chore(release): 1.31.4 [skip ci]

Author: semantic-release-bot

CHANGELOG.md

@@ -1,3 +1,5 @@
+## [1.31.4](https://github.com/ExaDev/github-runner/compare/v1.31.3...v1.31.4) (2026-10-18)
+
 ## [1.31.3](https://github.com/ExaDev/github-runner/compare/v1.31.2...v1.31.3) (2026-10-15)
 
 ## [1.31.2](https://github.com/ExaDev/github-runner/compare/v1.31.1...v1.31.2) (2026-10-15)

galaxy.yml

@@ -2,7 +2,7 @@
 # Collection metadata for exadev.github_runner. The version stays 0.0.0 in source: the release process stamps the real version at publish time.
 namespace: exadev
 name: github_runner
-version: 1.31.3
+version: 1.31.4
 readme: README.md
 authors:
   - ExaDev

roles/github_runner_arc/defaults/main.yml

@@ -132,7 +132,7 @@ github_runner_arc_image_pull_secret_source: static
 github_runner_arc_image_pull_secret_renewal_schedule: "*/15 * * * *"
 
 # Image the renewal CronJob runs. Pulled without a pull Secret, so it must be public.
-github_runner_arc_image_pull_secret_renewer_image: "ghcr.io/exadev/github-runner-pull-secret-renewer:1.31.3"
+github_runner_arc_image_pull_secret_renewer_image: "ghcr.io/exadev/github-runner-pull-secret-renewer:1.31.4"
 
 # Before writing the pull Secret, prove the credential can read each image this host installs from that registry (with an App token, each org's own image, in the role and in every renewal): exchange it for a registry bearer token and fetch the image's manifest. A token that authenticates but lacks package access is otherwise only found later, as pods stuck in ImagePullBackOff. Uses the registry's /token endpoint, as GHCR provides.
 github_runner_arc_verify_image_pull: true
@@ -149,8 +149,8 @@ github_runner_arc_heartbeat_gist_consumer: ""
 
 # Namespace and images for the platform's own Deployments (see install_platform.yml).
 github_runner_arc_platform_namespace: "github-runner-platform"
-github_runner_arc_heartbeat_image: "ghcr.io/exadev/github-runner-heartbeat:1.31.3"
-github_runner_arc_autoscaler_image: "ghcr.io/exadev/github-runner-autoscaler:1.31.3"
+github_runner_arc_heartbeat_image: "ghcr.io/exadev/github-runner-heartbeat:1.31.4"
+github_runner_arc_autoscaler_image: "ghcr.io/exadev/github-runner-autoscaler:1.31.4"
 # Scheduling class and local-storage sizing for the platform's own long-running pods (heartbeat, autoscaler, node recovery). Without them the pods run at the default priority with no ephemeral-storage request, so under disk pressure the kubelet ranks them with, or ahead of, the runner pods it should evict first, and the watcher that recovers a node was itself evicted while a node had disk pressure. The priority value only has to sit above 0, the priority every runner pod runs at, and below 1000000000, the ceiling Kubernetes reserves for its own system classes. The storage request is above what these pods write (container logs and kubectl's small cache) so the kubelet never counts them as exceeding it; the limit stops a runaway log from becoming the pressure.
 github_runner_arc_platform_priority_class_name: "github-runner-platform"
 github_runner_arc_platform_priority_value: 1000000
@@ -176,7 +176,7 @@ github_runner_arc_node_recovery_after_seconds: 120
 # How often the watcher checks the nodes. A taint lands at most this long after the threshold passes.
 github_runner_arc_node_recovery_poll_seconds: 15
 # Image the watcher runs. Pulled without a pull Secret, so it must be public.
-github_runner_arc_node_recovery_image: "ghcr.io/exadev/github-runner-node-recovery:1.31.3"
+github_runner_arc_node_recovery_image: "ghcr.io/exadev/github-runner-node-recovery:1.31.4"
 
 # Runner reaper (see the role README's Runner reaper section, tasks/install_runner_reaper.yml and files/reap-runners.sh): a CronJob in each runner namespace that deletes an EphemeralRunner whose job's workflow run is completed or cancelled, whose own job is completed, or whose job has been running for longer than github_runner_arc_runner_reaper_max_job_seconds; the scale set replaces it. It reads the runs with an installation token from the org's GitHub App restricted to actions: read, so the App needs the Actions repository permission (read) on every repository whose jobs the runners take, approved on its installation. It never deletes a runner that has not been assigned a job, and deletes nothing when GitHub or the token is unavailable. false removes the CronJob, its RBAC and its ConfigMap.
 github_runner_arc_runner_reaper_enabled: false
@@ -223,4 +223,4 @@ github_runner_arc_app_setup_keep_private_key: false
 github_runner_arc_deployed_state_configmap: "deployed-state"
 
 # The collection version this role was released as, stamped by scripts/release/stamp_version.py. The role records it in the platform namespace's deployed-state ConfigMap once a run has applied everything, and the heartbeat publishes it in fleet-health.json. It is what was applied, not what is running.
-github_runner_arc_collection_version: "1.31.3"
+github_runner_arc_collection_version: "1.31.4"

roles/github_runner_cluster/defaults/main.yml

@@ -135,4 +135,4 @@ github_runner_cluster_record_deployed_version: true
 github_runner_cluster_deployed_version_annotation: "github-runner.exadev.com/deployed-version"
 
 # The collection version this role was released as, stamped by scripts/release/stamp_version.py. A server host records it as an annotation on its own node once the node has registered, and the heartbeat publishes it in fleet-health.json. It is what was applied, not what is running, and an agent host, which has no API of its own, records nothing.
-github_runner_cluster_collection_version: "1.31.3"
+github_runner_cluster_collection_version: "1.31.4"