build(deps): bump worker PowerShell to 7.6.5 for hosted-image parity - #311
Open
kyle-sexton wants to merge 3 commits into
Open
build(deps): bump worker PowerShell to 7.6.5 for hosted-image parity#311kyle-sexton wants to merge 3 commits into
kyle-sexton wants to merge 3 commits into
Conversation
GitHub's Ubuntu 24.04 hosted-image manifest at commit c5170d2 lists PowerShell 7.6.5. Per the docs/releases.md freshness policy, PowerShell tracks that manifest rather than getting ahead of it, so adopting 7.6.5 restores cloud parity instead of leading it. Moves the pin, its checksum, and the manifest-evidence references together: Dockerfile POWERSHELL_VERSION / POWERSHELL_SHA256 and the release/dependencies.json powerShell entry. The gh entry's hostedImageManifestCommit also moves to c5170d2 so both entries cite the manifest actually consulted; the same manifest still lists GitHub CLI 2.97.0, so the gh version pin itself is unchanged. v7.6.5 is a servicing patch over v7.6.4 with one engine fix (dot-sourcing behavior of `pwsh -file` for advanced-function scripts) plus .NET SDK and packaging updates. The release notes document no breaking change and no security fix. The archive checksum was verified independently by downloading the asset and hashing it, and the worker image was built locally: the in-build `sha256sum --check --strict` passed and the resulting image reports pwsh 7.6.5 and gh 2.97.0. Review-only per the docs/releases.md freshness policy; carries the do-not-merge label. Promotion additionally needs a new reviewed compatibility pair and a rolling-host rollout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
kyle-sexton
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a7920451fa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
docs/worker-image.md is the authoritative description of the worker image's reviewed upstream baseline, and it still named PowerShell 7.6.4 at hosted-image manifest commit 8926c75 while the Dockerfile and release/dependencies.json in this PR record 7.6.5 at c5170d2. Moves the documented version, the reviewed manifest commit, and the manifest link together so the doc, the baked image, and the release evidence agree. Raised in review on #311; no remaining references to the old baseline outside the historical dependency-drift-review record. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
release/dependencies.json still claimed the pins were resolved against official sources at 2026-08-21T07:40:00Z, which is no longer true once the PowerShell pin and both hosted-image manifest references move. #291, the immediate predecessor of this drain, moved resolvedAt to the same instant as the reviewed-decision record's reviewedAt; this follows that precedent. Metadata only. Test-ReleasePins.ps1 does not read this field, so nothing in CI would have caught the stale value. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No linked issue
Summary
Review-only drain of the
github-hosted-powershellrow of #283: PowerShell 7.6.4 → 7.6.5 in the worker image, restoring parity with GitHub's Ubuntu 24.04 hosted image.Based on
mainand revertable on its own, but merge it last: #309 → #310 → this PR. See "Merge order" under Related — merging this before #310 silently regresses its own reviewed-decision record.This PR carries the
do-not-mergelabel and must not be merged autonomously.docs/releases.md("Freshness policy"): never auto-merge controller, runner, image, toolchain, Scale Set Client, Action, or release changes, and a passing drift check is necessary but is not promotion approval.Problem
docs/releases.mdstates that "PowerShell tracks the hosted manifest rather than getting ahead of it, preserving cloud parity." The current hosted manifest —actions/runner-imagesimages/ubuntu/Ubuntu2404-Readme.mdat commitc5170d2845dc0eb0f22853ec70bd4f1c891112ca(2026-08-21) — lists:The worker image is pinned at 7.6.4, so it is now behind the hosted image. Adopting 7.6.5 restores parity rather than leading it.
