUME_NAME)).toBeTruthy()
-      volumes = containerVolumes([], false, false)
-      expect(volumes.every(e => e.name === POD_VOLUME_NAME)).toBeTruthy()
-    })
-
    it('should parse container ports', () => {
      const tt = [
        {
@@ -394,7 +275,7 @@ metadata:
 spec:
  containers:
    - name: test
-      image: node:14.16
+      image: node:22
    - name: job
      image: ubuntu:latest`
      )
@@ -407,7 +288,7 @@ spec:

  it('should merge container spec', () => {
    const base = {
-      image: 'node:14.16',
+      image: 'node:22',
      name: 'test',
      env: [
        {
@@ -462,7 +343,7 @@ spec:
    const base = {
      containers: [
        {
-          image: 'node:14.16',
+          image: 'node:22',
          name: 'test',
          env: [
            {
@@ -3,15 +3,9 @@ import * as path from 'path'
 import { cleanupJob } from '../src/hooks'
 import { createContainerSpec, prepareJob } from '../src/hooks/prepare-job'
 import { TestHelper } from './test-setup'
-import {
-  ENV_HOOK_TEMPLATE_PATH,
-  ENV_USE_KUBE_SCHEDULER,
-  generateContainerName,
-  readExtensionFromFile
-} from '../src/k8s/utils'
-import { getPodByName } from '../src/k8s'
+import { ENV_HOOK_TEMPLATE_PATH, generateContainerName } from '../src/k8s/utils'
+import { execPodStep, getPodByName } from '../src/k8s'
 import { V1Container } from '@kubernetes/client-node'
-import * as yaml from 'js-yaml'
 import { JOB_CONTAINER_NAME } from '../src/hooks/constants'

 jest.useRealTimers()
@@ -47,32 +41,82 @@ describe('Prepare job', () => {
  })

  it('should prepare job with absolute path for userVolumeMount', async () => {
+    const userVolumeMount = path.join(
+      process.env.GITHUB_WORKSPACE as string,
+      'myvolume'
+    )
+    fs.mkdirSync(userVolumeMount, { recursive: true })
+    fs.writeFileSync(path.join(userVolumeMount, 'file.txt'), 'hello')
    prepareJobData.args.container.userMountVolumes = [
      {
-        sourceVolumePath: path.join(
-          process.env.GITHUB_WORKSPACE as string,
-          '/myvolume'
-        ),
-        targetVolumePath: '/volume_mount',
+        sourceVolumePath: userVolumeMount,
+        targetVolumePath: '/__w/myvolume',
        readOnly: false
      }
    ]
    await expect(
      prepareJob(prepareJobData.args, prepareJobOutputFilePath)
    ).resolves.not.toThrow()
+
+    const content = JSON.parse(
+      fs.readFileSync(prepareJobOutputFilePath).toString()
+    )
+
+    await execPodStep(
+      ['sh', '-c', '[ "$(cat /__w/myvolume/file.txt)" = "hello" ] || exit 5'],
+      content!.state!.jobPod,
+      JOB_CONTAINER_NAME
+    ).then(output => {
+      expect(output).toBe(0)
+    })
  })

-  it('should throw an exception if the user volume mount is absolute path outside of GITHUB_WORKSPACE', async () => {
-    prepareJobData.args.container.userMountVolumes = [
-      {
-        sourceVolumePath: '/somewhere/not/in/gh-workspace',
-        targetVolumePath: '/containermount',
-        readOnly: false
-      }
-    ]
-    await expect(
-      prepareJob(prepareJobData.args, prepareJobOutputFilePath)
-    ).rejects.toThrow()
+  it('should prepare job with envs CI and GITHUB_ACTIONS', async () => {
+    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+
+    const content = JSON.parse(
+      fs.readFileSync(prepareJobOutputFilePath).toString()
+    )
+
+    const got = await getPodByName(content.state.jobPod)
+    expect(got.spec?.containers[0].env).toEqual(
+      expect.arrayContaining([
+        { name: 'CI', value: 'true' },
+        { name: 'GITHUB_ACTIONS', value: 'true' }
+      ])
+    )
+    expect(got.spec?.containers[1].env).toEqual(
+      expect.arrayContaining([
+        { name: 'CI', value: 'true' },
+        { name: 'GITHUB_ACTIONS', value: 'true' }
+      ])
+    )
+  })
+
+  it('should not override CI env var if already set', async () => {
+    prepareJobData.args.container.environmentVariables = {
+      CI: 'false'
+    }
+
+    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+
+    const content = JSON.parse(
+      fs.readFileSync(prepareJobOutputFilePath).toString()
+    )
+
+    const got = await getPodByName(content.state.jobPod)
+    expect(got.spec?.containers[0].env).toEqual(
+      expect.arrayContaining([
+        { name: 'CI', value: 'false' },
+        { name: 'GITHUB_ACTIONS', value: 'true' }
+      ])
+    )
+    expect(got.spec?.containers[1].env).toEqual(
+      expect.arrayContaining([
+        { name: 'CI', value: 'true' },
+        { name: 'GITHUB_ACTIONS', value: 'true' }
+      ])
+    )
  })

  it('should not run prepare job without the job container', async () => {
@@ -120,12 +164,11 @@ describe('Prepare job', () => {

    expect(got.metadata?.annotations?.['annotated-by']).toBe('extension')
    expect(got.metadata?.labels?.['labeled-by']).toBe('extension')
-    expect(got.spec?.securityContext?.runAsUser).toBe(1000)
-    expect(got.spec?.securityContext?.runAsGroup).toBe(3000)
+    expect(got.spec?.restartPolicy).toBe('Never')

    // job container
    expect(got.spec?.containers[0].name).toBe(JOB_CONTAINER_NAME)
-    expect(got.spec?.containers[0].image).toBe('node:14.16')
+    expect(got.spec?.containers[0].image).toBe('node:22')
    expect(got.spec?.containers[0].command).toEqual(['sh'])
    expect(got.spec?.containers[0].args).toEqual(['-c', 'sleep 50'])

@@ -133,9 +176,13 @@ describe('Prepare job', () => {
    expect(got.spec?.containers[1].image).toBe('redis')
    expect(got.spec?.containers[1].command).toBeFalsy()
    expect(got.spec?.containers[1].args).toBeFalsy()
-    expect(got.spec?.containers[1].env).toEqual([
-      { name: 'ENV2', value: 'value2' }
-    ])
+    expect(got.spec?.containers[1].env).toEqual(
+      expect.arrayContaining([
+        { name: 'CI', value: 'true' },
+        { name: 'GITHUB_ACTIONS', value: 'true' },
+        { name: 'ENV2', value: 'value2' }
+      ])
+    )
    expect(got.spec?.containers[1].resources).toEqual({
      requests: { memory: '1Mi', cpu: '1' },
      limits: { memory: '1Gi', cpu: '2' }
@@ -167,17 +214,6 @@ describe('Prepare job', () => {
    expect(content.context.services.length).toBe(1)
  })

