[任务] 修改回合，ghcr.io/actions/actions-runner:2.336.0-的开发实现-runner-container-hooks部分

[fly333sky]

背景

[任务] 修改回合，ghcr.io/actions/actions-runner:2.336.0（runner-container-hooks）· 开发流水线 · 开发预览阶段（代码已推 + 预览已部署 + UT 已补；门禁/对抗由 PR CI 异步跑）

改动内容

feat(runner-container-hooks): 升级 actions-runner 基镜像 2.334.0 → 2.336.0

改动内容

基于 origin/release/no_volumes 的 638eb63（design.md 指定基线，此处 Dockerfile 仍为 2.334.0）新建干净分支，仅修改 Dockerfile 第 9 行基镜像版本号：

• 改前：FROM ghcr.io/actions/actions-runner:2.334.0
• 改后：FROM ghcr.io/actions/actions-runner:2.336.0
• 镜像源前缀 ghcr.io/ 保持不变；仅版本号一行变化，未夹带任何其他文件改动。

产出

• 远端新分支：release-2.336.0-a381115（commit a381115，父提交 638eb63）
• 已 git push 到 opensourceways/runner-container-hooks。

为何不用 main / issue-1665-from-main

design.md 2.3 明确：main 与 issue-1665-from-main 的 Dockerfile 用的是 ghcr.nju.edu.cn/actions/actions-runner:2.334.0（不同镜像源，且非本任务基线）；本任务要求从 release/no_volumes 切出，故基于 638eb63 新建。

为何不复用 origin/release-2.336.0-6d63663

该历史分支额外带 38554b4 fix: bump js-yaml to 4.3.1（共 3 文件：Dockerfile + packages/k8s/package.json + package-lock.json），属本 issue 范围外，且其与 release/no_volumes 的 merge-base 为 6d63663 而非 638eb63，不满足验收标准 #2（merge-base==638eb63）与 #5（仅 Dockerfile）。故另建仅含版本升级一条 commit 的干净分支。

验收标准核验（全部通过）

1. git ls-remote --heads origin 'release-2.336.0-*' → 命中 release-2.336.0-a381115 ✅
2. git merge-base origin/release/no_volumes release-2.336.0-a381115 == 638eb63 ✅
3. 新分支 Dockerfile 第 9 行 = FROM ghcr.io/actions/actions-runner:2.336.0 ✅
4. git diff 638eb63..release-2.336.0-a381115 -- Dockerfile 仅一行变化（2.334.0→2.336.0）✅
5. git diff 638eb63..release-2.336.0-a381115 --stat 仅 Dockerfile 一个文件 ✅

单元测试

本次为 Dockerfile 单行基镜像版本号升级，属纯配置改动（无业务逻辑变更），按 AGENT.md「纯文案/配置改动无需 UT」不补单元测试。

相关 Issue

resolve https://github.com/opensourceways/backlog/issues/1665

AI 使用声明

当前 PR 是否有 AI 参与：

• 否
• 是
  1. AI Agent 平台：opencode（Workflow Develop · 需求实现）
  2. AI 模型：bigmodel/glm-5.2
  3. Prompt 上下文：https://github.com/opensourceways/backlog/issues/1665 的 /ai-develop-preview

[opensourceways-bot]

Welcome To opensourceways Community

Hey @fly333sky , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: infratructure ,
and any of the maintainers: @GeorgeCao-hw, @TangJia025, @pkking, @zhongjun2 ,
and any of the committers: @GeorgeCao-hw, @Goalina, @Hourunze1997, @JavaPythonAIForBAT, @KadenZhang3321, @LiYanghang00, @ccijunk, @drizzlezyk, @pkking, @rosecoffe, @tfhddd, @yao-xiaobai, @zhongjun2, @zkhzkhz .

[opensourceways-bot]

CLA Signature Pass

fly333sky, thanks for your pull request. All authors of the commits have signed the CLA. 👍

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jest@​30.4.2 ⏵ 30.2.0
	@​babel/​preset-env@​7.29.7 ⏵ 7.28.3	+1		+1
	@​babel/​core@​7.29.7 ⏵ 7.28.4	+1		+1	+4
	babel-jest@​30.4.1 ⏵ 30.2.0
	@​actions/​core@​2.0.2 ⏵ 1.11.1
	uuid@​14.0.1 ⏵ 11.1.1			+1
	tar-fs@​3.1.3 ⏵ 3.1.1
	ts-jest@​29.4.11 ⏵ 29.4.4	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: Handlebars.js has JavaScript Injection via AST Type Confusion CVE: GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion (CRITICAL) Affected versions: >= 4.0.0 < 4.7.9 Patched version: 4.7.9 From: packages/k8s/package-lock.json → npm/ts-jest@29.4.4 → npm/handlebars@4.7.8 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/handlebars@4.7.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[opensourceways-bot]

检查项	状态
敏感信息扫描	✅
安全编码扫描	✅
漏洞扫描	❌
开源license合规扫描	✅
UT覆盖率	✅
开发阶段设计文档检查	✅
流水线链接	点击跳转查看日志