fix: pin actions-runner to 2.336.0

latest only resolves at build time; a published image is still a frozen
snapshot, so tracking latest does not avoid the next deprecation outage
and obscures which runner version each release contains. Pin 2.336.0
explicitly (current actions/runner release) to unblock ARC runners that
fail with exit code 7 on deprecated 2.334.0.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: zzswang

.github/workflows/ci.yml

@@ -53,8 +53,6 @@ jobs:
         with:
           context: .
           push: true
-          # inline cache would otherwise pin the base image to a stale digest
-          pull: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=registry,ref=${{ env.DOCKER_IMAGE }}

.github/workflows/release-please.yml

@@ -61,8 +61,6 @@ jobs:
         with:
           context: .
           push: true
-          # inline cache would otherwise pin the base image to a stale digest
-          pull: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=registry,ref=${{ env.DOCKER_IMAGE }}

Dockerfile

@@ -1,6 +1,4 @@
-# Track latest: ARC disables runner self-update, and GitHub rejects job messages
-# from runner versions that fall out of the support window (exit code 7).
-FROM ghcr.io/actions/actions-runner:latest
+FROM ghcr.io/actions/actions-runner:2.336.0
 
 RUN sudo apt update -y && \
   sudo apt install -y curl make bash jq