-  it('should not throw exception using kube scheduler', async () => {
-    // only for ReadWriteMany volumes or single node cluster
-    process.env[ENV_USE_KUBE_SCHEDULER] = 'true'
-
-    await expect(
-      prepareJob(prepareJobData.args, prepareJobOutputFilePath)
-    ).resolves.not.toThrow()
-
-    delete process.env[ENV_USE_KUBE_SCHEDULER]
-  })
-
  test.each([undefined, null, []])(
    'should not throw exception when portMapping=%p',
    async pm => {
@@ -191,4 +227,20 @@ describe('Prepare job', () => {
      expect(() => content.context.services[0].image).not.toThrow()
    }
  )
+
+  it('should prepare job with container with non-root user', async () => {
+    prepareJobData.args!.container!.image =
+      'ghcr.io/actions/actions-runner:latest' // known to use user 1001
+    await expect(
+      prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+    ).resolves.not.toThrow()
+
+    const content = JSON.parse(
+      fs.readFileSync(prepareJobOutputFilePath).toString()
+    )
+    expect(content.state.jobPod).toBeTruthy()
+    expect(content.context.container.image).toBe(
+      'ghcr.io/actions/actions-runner:latest'
+    )
+  })
 })
@@ -1,4 +1,4 @@
-import { runContainerStep } from '../src/hooks'
+import { prepareJob, runContainerStep } from '../src/hooks'
 import { TestHelper } from './test-setup'
 import { ENV_HOOK_TEMPLATE_PATH } from '../src/k8s/utils'
 import * as fs from 'fs'
@@ -10,11 +10,16 @@ jest.useRealTimers()
 let testHelper: TestHelper

 let runContainerStepData: any
+let prepareJobData: any
+let prepareJobOutputFilePath: string

 describe('Run container step', () => {
  beforeEach(async () => {
    testHelper = new TestHelper()
    await testHelper.initialize()
+    prepareJobData = testHelper.getPrepareJobDefinition()
+    prepareJobOutputFilePath = testHelper.createFile('prepare-job-output.json')
+    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
    runContainerStepData = testHelper.getRunContainerStepDefinition()
  })

@@ -22,11 +27,6 @@ describe('Run container step', () => {
    await testHelper.cleanup()
  })

-  it('should not throw', async () => {
-    const exitCode = await runContainerStep(runContainerStepData.args)
-    expect(exitCode).toBe(0)
-  })
-
  it('should run pod with extensions applied', async () => {
    const extension = {
      metadata: {
@@ -42,7 +42,7 @@ describe('Run container step', () => {
          {
            name: JOB_CONTAINER_EXTENSION_NAME,
            command: ['sh'],
-            args: ['-c', 'echo test']
+            args: ['-c', 'sleep 10000']
          },
          {
            name: 'side-container',
@@ -51,11 +51,7 @@ describe('Run container step', () => {
            args: ['-c', 'echo test']
          }
        ],
-        restartPolicy: 'Never',
-        securityContext: {
-          runAsUser: 1000,
-          runAsGroup: 3000
-        }
+        restartPolicy: 'Never'
      }
    }

@@ -78,4 +74,15 @@ describe('Run container step', () => {
      runContainerStep(runContainerStepData.args)
    ).resolves.not.toThrow()
  })
+
+  it('should run container step with envs CI and GITHUB_ACTIONS', async () => {
+    runContainerStepData.args.entryPoint = 'bash'
+    runContainerStepData.args.entryPointArgs = [
+      '-c',
+      "'if [[ -z $GITHUB_ACTIONS  ]] || [[ -z $CI ]]; then exit 1; fi'"
+    ]
+    await expect(
+      runContainerStep(runContainerStepData.args)
+    ).resolves.not.toThrow()
+  })
 })
@@ -1,6 +1,7 @@
 import * as fs from 'fs'
 import { cleanupJob, prepareJob, runScriptStep } from '../src/hooks'
 import { TestHelper } from './test-setup'
+import { PrepareJobArgs, RunScriptStepArgs } from 'hooklib'

 jest.useRealTimers()

@@ -8,7 +9,9 @@ let testHelper: TestHelper

 let prepareJobOutputData: any

-let runScriptStepDefinition
+let runScriptStepDefinition: {
+  args: RunScriptStepArgs
+}

 describe('Run script step', () => {
  beforeEach(async () => {
@@ -19,9 +22,14 @@ describe('Run script step', () => {
    )

    const prepareJobData = testHelper.getPrepareJobDefinition()
-    runScriptStepDefinition = testHelper.getRunScriptStepDefinition()
+    runScriptStepDefinition = testHelper.getRunScriptStepDefinition() as {
+      args: RunScriptStepArgs
+    }

-    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+    await prepareJob(
+      prepareJobData.args as PrepareJobArgs,
+      prepareJobOutputFilePath
+    )
    const outputContent = fs.readFileSync(prepareJobOutputFilePath)
    prepareJobOutputData = JSON.parse(outputContent.toString())
  })
@@ -37,22 +45,14 @@ describe('Run script step', () => {

  it('should not throw an exception', async () => {
    await expect(
-      runScriptStep(
-        runScriptStepDefinition.args,
-        prepareJobOutputData.state,
-        null
-      )
+      runScriptStep(runScriptStepDefinition.args, prepareJobOutputData.state)
    ).resolves.not.toThrow()
  })

  it('should fail if the working directory does not exist', async () => {
    runScriptStepDefinition.args.workingDirectory = '/foo/bar'
    await expect(
-      runScriptStep(
-        runScriptStepDefinition.args,
-        prepareJobOutputData.state,
-        null
-      )
+      runScriptStep(runScriptStepDefinition.args, prepareJobOutputData.state)
    ).rejects.toThrow()
  })

@@ -64,16 +64,12 @@ describe('Run script step', () => {
      "'if [[ -z $NODE_ENV ]]; then exit 1; fi'"
    ]
    await expect(
-      runScriptStep(
-        runScriptStepDefinition.args,
-        prepareJobOutputData.state,
-        null
-      )
+      runScriptStep(runScriptStepDefinition.args, prepareJobOutputData.state)
    ).resolves.not.toThrow()
  })

  it('Should have path variable changed in container with prepend path string', async () => {
-    runScriptStepDefinition.args.prependPath = '/some/path'
+    runScriptStepDefinition.args.prependPath = ['/some/path']
    runScriptStepDefinition.args.entryPoint = '/bin/bash'
    runScriptStepDefinition.args.entryPointArgs = [
      '-c',
@@ -81,11 +77,7 @@ describe('Run script step', () => {
    ]

    await expect(
-      runScriptStep(
-        runScriptStepDefinition.args,
-        prepareJobOutputData.state,
-        null
-      )
+      runScriptStep(runScriptStepDefinition.args, prepareJobOutputData.state)
    ).resolves.not.toThrow()
  })

