🩺 Runner Doctor Update🩺 Runner Doctor: update A17 status (build-tools digest pinning merged)

[github-actions]

Summary

• Scan window: 2026-07-01 to 2026-07-08
• Items reviewed: local codebase cross-referenced against the catalog; GitHub searches for recent issues/PRs with keywords (ARC, DinD, self-hosted, GHES, GHEC, ghe.com, DOCKER_HOST, chroot, musl, Alpine, IPv6, corporate proxy, capsh, passwd, toolcache, resolv.conf)
• Genuinely new lessons: 1 status update (A17 fix merged — catalog says "open"; source code confirms "fixed")

No new failure mode IDs were identified. The only actionable change is updating A17 from "Open — not yet fixed" to "Fixed."

---

Proposed knowledge-base changes

File: .github/workflows/shared/self-hosted-failure-modes.md

1. A17 table row — change status from "open" to "fixed"

In the Category A table, replace the Fix / flag cell for A17:

Current:

**Open — not yet fixed** (PR github/gh-aw-firewall#5986 in review): adds `'build-tools'` to `IMAGE_DIGEST_KEYS` and threads `ParsedImageTag` through `SysrootServiceParams`. Until merged, security-sensitive deployments cannot digest-pin the sysroot-stage image.

Proposed:

**Fixed in AWF (PR github/gh-aw-firewall#5986)**: `'build-tools'` is now in `IMAGE_DIGEST_KEYS`; `buildSysrootStageService()` accepts `ParsedImageTag` via `SysrootServiceParams` and calls `buildRuntimeImageRef()` instead of a hardcoded template string. Upgrade to the AWF version that includes github/gh-aw-firewall#5986.

2. Known unresolved items section — remove A17 entry

Remove this line:

- A17 / github/gh-aw-firewall#5985 — ARC/DinD sysroot-stage `build-tools` image cannot be digest-pinned; `--image-tag build-tools=sha256:...` throws "invalid key" (fix pending in open PR github/gh-aw-firewall#5986)

---

Proposed doctor changes

File: .github/workflows/self-hosted-runner-doctor.md

Update step 4 "Check for known gaps and notable fixes"

Current:

A17 / github/gh-aw-firewall#5985 — `build-tools` image cannot be digest-pinned; fix pending in open PR github/gh-aw-firewall#5986. Security-sensitive deployments must wait for the merge.

Proposed:

A17 / github/gh-aw-firewall#5985, github/gh-aw-firewall#5986 — `build-tools` digest pinning is **fixed** in AWF version including github/gh-aw-firewall#5986. `'build-tools'` is now a valid key for `--image-tag build-tools=sha256:<digest>`.

---

Proposed portable agent changes

File: .github/agents/self-hosted-runner-doctor.md

The portable agent file embeds a full copy of the failure-mode catalog. Apply the same three edits as above:

1. A17 table row (in the embedded Category A table) — same replacement as the shared file above.
2. Known unresolved items section — remove the same A17 bullet.
3. Step 4 "Check for known gaps and notable fixes" — same replacement as the workflow doctor file above.

---

Evidence

PR #5986 is fully merged into main (HEAD commit 58f77fd):

• src/image-tag.ts:3: IMAGE_DIGEST_KEYS now includes 'build-tools' as its 6th entry — ['squid', 'agent', 'agent-act', 'api-proxy', 'cli-proxy', 'build-tools'].
• src/services/sysroot-service.ts:9-10: defaultSysrootImage() calls buildRuntimeImageRef(registry, 'build-tools', parsedTag) — no longer a hardcoded template string.
• src/services/sysroot-service.ts:16: SysrootServiceParams includes parsedTag: ParsedImageTag.
• src/services/sysroot-service.test.ts and src/image-tag.test.ts contain passing tests for the build-tools digest path.

Source issues and PRs

• Add build-tools to SHA digest pinning infrastructure #5985 — issue: --image-tag build-tools=sha256:... throws Error: invalid key 'build-tools'
• feat: add build-tools to SHA digest pinning infrastructure #5986 — PR (merged): adds 'build-tools' to IMAGE_DIGEST_KEYS, threads ParsedImageTag through SysrootServiceParams

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Runner Doctor Updater · 500.2 AIC · ⊞ 13.4K · ◷

• expires on Aug 7, 2026, 7:37 PM UTC