🐛 fix(ci-runners): bump gh to 2.103.3 and let cli-pin-bump keep the runner pin current

.github/workflows/cli-pin-bump.yml

@@ -68,6 +68,7 @@ on:
       - 'src/scripts/test-check-cli-model-lists.sh'
       - 'src/scripts/cli-model-requirements.txt'
       - 'src/Dockerfile'
+      - 'src/deploy/ci-runners/Dockerfile'
       - 'src/pkg/dashboard/cli_models.go'
 
 permissions:
@@ -250,7 +251,7 @@ jobs:
           git config user.name "hive-release[bot]"
           git config user.email "hive-release@hive.kubestellar.io"
           git checkout -B "$HEAD_BRANCH"
-          git add src/Dockerfile src/Dockerfile.contributor src/pkg/config/dockerfile_contributor_test.go
+          git add src/Dockerfile src/Dockerfile.contributor src/deploy/ci-runners/Dockerfile src/pkg/config/dockerfile_contributor_test.go
           {
             echo "🌱 images: bump ${CLI} ${OLD} -> ${NEW}"
             echo

changelog.d/fixed-ci-runner-gh-pin-gate.md

@@ -0,0 +1 @@
+- CI runner image: bumped the pinned `gh` to 2.103.3 (the apt repo only serves the latest), and the daily CLI pin bump now keeps that pin current.

src/deploy/ci-runners/Dockerfile

@@ -48,7 +48,7 @@
 ARG RUNNER_BASE_IMAGE=summerwind/actions-runner:v2.337.0-ubuntu-24.04
 FROM ${RUNNER_BASE_IMAGE}
 
-ARG GITHUB_CLI_VERSION=2.103.2
+ARG GITHUB_CLI_VERSION=2.103.3
 ARG GITHUB_CLI_KEYRING_SHA256=6084d5d7bd8e288441e0e94fc6275570895da18e6751f70f057485dc2d1a811b
 
 # The base image runs as uid 1001 (`runner`), which does not own /etc/apt.

src/docs/cli-pins.md

@@ -13,7 +13,7 @@ Every agent CLI hive drives is baked into the images at a fixed version:
 | Oh My Pi (omp) | `OMP_VERSION`, `OMP_SHA256_*` | GitHub releases `can1357/oh-my-pi` | SHA-256 per arch, cross-checked with `SHA256SUMS.txt` |
 | Muse Code | `MUSE_VERSION`, `MUSE_SHA256_*` | `api.meta.ai/muse-code/channels/muse-stable` and its release manifest | SHA-256 per arch, cross-checked with the manifest |
 | bobshell (bob) | `BOBSHELL_VERSION`, `BOBSHELL_SHA256_*` | `bobshell2-version.txt` on IBM COS | SHA-256, cross-checked with the vendor `.tgz.sha256` |
-| gh | `GH_VERSION`, `GH_SHA256_*` (hub only) | GitHub releases `cli/cli` | SHA-256 per arch, cross-checked with `gh_<v>_checksums.txt` |
+| gh | `GH_VERSION`, `GH_SHA256_*` (hub only); also `GITHUB_CLI_VERSION` in `src/deploy/ci-runners/Dockerfile` | GitHub releases `cli/cli` | SHA-256 per arch, cross-checked with `gh_<v>_checksums.txt` |
 
 The pins live in `src/Dockerfile` (hub and spoke image) and
 `src/Dockerfile.contributor` (containerized contributors), and the two must

src/scripts/cli-pin-bump.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # cli-pin-bump.sh — keep the agent CLI pins in src/Dockerfile and
-# src/Dockerfile.contributor current without giving up the pin (#8419).
+# src/Dockerfile.contributor (and gh in the runner image) current without giving up the pin (#8419).
 #
 # Every CLI hive drives is installed at a fixed version: npm packages through
 # `ARG X_VERSION`, release downloads through `ARG X_VERSION` plus a per-arch
@@ -38,6 +38,7 @@
 #   HIVE_PIN_ROOT                repo root (default: two levels above this script)
 #   HIVE_PIN_DOCKERFILE          override src/Dockerfile
 #   HIVE_PIN_CONTRIB_DOCKERFILE  override src/Dockerfile.contributor
+#   HIVE_PIN_RUNNER_DOCKERFILE   override src/deploy/ci-runners/Dockerfile (gh's GITHUB_CLI_VERSION)
 #   HIVE_PIN_PI_TEST             override src/pkg/config/dockerfile_contributor_test.go
 #   HIVE_PIN_WORKDIR             where downloads land (default: mktemp -d, removed on exit)
 #   GH_TOKEN / GITHUB_TOKEN      optional; raises the GitHub API rate limit
@@ -52,6 +53,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="${HIVE_PIN_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
 DOCKERFILE="${HIVE_PIN_DOCKERFILE:-$ROOT/src/Dockerfile}"
 CONTRIB="${HIVE_PIN_CONTRIB_DOCKERFILE:-$ROOT/src/Dockerfile.contributor}"
+RUNNER="${HIVE_PIN_RUNNER_DOCKERFILE:-$ROOT/src/deploy/ci-runners/Dockerfile}"
 PI_TEST="${HIVE_PIN_PI_TEST:-$ROOT/src/pkg/config/dockerfile_contributor_test.go}"
 