@@ -103,11 +95,7 @@ describe('Run script step', () => {
    ]

    await expect(
-      runScriptStep(
-        runScriptStepDefinition.args,
-        prepareJobOutputData.state,
-        null
-      )
+      runScriptStep(runScriptStepDefinition.args, prepareJobOutputData.state)
    ).resolves.not.toThrow()
  })

@@ -122,11 +110,7 @@ describe('Run script step', () => {
    ]

    await expect(
-      runScriptStep(
-        runScriptStepDefinition.args,
-        prepareJobOutputData.state,
-        null
-      )
+      runScriptStep(runScriptStepDefinition.args, prepareJobOutputData.state)
    ).resolves.not.toThrow()
  })
 })
@@ -0,0 +1,137 @@
+import * as fs from 'fs'
+import { cleanupJob } from '../src/hooks'
+import { prepareJob } from '../src/hooks/prepare-job'
+import { TestHelper } from './test-setup'
+import { getPodByName } from '../src/k8s'
+import { ENV_DISABLE_KUBE_SCHEDULER } from '../src/k8s/utils'
+
+jest.useRealTimers()
+
+let testHelper: TestHelper
+let prepareJobData: any
+let prepareJobOutputFilePath: string
+
+describe('RWO Affinity Behavior (Scheduler Mode)', () => {
+  beforeEach(async () => {
+    testHelper = new TestHelper()
+    await testHelper.initialize()
+    prepareJobData = testHelper.getPrepareJobDefinition()
+    prepareJobOutputFilePath = testHelper.createFile('prepare-job-output.json')
+  })
+
+  afterEach(async () => {
+    await cleanupJob()
+    await testHelper.cleanup()
+    delete process.env[ENV_DISABLE_KUBE_SCHEDULER]
+  })
+
+  it('should add nodeAffinity with hostname selector by default', async () => {
+    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+
+    const content = JSON.parse(
+      fs.readFileSync(prepareJobOutputFilePath).toString()
+    )
+
+    const pod = await getPodByName(content.state.jobPod)
+
+    expect(pod.spec?.affinity).toBeDefined()
+    expect(pod.spec?.affinity?.nodeAffinity).toBeDefined()
+
+    const nodeAffinity = pod.spec?.affinity?.nodeAffinity
+    expect(
+      nodeAffinity?.requiredDuringSchedulingIgnoredDuringExecution
+    ).toBeDefined()
+
+    const nodeSelectorTerms =
+      nodeAffinity?.requiredDuringSchedulingIgnoredDuringExecution
+        ?.nodeSelectorTerms
+
+    expect(nodeSelectorTerms).toBeDefined()
+    expect(nodeSelectorTerms?.length).toBeGreaterThan(0)
+
+    const matchExpressions = nodeSelectorTerms?.[0].matchExpressions
+    expect(matchExpressions).toBeDefined()
+    expect(matchExpressions?.length).toBeGreaterThan(0)
+
+    const hostnameExpression = matchExpressions?.[0]
+    expect(hostnameExpression?.key).toBe('kubernetes.io/hostname')
+    expect(hostnameExpression?.operator).toBe('In')
+
+    expect(hostnameExpression?.values).toBeDefined()
+    expect(hostnameExpression?.values?.length).toBeGreaterThan(0)
+    expect(hostnameExpression?.values?.[0]).toBeTruthy()
+  })
+
+  it('should NOT add nodeAffinity when scheduler mode is disabled', async () => {
+    process.env[ENV_DISABLE_KUBE_SCHEDULER] = 'true'
+
+    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+
+    const content = JSON.parse(
+      fs.readFileSync(prepareJobOutputFilePath).toString()
+    )
+
+    const pod = await getPodByName(content.state.jobPod)
+
+    if (pod.spec?.affinity) {
+      expect(pod.spec.affinity.nodeAffinity).toBeUndefined()
+    }
+
+    expect(pod.spec?.nodeName).toBeDefined()
+  })
+
+  it('should fail assertion if affinity block is missing by default', async () => {
+    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+
+    const content = JSON.parse(
+      fs.readFileSync(prepareJobOutputFilePath).toString()
+    )
+
+    const pod = await getPodByName(content.state.jobPod)
+
+    expect(pod.spec?.affinity).toBeDefined()
+    expect(pod.spec?.affinity?.nodeAffinity).toBeDefined()
+    expect(
+      pod.spec?.affinity?.nodeAffinity
+        ?.requiredDuringSchedulingIgnoredDuringExecution
+    ).toBeDefined()
+
+    const nodeSelectorTerms =
+      pod.spec?.affinity?.nodeAffinity
+        ?.requiredDuringSchedulingIgnoredDuringExecution?.nodeSelectorTerms
+
+    expect(nodeSelectorTerms?.[0]?.matchExpressions?.[0]?.key).toBe(
+      'kubernetes.io/hostname'
+    )
+    expect(nodeSelectorTerms?.[0]?.matchExpressions?.[0]?.operator).toBe('In')
+    expect(
+      nodeSelectorTerms?.[0]?.matchExpressions?.[0]?.values?.length
+    ).toBeGreaterThan(0)
+  })
+
+  it('should use correct node name from runner pod in affinity values by default', async () => {
+    const runnerPodName = process.env.ACTIONS_RUNNER_POD_NAME
+
+    await prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+
+    const content = JSON.parse(
+      fs.readFileSync(prepareJobOutputFilePath).toString()
+    )
+
+    const jobPod = await getPodByName(content.state.jobPod)
+
+    const runnerPod = await getPodByName(runnerPodName!)
+
+    const affinityValues =
+      jobPod.spec?.affinity?.nodeAffinity
+        ?.requiredDuringSchedulingIgnoredDuringExecution?.nodeSelectorTerms?.[0]
+        ?.matchExpressions?.[0]?.values
+
+    expect(affinityValues).toBeDefined()
+    expect(affinityValues?.length).toBeGreaterThan(0)
+
+    if (runnerPod.spec?.nodeName) {
+      expect(affinityValues).toContain(runnerPod.spec.nodeName)
+    }
+  })
+})
@@ -0,0 +1,28 @@
+import {
+  isRWXTestEnabled,
+  getRWXStorageClass,
+  RWX_SKIP_MESSAGE
+} from './test-setup'
+
+describe('RWX Test Contract Demo', () => {
+  const describeOrSkip = isRWXTestEnabled() ? describe : describe.skip
+
+  describeOrSkip('RWX volume tests', () => {
+    it('should use RWX storage class when enabled', () => {
+      const storageClass = getRWXStorageClass()
+      expect(storageClass).toBeDefined()
+      expect(typeof storageClass).toBe('string')
+    })
+
+    it('should verify both env vars are required', () => {
+      expect(process.env.ACTIONS_RUNNER_K8S_TEST_ENABLE_RWX).toBe('true')
+      expect(
+        process.env.ACTIONS_RUNNER_K8S_TEST_RWX_STORAGE_CLASS
+      ).toBeDefined()
+    })
+  })
+
+  if (!isRWXTestEnabled()) {
+    it(RWX_SKIP_MESSAGE, () => {})
+  }
+})
@@ -0,0 +1,119 @@
+import * as k8s from '@kubernetes/client-node'
+import * as fs from 'fs'
+import { cleanupJob, prepareJob, runScriptStep } from '../src/hooks'
+import {
+  TestHelper,
+  isRWXTestEnabled,
+  getRWXStorageClass,
+  RWX_SKIP_MESSAGE
+} from './test-setup'
+import { RunScriptStepArgs } from 'hooklib'
+
+jest.useRealTimers()
+
+const kc = new k8s.KubeConfig()
+kc.loadFromDefault()
+const k8sApi = kc.makeApiClient(k8s.CoreV1Api)
+
+describe('RWX Volume Tests', () => {
+  const describeOrSkip = isRWXTestEnabled() ? describe : describe.skip
+
+  describeOrSkip('RWX volume integration', () => {
+    let testHelper: TestHelper
+    let rwxPvcName: string
+    let prepareJobData: any
+    let prepareJobOutputFilePath: string
+
+    beforeEach(async () => {
+      testHelper = new TestHelper()
+      await testHelper.initialize()
+
+      const podName = process.env.ACTIONS_RUNNER_POD_NAME
+      rwxPvcName = `${podName}-work-rwx`
+
+      const volumeClaim: k8s.V1PersistentVolumeClaim = {
+        metadata: {
+          name: rwxPvcName
+        },
+        spec: {
+          accessModes: ['ReadWriteMany'],
+          volumeMode: 'Filesystem',
+          storageClassName: getRWXStorageClass(),
+          resources: {
+            requests: {
+              storage: '1Gi'
+            }
+          }
+        }
+      }
+
+      await k8sApi.createNamespacedPersistentVolumeClaim({
+        namespace: 'default',
+        body: volumeClaim
+      })
+
+      process.env.ACTIONS_RUNNER_CLAIM_NAME = rwxPvcName
+
+      prepareJobData = testHelper.getPrepareJobDefinition()
+      prepareJobOutputFilePath = testHelper.createFile(
+        'prepare-job-output.json'
+      )
+    })
+
+    afterAll(async () => {
+      if (rwxPvcName) {
+        try {
+          await k8sApi.deleteNamespacedPersistentVolumeClaim({
+            name: rwxPvcName,
+            namespace: 'default'
+          })
+        } catch {
+          // Ignore cleanup errors - PVC may not exist
+        }
+      }
+    })
+
+    afterEach(async () => {
+      await testHelper.cleanup()
+    })
+
+    it('should successfully run hook flow with RWX volume', async () => {
+      await expect(
+        prepareJob(prepareJobData.args, prepareJobOutputFilePath)
+      ).resolves.not.toThrow()
+
+      const prepareJobOutputJson = fs.readFileSync(prepareJobOutputFilePath)
+      const prepareJobOutputData = JSON.parse(prepareJobOutputJson.toString())
+
+      const scriptStepData = testHelper.getRunScriptStepDefinition()
+
+      await expect(
+        runScriptStep(
+          scriptStepData.args as RunScriptStepArgs,
+          prepareJobOutputData.state
+        )
+      ).resolves.not.toThrow()
+
+      await expect(cleanupJob()).resolves.not.toThrow()
+    })
+
+    it('should verify RWX PVC was created with correct access mode', async () => {
+      const pvc = await k8sApi.readNamespacedPersistentVolumeClaim({
+        name: rwxPvcName,
+        namespace: 'default'
+      })
+
+      expect(pvc.spec?.accessModes).toContain('ReadWriteMany')
+      expect(pvc.spec?.storageClassName).toBe(getRWXStorageClass())
+      expect(pvc.spec?.volumeMode).toBe('Filesystem')
+    })
+
+    it('should verify RWX claim name is set correctly', () => {
+      expect(process.env.ACTIONS_RUNNER_CLAIM_NAME).toBe(rwxPvcName)
+    })
+  })
+
+  if (!isRWXTestEnabled()) {
+    it(RWX_SKIP_MESSAGE, () => {})
+  }
+})
@@ -14,25 +14,35 @@ const k8sStorageApi = kc.makeApiClient(k8s.StorageV1Api)
 export class TestHelper {
  private tempDirPath: string
  private podName: string
+  private runnerWorkdir: string
+  private runnerTemp: string
+
  constructor() {
    this.tempDirPath = `${__dirname}/_temp/runner`
+    this.runnerWorkdir = `${this.tempDirPath}/_work`
+    this.runnerTemp = `${this.tempDirPath}/_work/_temp`
    this.podName = uuidv4().replace(/-/g, '')
  }