Fix
Moves the pin, its checksum, and the manifest-evidence references together:
Dockerfile:ARG POWERSHELL_VERSION=7.6.5,ARG POWERSHELL_SHA256=b34ab3b19acac1d3d4d0d3cfdb02acf62f457b0b6a962ff008132033f7566844.release/dependencies.json→powerShell:version,linuxX64ArchiveSha256,source,hostedImageManifestCommit,hostedImageManifestSource.release/dependencies.json→gh:hostedImageManifestCommit/hostedImageManifestSourcealso move toc5170d2, so both entries cite the manifest actually consulted rather than leaving two entries pointed at different manifest commits. Theghversion pin is unchanged — the same manifest still listsGitHub CLI 2.97.0, re-verified as part of this change.release/dependencies.json→resolvedAt→2026-08-27T08:00:00Z; it still claimed the pins were resolved on 2026-08-21, which stops being true once the PowerShell pin and both manifest references move. build(deps): bump setup-buildx-action to 4.3.0 and ci-workflows to v0.17.0 #291 set the precedent of matchingresolvedAtto the reviewed-decision instant. No CI check reads that field.release/dependency-drift-review.json: appends the reviewed decision for this row. The existing Go hold is left intact — that row is handled in build(deps): bump Go to 1.27.0 and the lint contract to golangci-lint 2.13.1 #310.docs/worker-image.md: moves the documented reviewed baseline (PowerShell version, reviewed manifest commit, and the manifest link in the references section) to 7.6.5 atc5170d2, so the authoritative worker-image doc, the baked image, and the release evidence agree. Added in893af64in response to review.Upstream change review, v7.6.4 → v7.6.5
A servicing patch. From the release notes:
pwsh -filefor advanced-function scripts" — the only functional change.Microsoft.PowerShell.Archive1.2.6, OneBranch pipeline fixes, EXE signing condition fix, localized resources limited to MSIX packages, minimum-size arm64 package.No breaking changes and no security fixes are documented in this release. The one engine fix affects
pwsh -filedot-sourcing of advanced-function scripts; the worker image installspwshfor job steps and does not itself depend on that behavior.Verification
images/ubuntu/Ubuntu2404-Readme.mdatc5170d2845dc0eb0f22853ec70bd4f1c891112ca- PowerShell 7.6.5ghstill at 2.97.0 in that manifest- GitHub CLI 2.97.0— pin unchangedGET /repos/PowerShell/PowerShell/releases/tags/v7.6.5powershell-7.6.5-linux-x64.tar.gz→sha256:b34ab3b19acac1d3d4d0d3cfdb02acf62f457b0b6a962ff008132033f7566844sha256sum→b34ab3b19acac1d3d4d0d3cfdb02acf62f457b0b6a962ff008132033f7566844— matchesdocker build -t ci-runner-worker:pr-b-verify .sha256sum --check --strictstep reported/tmp/powershell.tar.gz: OKdocker run --entrypoint pwsh … -Command '$PSVersionTable.PSVersion.ToString()'7.6.5ghin the built image unchangeddocker run --entrypoint gh … --versiongh version 2.97.0 (2026-07-31)./scripts/Test-ReleasePins.ps1(enforces the DockerfileARGs matchrelease/dependencies.json)Release and workflow pins are internally consistent.JSON.parseon bothrelease/*.jsongrep -rn '8926c75|7\.6\.4'across markdown, JSON, YAML, PowerShell, shell, and the Dockerfilefromvalues inrelease/dependency-drift-review.jsonNo Go source changes, so the Go lanes are unaffected by this PR.
Related
dependency-drift.ymlreconciles that issue itself: it closes it whenhasDriftis false, and otherwise refreshes whichever matching issue is currentlystate: 'open'. It never reopens a closed one — closing it manually while rows remain outstanding makes the next daily run create a duplicate, which is what the 2026-08-21 maintainer note warns about.Merge order: this PR goes LAST
#309 → #310 → this PR. This PR's content is independent of the other two, but the ordering is not optional, because all three touch
release/dependency-drift-review.json.held: [],bumped: [go, ci-workflows], and this row underpendingas"decision": "proposed-in-separate-pr").bumpedarray, leaving the Go hold intact — so it is coherent if merged on its own.If this PR merges before #310, #310's wholesale replacement then deletes the merged PowerShell decision and regresses it back to
pending/ "proposed", silently, because git sees the whole file replaced with no textual conflict. That would leave already-merged reviewed evidence contradicting itself.Merging in the stated order avoids that. The resulting conflict here is small but semantic, not textual: resolve it by moving this PR's
github-hosted-powershellentry into the new 2026-08-27bumpedarray and deleting thependingblock that stands in for it.docs/releases.md— freshness policy, including the hosted-manifest parity rule this PR follows.Fleet rollout
Required. PowerShell is baked into the worker image and
release/dependencies.jsonis a compatibility-pair input feedingcompatibility.json. Merging this PR changes nothing on any live runner: publication and promotion of a new compatibility pair run through the release workflow and the provisioning rolling-upgrade runbook, which is a separate operator procedure. This lane did not touch any runner host.This PR was prepared by an automated agent lane. It is review-only: the agent did not merge it and will not, and deliberately left issue 283 open.