v3.6 changelog
quickstart →
Pricing Benchmarks Docs Changelog Blog Troubleshooting GitHub Install in 10 min

v3.6.0

runson-monorepo-mirror[bot] runson-monorepo-mirror[bot]
· 5 min read
View on GitHub Upgrade guide

Spotlight

  • Remote caches for build tools, in your own S3 bucket. The runner agent serves remote caches for Bazel, Go (GOCACHEPROG), Gradle, sccache, Turborepo, mbx and any HTTP cache, from your stack's cache bucket. List the tools in the new remote_cache input of runs-on/action@v2 on a runner with extras=s3-cache. On vercel/ai, a 95 s Turborepo build restores in under 3 s, and on openai/codex a warm Bazel build takes 130 s instead of 242 s. See Remote caches. Addresses runs-on#410.
  • Git checkout caching with extras=git-cache. Checkouts stream from S3 instead of GitHub, with no workflow changes. A shallow checkout of elastic/kibana takes 13 s instead of 46 s. Git verifies every object, so a bad entry can't change your code. Works on Linux, github.com and GHE.com. See Git checkout caching.
  • Ubuntu and Debian package caching with extras=apt-cache. Packages come from your stack's cache bucket after the first install: many small downloads take about half as long, and installs keep working when the archive is down. apt still checks every signature. Linux only. See apt package caching.
  • Faster Magic Cache restores. Large actions/cache restores now download in parallel ranged requests. A 4 GB restore takes 3 to 6 s, against about 8 s on v3.5.

CloudFormation

  • New MandatoryExtras parameter: extras for every job of the stack, joined with + (for example s3-cache+git-cache+apt-cache), like Terraform's mandatory_extras.
  • The WAF no longer blocks GitHub webhooks after a stack update that touches its IP sets, including the upgrade to v3.6.
  • Stack resources (except the WAF IP sets) carry an aws-apn-id-135269210855 tag for AWS Partner Revenue Measurement. Check it against any tag policy you enforce.

Terraform

  • Fleet stacks get the runner cache Flex already has, so custom AMIs without a runner work on Fleet too.
  • spot_circuit_breaker counts interruptions per instance family. Its format and default (2/15/30) don't change.
  • logger_level applies to the runner agent too.
  • apt-cache only saves NAT traffic if your VPC has an S3 gateway endpoint. The full-featured example adds one.
  • The same WAF and tag changes as CloudFormation.

Other fixes

  • Spot capacity:
    • The Spot circuit breaker pauses Spot only for the interrupted instance family. Before, it sent the whole stack on-demand.
    • A full on-demand vCPU quota no longer fails jobs. Flex waits and retries. Fixes runs-on#569.
    • Flex relaunches runners that GitHub never assigned on a slower schedule, so idle replacements don't pile up during GitHub incidents.
    • Fleet retries the unfilled part of a partly filled Spot request on-demand.
  • GitHub incidents:
    • A spurious 404 for an existing runs-on.yml no longer launches the fallback runner or drops your pools.
    • When GitHub's job API lags, Flex no longer relaunches jobs that already ran, or reports finished jobs as cancelled.
    • Fleet recreates a scale-set session that silently stops delivering jobs.
    • Fleet stacks whose GitHub App lacks the Actions permission no longer drain their API rate limit.
  • Large matrices: in long max-parallel matrices, a sibling job taking a job's runner no longer uses up that job's launch attempts. Before, jobs could fail at "Set up runner" or stay queued forever.
  • StickyDisk: after a Spot interruption, a job with a sticky disk is reconciled and rerun right away, instead of failing reconciliation for about 2 hours. Fixes runs-on#573.
  • Memory and disk:
    • A job that fills the disk fails its step with "No space left on device", instead of crashing the runner.
    • An out-of-memory step is killed instead of the runner, including docker build steps and 16 GiB runners, and the job reports the failure.
    • extras=tmpfs is sized at the runner's memory minus a small reserve (7 GiB on an 8 GiB runner) instead of 150 % of RAM, so filling it fails the step instead of losing the job.
  • Runner: RunsOn now ships its own build of the GitHub Actions runner (runs-on/runner). It serves your workflow's actions from the stack's cache bucket, so jobs skip most action downloads. A runner missing from the image is installed from the stack's runner cache, never from github.com.
  • Agent AWS credentials: the runner agent always uses the instance role for its own AWS calls. Credentials, AWS_CA_BUNDLE and endpoint overrides set on the image no longer apply to it, so a custom AMI behind a private CA must install the CA in the OS trust store. Your workflow steps keep their own AWS configuration.
  • bash -l keeps the job's PATH, as on GitHub-hosted runners. Preinstall and prerun scripts can write to $GITHUB_PATH.
  • .NET on Linux runners uses the system's ICU, as on GitHub-hosted runners. Fixes runs-on#568.
  • Windows runners start bootstrapping 10 to 25 s sooner.
  • Runner agent logs in CloudWatch are much smaller. Fixes runs-on#570.
  • A deprecated disk field on a Fleet runner no longer stops fleetd from starting.
  • Go dependency security updates, and Go 1.27.3. Includes v3.5.1's removal of the compromised emSign ECC Root CA - G3 (runs-on#572).

Release resources