-  public async initialize(): Promise<void> {
+  async initialize(): Promise<void> {
    process.env['ACTIONS_RUNNER_POD_NAME'] = `${this.podName}`
-    process.env['RUNNER_WORKSPACE'] = `${this.tempDirPath}/_work/repo`
-    process.env['RUNNER_TEMP'] = `${this.tempDirPath}/_work/_temp`
-    process.env['GITHUB_WORKSPACE'] = `${this.tempDirPath}/_work/repo/repo`
+    process.env['RUNNER_WORKSPACE'] = `${this.runnerWorkdir}/repo`
+    process.env['RUNNER_TEMP'] = `${this.runnerTemp}`
+    process.env['GITHUB_WORKSPACE'] = `${this.runnerWorkdir}/repo/repo`
    process.env['ACTIONS_RUNNER_KUBERNETES_NAMESPACE'] = 'default'

-    fs.mkdirSync(`${this.tempDirPath}/_work/repo/repo`, { recursive: true })
+    fs.mkdirSync(`${this.runnerWorkdir}/repo/repo`, { recursive: true })
    fs.mkdirSync(`${this.tempDirPath}/externals`, { recursive: true })
-    fs.mkdirSync(process.env.RUNNER_TEMP, { recursive: true })
+    fs.mkdirSync(this.runnerTemp, { recursive: true })
+    fs.mkdirSync(`${this.runnerTemp}/_github_workflow`, { recursive: true })
+    fs.mkdirSync(`${this.runnerTemp}/_github_home`, { recursive: true })
+    fs.mkdirSync(`${this.runnerTemp}/_runner_file_commands`, {
+      recursive: true
+    })

    fs.copyFileSync(
      path.resolve(`${__dirname}/../../../examples/example-script.sh`),
-      `${process.env.RUNNER_TEMP}/example-script.sh`
+      `${this.runnerTemp}/example-script.sh`
    )

    await this.cleanupK8sResources()
@@ -44,52 +54,80 @@ export class TestHelper {
    }
  }