 # Every CLI this script knows. Order is the order the workflow's matrix uses.
@@ -454,7 +456,10 @@ apply_cli() {
     bob)
       for f in "$DOCKERFILE" "$CONTRIB"; do set_arg "$f" BOBSHELL_VERSION "$v"; apply_sha_pair "$f" BOBSHELL "$kv" 256; done ;;
     gh)
-      set_arg "$DOCKERFILE" GH_VERSION "$v"; apply_sha_pair "$DOCKERFILE" GH "$kv" 256 ;;
+      set_arg "$DOCKERFILE" GH_VERSION "$v"; apply_sha_pair "$DOCKERFILE" GH "$kv" 256
+      # The runner image installs gh from the apt repo, which only serves the
+      # latest release, so its exact pin goes stale unless it moves with this one.
+      set_arg "$RUNNER" GITHUB_CLI_VERSION "$v" ;;
     agy)
       # The two images spell the same release differently: the hub image
       # keeps version and build id in separate ARGs and verifies SHA-512, the

src/scripts/test-cli-pin-bump.sh

@@ -72,6 +72,11 @@ ARG OMP_VERSION=18.2.6
 ARG OMP_SHA256_AMD64=6666666666666666666666666666666666666666666666666666666666666666
 ARG OMP_SHA256_ARM64=7777777777777777777777777777777777777777777777777777777777777777
 ARG PI_CODING_AGENT_VERSION=0.84.1
+DF
+  cat > "$TMP/runner.Dockerfile" <<'DF'
+FROM scratch
+ARG GITHUB_CLI_VERSION=2.101.0
+ARG GITHUB_CLI_KEYRING_SHA256=6084d5d7bd8e288441e0e94fc6275570895da18e6751f70f057485dc2d1a811b
 DF
   cat > "$TMP/pi_test.go" <<'GO'
 	for _, want := range []string{
@@ -83,7 +88,7 @@ GO
 run() {
   # run <args...>: the script against the fixtures; stdout to $OUT, rc in $RC
   OUT="$(HIVE_PIN_DOCKERFILE="$TMP/Dockerfile" HIVE_PIN_CONTRIB_DOCKERFILE="$TMP/Dockerfile.contributor" \
-         HIVE_PIN_PI_TEST="$TMP/pi_test.go" HIVE_PIN_WORKDIR="$TMP/work" \
+         HIVE_PIN_PI_TEST="$TMP/pi_test.go" HIVE_PIN_RUNNER_DOCKERFILE="$TMP/runner.Dockerfile" HIVE_PIN_WORKDIR="$TMP/work" \
          HIVE_PIN_INCLUDE_PATCH="${HIVE_PIN_INCLUDE_PATCH:-}" \
          STUB_CLAUDE_VERSION="${STUB_CLAUDE_VERSION:-}" \
          STUB_AGY_VERSION="${STUB_AGY_VERSION:-}" \
@@ -125,6 +130,9 @@ run apply gh "$TMP/gh.kv"
 [ $RC -eq 0 ] && [ "$(arg Dockerfile GH_VERSION)" = "2.102.0" ] && [ "$(arg Dockerfile GH_SHA256_ARM64)" = "$SHA256_B" ] \
   && ! grep -q GH_VERSION "$TMP/Dockerfile.contributor" \
   && pass "gh is hub-only" || fail "gh apply" "$ERR"
+[ "$(arg runner.Dockerfile GITHUB_CLI_VERSION)" = "2.102.0" ] \
+  && grep -q '^ARG GITHUB_CLI_KEYRING_SHA256=6084d5d7' "$TMP/runner.Dockerfile" \
+  && pass "gh also bumps the runner image GITHUB_CLI_VERSION and leaves the keyring sha" || fail "gh runner apply" "$ERR"
 printf 'VERSION=1.2.9\nBUILD=5905287731871744\nSHA256_AMD64=%s\nSHA256_ARM64=%s\nSHA512_AMD64=%s\nSHA512_ARM64=%s\n' \
   "$SHA256_A" "$SHA256_B" "$SHA512_C" "$SHA512_D" > "$TMP/agy.kv"
 run apply agy "$TMP/agy.kv"