-  public async cleanup(): Promise<void> {
+  async cleanup(): Promise<void> {
    try {
      await this.cleanupK8sResources()
      fs.rmSync(this.tempDirPath, { recursive: true })
-    } catch {}
+    } catch {
+      // Ignore errors during cleanup
+    }
  }
-  public async cleanupK8sResources() {
+
+  async cleanupK8sResources(): Promise<void> {
    await k8sApi
-      .deleteNamespacedPersistentVolumeClaim(
-        `${this.podName}-work`,
-        'default',
-        undefined,
-        undefined,
-        0
-      )
-      .catch(e => {})
-    await k8sApi.deletePersistentVolume(`${this.podName}-pv`).catch(e => {})
-    await k8sStorageApi.deleteStorageClass('local-storage').catch(e => {})
+      .deleteNamespacedPersistentVolumeClaim({
+        name: `${this.podName}-work`,
+        namespace: 'default',
+        gracePeriodSeconds: 0
+      })
+      .catch((e: k8s.ApiException<any>) => {
+        if (e.code !== 404) {
+          console.error(JSON.stringify(e))
+        }
+      })
    await k8sApi
-      .deleteNamespacedPod(this.podName, 'default', undefined, undefined, 0)
-      .catch(e => {})
+      .deletePersistentVolume({ name: `${this.podName}-pv` })
+      .catch((e: k8s.ApiException<any>) => {
+        if (e.code !== 404) {
+          console.error(JSON.stringify(e))
+        }
+      })
    await k8sApi
-      .deleteNamespacedPod(
-        `${this.podName}-workflow`,
-        'default',
-        undefined,
-        undefined,
-        0
-      )
-      .catch(e => {})
+      .deleteNamespacedPod({
+        name: this.podName,
+        namespace: 'default',
+        gracePeriodSeconds: 0
+      })
+      .catch((e: k8s.ApiException<any>) => {
+        if (e.code !== 404) {
+          console.error(JSON.stringify(e))
+        }
+      })
+    await k8sApi
+      .deleteNamespacedPod({
+        name: `${this.podName}-workflow`,
+        namespace: 'default',
+        gracePeriodSeconds: 0
+      })
+      .catch((e: k8s.ApiException<any>) => {
+        if (e.code !== 404) {
+          console.error(JSON.stringify(e))
+        }
+      })
+
+    await k8sStorageApi
+      .deleteStorageClass({ name: `${this.podName}-storage` })
+      .catch((e: k8s.ApiException<any>) => {
+        if (e.code !== 404) {
+          console.error(JSON.stringify(e))
+        }
+      })
  }
-  public createFile(fileName?: string): string {
+  createFile(fileName?: string): string {
    const filePath = `${this.tempDirPath}/${fileName || uuidv4()}`
    fs.writeFileSync(filePath, '')
    return filePath
  }

-  public removeFile(fileName: string): void {
+  removeFile(fileName: string): void {
    const filePath = `${this.tempDirPath}/${fileName}`
    fs.rmSync(filePath)
  }

-  public async createTestJobPod() {
+  async createTestJobPod(): Promise<void> {
    const container = {
-      name: 'nginx',
-      image: 'nginx:latest',
+      name: 'runner',
+      image: 'ghcr.io/actions/actions-runner:latest',
      imagePullPolicy: 'IfNotPresent'
    } as k8s.V1Container

@@ -99,28 +137,35 @@ export class TestHelper {
      },
      spec: {
        restartPolicy: 'Never',
-        containers: [container]
+        containers: [container],
+        securityContext: {
+          runAsUser: 1001,
+          runAsGroup: 1001,
+          fsGroup: 1001
+        }
      }
    } as k8s.V1Pod
-    await k8sApi.createNamespacedPod('default', pod)
+    await k8sApi.createNamespacedPod({ namespace: 'default', body: pod })
  }

-  public async createTestVolume() {
-    var sc: k8s.V1StorageClass = {
+  async createTestVolume(): Promise<void> {
+    const storageClassName = `${this.podName}-storage`
+
+    const sc: k8s.V1StorageClass = {
      metadata: {
-        name: 'local-storage'
+        name: storageClassName
      },
      provisioner: 'kubernetes.io/no-provisioner',
      volumeBindingMode: 'Immediate'
    }
-    await k8sStorageApi.createStorageClass(sc)
+    await k8sStorageApi.createStorageClass({ body: sc })

-    var volume: k8s.V1PersistentVolume = {
+    const volume: k8s.V1PersistentVolume = {
      metadata: {
        name: `${this.podName}-pv`
      },
      spec: {
-        storageClassName: 'local-storage',
+        storageClassName,
        capacity: {
          storage: '2Gi'
        },
@@ -131,15 +176,16 @@ export class TestHelper {
        }
      }
    }
-    await k8sApi.createPersistentVolume(volume)
-    var volumeClaim: k8s.V1PersistentVolumeClaim = {
+    await k8sApi.createPersistentVolume({ body: volume })
+
+    const volumeClaim: k8s.V1PersistentVolumeClaim = {
      metadata: {
        name: `${this.podName}-work`
      },
      spec: {
        accessModes: ['ReadWriteOnce'],
        volumeMode: 'Filesystem',
-        storageClassName: 'local-storage',
+        storageClassName,
        volumeName: `${this.podName}-pv`,
        resources: {
          requests: {
@@ -148,10 +194,13 @@ export class TestHelper {
        }
      }
    }
-    await k8sApi.createNamespacedPersistentVolumeClaim('default', volumeClaim)
+    await k8sApi.createNamespacedPersistentVolumeClaim({
+      namespace: 'default',
+      body: volumeClaim
+    })
  }

-  public getPrepareJobDefinition(): HookData {
+  getPrepareJobDefinition(): HookData {
    const prepareJob = JSON.parse(
      fs.readFileSync(
        path.resolve(__dirname + '/../../../examples/prepare-job.json'),
@@ -168,7 +217,7 @@ export class TestHelper {
    return prepareJob
  }

-  public getRunScriptStepDefinition(): HookData {
+  getRunScriptStepDefinition(): HookData {
    const runScriptStep = JSON.parse(
      fs.readFileSync(
        path.resolve(__dirname + '/../../../examples/run-script-step.json'),
@@ -180,7 +229,7 @@ export class TestHelper {
    return runScriptStep
  }

-  public getRunContainerStepDefinition(): HookData {
+  getRunContainerStepDefinition(): HookData {
    const runContainerStep = JSON.parse(
      fs.readFileSync(
        path.resolve(__dirname + '/../../../examples/run-container-step.json'),
@@ -194,3 +243,65 @@ export class TestHelper {
    return runContainerStep
  }
 }
+
+/**
+ * RWX Test Contract:
+ *
+ * Tests requiring ReadWriteMany (RWX) volumes MUST be gated by TWO environment variables:
+ * 1. ACTIONS_RUNNER_K8S_TEST_ENABLE_RWX=true (explicit opt-in)
+ * 2. ACTIONS_RUNNER_K8S_TEST_RWX_STORAGE_CLASS=<name> (storage class that supports RWX)
+ *
+ * If either variable is missing or ACTIONS_RUNNER_K8S_TEST_ENABLE_RWX is not "true",
+ * the test MUST be skipped with the exact message defined in this contract.
+ *
+ * This contract ensures:
+ * - RWX tests do not fail on clusters without RWX provisioners
+ * - Test requirements are explicit and documented
+ * - RWO affinity tests remain independent and always runnable
+ * - Skip behavior is deterministic (no dynamic cluster probing)
+ *
+ * Usage example:
+ * ```typescript
+ * import { isRWXTestEnabled, getRWXStorageClass, RWX_SKIP_MESSAGE } from './test-setup'
+ *
+ * describe('RWX Test Suite', () => {
+ *   const describeOrSkip = isRWXTestEnabled() ? describe : describe.skip
+ *
+ *   describeOrSkip('RWX volume tests', () => {
+ *     it('should test RWX functionality', async () => {
+ *       const storageClass = getRWXStorageClass()
+ *       // ... test code using storageClass
+ *     })
+ *   })
+ *
+ *   if (!isRWXTestEnabled()) {
+ *     it(RWX_SKIP_MESSAGE, () => {})
+ *   }
+ * })
+ * ```
+ */
+
+/**
+ * Checks if RWX tests should run based on environment variables.
+ * @returns true if both ACTIONS_RUNNER_K8S_TEST_ENABLE_RWX=true and ACTIONS_RUNNER_K8S_TEST_RWX_STORAGE_CLASS are set
+ */
+export function isRWXTestEnabled(): boolean {
+  const enabled = process.env.ACTIONS_RUNNER_K8S_TEST_ENABLE_RWX === 'true'
+  const storageClass = process.env.ACTIONS_RUNNER_K8S_TEST_RWX_STORAGE_CLASS
+  return enabled && !!storageClass
+}
+
+/**
+ * Gets the RWX storage class name from environment variable.
+ * @returns The storage class name, or undefined if not set
+ */
+export function getRWXStorageClass(): string | undefined {
+  return process.env.ACTIONS_RUNNER_K8S_TEST_RWX_STORAGE_CLASS
+}
+
+/**
+ * Skip message constant - DO NOT MODIFY
+ * This exact message must be used when skipping RWX tests
+ */
+export const RWX_SKIP_MESSAGE =
+  'RWX tests skipped: set ACTIONS_RUNNER_K8S_TEST_ENABLE_RWX=true and ACTIONS_RUNNER_K8S_TEST_RWX_STORAGE_CLASS'
@@ -5,7 +5,8 @@
      "outDir": "./lib",
      "rootDir": "./src"
    },
+    "esModuleInterop": true, /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */
    "include": [
-      "./src"
+      "src/**/*",
    ]
-  }
+}
@@ -0,0 +1,6 @@
+{
+  "compilerOptions": {
+    "allowJs": true
+  },
+  "extends": "./tsconfig.json"
+}
@@ -2,14 +2,20 @@

 ## Bugs

- Skip writing extension containers in output context file [#154]
+- Change command to remove sudo to fix fs-init initial container [#263]
+- Sort 'find' output before hashing for consistency [#267]
+- feat: check if required binaries are present [#272]
+- Allow non-root container [#264]
+- Improve validation checks after copying [#285]
+- Fix workingDir permissions issue by creating it within init container [#283]
+- Fix event.json not being copied to /github/workflow in kubernetes-novolume mode [#287]
+- Reduce the amount of data copied to the workflow pod [#293]
+- Overwrite runner file commands [#298]

 ## Misc

- Bump ws from 7.5.7 to 7.5.10 in /packages/docker [#170]
- Bump braces from 3.0.2 to 3.0.3 in /packages/docker [#171]
- Bump tar from 6.1.11 to 6.2.1 in /packages/k8s [#156]
-
+- Dependency updates [#276] [#277] [#278] [#279] [#304]
+- Group dependabot updates [#289]

 ## SHA-256 Checksums
Author	SHA1	Message	Date
Nikola JokicandSisyphus	9e78b267f6	refactor(k8s): invert scheduler env var to make affinity default Change ACTIONS_RUNNER_USE_KUBE_SCHEDULER to ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER to make affinity-based scheduling the first-class (default) implementation. Breaking Change: - OLD: Set ACTIONS_RUNNER_USE_KUBE_SCHEDULER=true to enable affinity (opt-in) - NEW: Affinity is enabled by default, set ACTIONS_RUNNER_DISABLE_KUBE_SCHEDULER=true to disable (opt-out) Code changes: - utils.ts: Rename constant and invert useKubeScheduler() logic - rwo-affinity-test.ts: Update tests to verify default affinity behavior - ADR 0135: Update to reflect opt-out model - README: Update guidance to reflect default behavior Co-authored-by: Sisyphus <[email protected]>	2026-04-23 00:23:47 +02:00
Nikola JokicandSisyphus	51a0a891f6	docs(adr,k8s): clarify RWX enables free scheduling, RWO requires affinity - RWX volumes allow job pods to be scheduled on any cluster node - RWO volumes require affinity to pin job pods to runner's node - Remove ACTIONS_RUNNER_USE_KUBE_SCHEDULER from RWX migration steps - Emphasize resource utilization benefits of RWX free scheduling Co-authored-by: Sisyphus <[email protected]>	2026-04-23 00:09:05 +02:00
Nikola Jokic	5d337ff96e	lint fmt	2026-04-22 22:59:40 +02:00
Nikola Jokic	4972708208	Ensure read write many first	2026-04-22 22:55:49 +02:00
tfhdddandGitHub	6ecda1d8ea	fix: Resolves the issue of inconsistent hash calculations between runner and workflow files. (#316 ) CodeQL / Analyze (javascript) (push) Has been cancelled Details	2026-02-13 22:47:15 +01:00
Nikola JokicandGitHub	d21e5b430e	Prepare 0.8.1 release (#311 ) * Prepare 0.8.1 release * setup node * Update releaseNotes.md	2026-02-04 11:13:03 +01:00
Nikola JokicandGitHub	d8d2e74810	Bump packages (#304 ) * Bump packages * bump exec	2026-01-15 21:21:58 +01:00
Will HopkinsandGitHub	5f5708a2b8	Overwrite runnner file commands (#298 )	2025-12-12 13:57:47 +01:00
Nikola Jokic GitHub Copilot	f8e1cae677	Reduce the amount of data copied to the workflow pod (#293 ) * run script copies back only runner file commands * wip * fix * fmt * user volume mount * try doing only file commands * typo * remove _temp_pre * Update packages/k8s/src/hooks/run-script-step.ts Co-authored-by: Copilot <[email protected]> * Update packages/k8s/src/hooks/run-script-step.ts Co-authored-by: Copilot <[email protected]> * better escape * no useless escapes --------- Co-authored-by: Copilot <[email protected]>	2025-12-10 21:49:35 +01:00
Nikola JokicandGitHub	996cc75daf	Group dependabot updates (#289 )	2025-12-10 21:49:27 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	adf5e34937	Bump js-yaml from 4.1.0 to 4.1.1 (#276 ) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-11-27 16:34:47 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	4041f8648c	Bump js-yaml from 4.1.0 to 4.1.1 in /packages/hooklib (#277 ) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-11-27 16:34:17 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	1f60eaf940	Bump glob from 10.4.5 to 10.5.0 in /packages/k8s (#278 ) Bumps [glob](https://github.com/isaacs/node-glob) from 10.4.5 to 10.5.0. - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](https://github.com/isaacs/node-glob/compare/v10.4.5...v10.5.0) --- updated-dependencies: - dependency-name: glob dependency-version: 10.5.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-11-27 16:34:01 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	c3d8e2ab20	Bump glob from 10.4.5 to 10.5.0 in /packages/docker (#279 ) Bumps [glob](https://github.com/isaacs/node-glob) from 10.4.5 to 10.5.0. - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](https://github.com/isaacs/node-glob/compare/v10.4.5...v10.5.0) --- updated-dependencies: - dependency-name: glob dependency-version: 10.5.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-11-27 16:33:39 +01:00
zarko-aandGitHub	3f829eef9e	Fix event.json not being copied to /github/workflow in kubernetes-novolume mode (#287 ) In run-script-step, the _temp directory was being copied to the workflow pod, but the _github_home and _github_workflow directories were not being moved from their temporary location to the /github directory structure where they are expected by GitHub Actions. This caused event.json to be missing at /github/workflow/event.json, breaking actions that depend on GITHUB_EVENT_PATH. The fix adds a setup step that copies _github_home and _github_workflow from /__w/_temp/ to /github/ after copying the temp directory to the pod, matching the behavior of run-container-step and prepareJobScript. Uses cp -r instead of symlinks to avoid symlink validation errors when copying files back from the pod to the runner.	2025-11-26 11:47:19 +01:00
zarko-a GitHub Copilot	011ffb284e	Fix workingDir permissions issue by creating it within init container (#283 ) * Fix workingDir permissions issue by creating it within init container * Apply suggestion from @Copilot Co-authored-by: Copilot <[email protected]> * rework init commands --------- Co-authored-by: Copilot <[email protected]>	2025-11-26 11:46:47 +01:00
Vincent Van OuytselandGitHub	0951cc73e4	Improve validation checks after copying (#285 ) * fix: calculate hash again after failure The hash from the source is calculated only once. The source hash is checked with the destination hash, but if the destination hash does not match, the destination match is calculated again. The problem is that if the source hash is incorrect, the check will keep failing because the source hash is never re-calculated. Now, in the event that the hashes do not match, the hash of the source and the destination are calculated again. * fix: use size instead of block size Previously the %b parameter was used with stat. This displays the block size of the file. We noticed that in some cases the block size of the source and the destination file could be slightly different. Since the source and target run in different containers, they can have different block sizes defined. If the block size did not match, the hash would also not match, even if the file content would be exactly the same. With this change, the block size is no longer used. Instead the actual size in bytes of the file is listed.	2025-11-24 16:14:02 +01:00
Nikola JokicandGitHub	15e808935c	Allow non-root container (#264 ) * Allow non-root container * format * add lint:fix and fix lint errors * fix tests and volume mounts	2025-11-21 14:44:29 +01:00
vvanouytsel-trendminerandGitHub	ad9cb43c31	feat: check if required binaries are present (#272 ) * feat: check if required binaries are present Previously the necessary binaries were copied over using the runner container. This lead to issues in case your main container was using the musl libc implementation. Instead of copying over any binaries, the initContainer now checks if the required binaries are present in the main container. * feat: get rid of the init container * fix: add _runner_file_commands * fix: do not fail if _runner_file_commands does not exist It seems that for container actions this directory does not exist.	2025-11-10 15:01:40 +01:00
zarko-aandGitHub	2934de33f8	Sort 'find' output before hashing for consistency (#267 ) * Sort 'find' output before hashing for consistency across different platforms * fix style issues	2025-11-04 12:06:36 +01:00
Jiang LongandGitHub	ea25fd1b3e	Change command to remove sudo to fix fs-init inital container (#263 ) * Change command to copy externals instead of move * fix: using only mv, remove sudo	2025-10-21 15:47:08 +02:00
Nikola Jokic GitHub Copilot	c03a5fb3c1	Prepare 0.8.0 release and bump dependencies once more (#256 ) * Prepare 0.8.0 release and bump dependencies once more * Update releaseNotes.md Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]>	2025-10-04 11:53:55 +02:00
Nikola Jokic GitHub Copilot DenisPalnitsky	96c35e7cc6	Remove dependency on the runner's volume (#244 ) * bump actions * experiment using init container to prepare working environment * rm script before continuing * fix * Update packages/k8s/src/hooks/run-script-step.ts Co-authored-by: Copilot <[email protected]> * leverage exec stat instead of printf * npm update * document the new constraint --------- Co-authored-by: DenisPalnitsky <[email protected]>	2025-10-02 16:23:07 +02:00
Nikola JokicandGitHub	c67938c536	bump actions (#254 )	2025-10-02 16:20:55 +02:00
Nikola Jokic GitHub Copilot	464be47642	Separate CI docker and k8s tests (#250 ) * Separate tests * Update .github/workflows/build.yaml Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]>	2025-09-24 19:18:35 +02:00
Nikola JokicandGitHub	74ce64c1d0	Update codeowners to reflect the same team from the ARC (#251 )	2025-09-24 12:40:42 -04:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	9a71a3a7e9	Bump brace-expansion from 1.1.11 to 1.1.12 (#238 ) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.11 to 1.1.12. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/1.1.11...v1.1.12) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-07-29 11:24:23 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	9a858922c8	Bump form-data from 4.0.3 to 4.0.4 in /packages/k8s (#239 ) Bumps [form-data](https://github.com/form-data/form-data) from 4.0.3 to 4.0.4. - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](https://github.com/form-data/form-data/compare/v4.0.3...v4.0.4) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-07-29 11:24:01 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	605551ff1c	Bump @eslint/plugin-kit from 0.3.3 to 0.3.4 (#240 ) Bumps [@eslint/plugin-kit](https://github.com/eslint/rewrite/tree/HEAD/packages/plugin-kit) from 0.3.3 to 0.3.4. - [Release notes](https://github.com/eslint/rewrite/releases) - [Changelog](https://github.com/eslint/rewrite/blob/main/packages/plugin-kit/CHANGELOG.md) - [Commits](https://github.com/eslint/rewrite/commits/plugin-kit-v0.3.4/packages/plugin-kit) --- updated-dependencies: - dependency-name: "@eslint/plugin-kit" dependency-version: 0.3.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-07-29 11:23:37 +02:00
name_snrlandGitHub	878781f9c4	docker: fix readOnly volumes in createContainer (#236 )	2025-07-29 11:12:01 +02:00
Nikola Jokic GitHub Rocio Montes	1e051b849b	Update codeowners (#237 ) * Update codeowners * Update CODEOWNERS Co-authored-by: Rocio Montes <[email protected]> --------- Co-authored-by: Rocio Montes <[email protected]>	2025-07-29 11:11:27 +02:00
Nikola JokicandGitHub	589414ea69	Bump all dependencies (#234 ) * Bump all dependencies * build and reformat * lint * format	2025-07-29 11:06:45 +02:00
Ben De St Paer-GotchandGitHub	dd4f7dae2c	Update README.md (#224 )	2025-06-05 14:03:29 +02:00
Nikola JokicandGitHub	7da5474a5d	Release 0.7.0 (#218 )	2025-04-17 12:34:48 +02:00
Nikola JokicandGitHub	375992cd31	Expose CI=true and GITHUB_ACTIONS env variables (#215 ) * Expose CI=true and GITHUB_ACTIONS env variables * fmt * revert the prettier and finish this * revert package-lock.json	2025-04-17 12:08:32 +02:00
Nikola JokicandGitHub	aae800a69b	bump node in tests to node 22 since node14 is quite old (#216 ) * bump node in tests to node 22 since node14 is quite old * change test contsants	2025-04-16 15:57:59 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	e47f9b8af4	Bump jsonpath-plus from 10.1.0 to 10.3.0 in /packages/k8s (#213 ) Bumps [jsonpath-plus](https://github.com/s3u/JSONPath) from 10.1.0 to 10.3.0. - [Release notes](https://github.com/s3u/JSONPath/releases) - [Changelog](https://github.com/JSONPath-Plus/JSONPath/blob/main/CHANGES.md) - [Commits](https://github.com/s3u/JSONPath/compare/v10.1.0...v10.3.0) --- updated-dependencies: - dependency-name: jsonpath-plus dependency-version: 10.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-15 14:25:32 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	54e14cb7f3	Bump braces from 3.0.2 to 3.0.3 in /packages/hooklib (#194 ) Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3. - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/braces/compare/3.0.2...3.0.3) --- updated-dependencies: - dependency-name: braces dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-14 14:37:19 +02:00
Grant BuskeyandGitHub	ef2229fc0b	feat(k8s): add /github/home to containerAction mounts and surface createSecretForEnvs errors #181 (#198 ) * feat: add /github/home to containerAction mounts #181 * fix: add debug logging for failed secret creations #181	2025-04-14 14:12:51 +02:00
Andre KlärnerandGitHub	88dc98f8ef	k8s: start logging from the beginning (#184 )	2025-04-14 14:03:05 +02:00
Joan Miquel LuqueandGitHub	b388518d40	feat(k8s): Use pod affinity when KubeScheduler is enabled #201 (#212 ) Signed-off-by: Joan Miquel Luque Oliver <[email protected]>	2025-04-14 13:36:21 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	7afb8f9323	Bump cross-spawn from 7.0.3 to 7.0.6 in /packages/k8s (#196 ) Bumps [cross-spawn](https://github.com/moxystudio/node-cross-spawn) from 7.0.3 to 7.0.6. - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](https://github.com/moxystudio/node-cross-spawn/compare/v7.0.3...v7.0.6) --- updated-dependencies: - dependency-name: cross-spawn dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-03-24 16:51:12 +01:00
Robin BobbittandGitHub	d4c5425b22	support alternative network modes (#209 )	2025-03-24 16:33:43 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	120636d3d7	Bump ws from 7.5.8 to 7.5.10 in /packages/k8s (#192 ) Bumps [ws](https://github.com/websockets/ws) from 7.5.8 to 7.5.10. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](https://github.com/websockets/ws/compare/7.5.8...7.5.10) --- updated-dependencies: - dependency-name: ws dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-06 11:41:28 -05:00
Josh GrossandGitHub	5e805a0546	Remove dependency on deprecated release actions (#193 ) * Update to the latest available actions * Remove dependency on deprecated release actions * Add release workflow fixes from testing	2024-11-06 11:41:09 -05:00
Josh GrossandGitHub	27bae0b2b7	Update to the latest available actions (#191 )	2024-11-06 11:18:49 -05:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	8eed1ad1b6	Bump jsonpath-plus and @kubernetes/client-node in /packages/k8s (#187 ) Bumps [jsonpath-plus](https://github.com/s3u/JSONPath) to 10.1.0 and updates ancestor dependency [@kubernetes/client-node](https://github.com/kubernetes-client/javascript). These dependencies need to be updated together. Updates `jsonpath-plus` from 9.0.0 to 10.1.0 - [Release notes](https://github.com/s3u/JSONPath/releases) - [Changelog](https://github.com/JSONPath-Plus/JSONPath/blob/main/CHANGES.md) - [Commits](https://github.com/s3u/JSONPath/compare/v9.0.0...v10.1.0) Updates `@kubernetes/client-node` from 0.22.0 to 0.22.2 - [Release notes](https://github.com/kubernetes-client/javascript/releases) - [Changelog](https://github.com/kubernetes-client/javascript/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes-client/javascript/compare/0.22.0...0.22.2) --- updated-dependencies: - dependency-name: jsonpath-plus dependency-type: indirect - dependency-name: "@kubernetes/client-node" dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-06 10:34:45 -05:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	7b404841b2	Bump braces from 3.0.2 to 3.0.3 in /packages/k8s (#188 ) Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3. - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/braces/compare/3.0.2...3.0.3) --- updated-dependencies: - dependency-name: braces dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-11-06 10:34:16 -05:00
Josh GrossandGitHub	977d53963d	Remove `@actions/runner-akvelon` from CODEOWNERS (#190 )	2024-11-05 18:13:42 -05:00
Josh GrossandGitHub	77b40ac6df	Prepare 0.6.2 Release (#189 )	2024-11-05 14:36:03 -05:00
Oliver RadwellandGitHub	ee10d95fd4	Bump kubernetes/client-node from 0.18.1 to 0.22.0 (#182 )	2024-11-05 13:22:04 -05:00