[codex] Shrink GitHub runner job image package

[intel352]

Summary

• replace the expanded ghcr.io/actions/actions-runner base with a smaller runtime-deps image
• package the GitHub Actions runner as a compressed archive and extract it at container startup
• add Dockerfile/entrypoint invariants so the provider runtime stays packageable through workflow-compute

Root cause

workflow-compute STG dynamic provider package run 28279620866 failed while promoting the GitHub runner job runtime. docker save of the previous image exceeded STG's 1 GiB package artifact limit and /v1/agent-artifacts/.../commit returned HTTP 413.

The previous image inherited the fully expanded official Actions runner filesystem. For workflow-compute package delivery, the important limit is saved OCI tar size, so the runner should be carried compressed and expanded only inside the ephemeral runtime container.

Validation

• RED: GOWORK=off go test . -run TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive -count=1 failed because the Dockerfile inherited ghcr.io/actions/actions-runner
• GREEN: GOWORK=off go test . -run 'TestGitHubActionsRunnerJobImageCarriesCompressedRunnerArchive|TestReleasePublishesGitHubActionsRunnerJobImage' -count=1
• GREEN: GOWORK=off go test ./cmd/github-actions-runner-job -count=1
• GREEN: GOWORK=off go test ./... -count=1
• GREEN: git diff --check
• Runtime proof: local linux/arm64 image docker run --spec succeeded, and docker save measured 397,696,512 bytes
• Runtime proof: local linux/amd64 docker save measured 498,814,464 bytes

[Copilot]

Pull request overview

This PR reduces the packaged (saved OCI tar) size of the GitHub Actions runner-job image to fit workflow-compute’s provider artifact limits by switching to a smaller base image and carrying the Actions runner as a compressed archive that is extracted at container startup.

Changes:

• Replace ghcr.io/actions/actions-runner base with mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy.
• Download and store the runner as /opt/actions-runner/actions-runner.tar.gz, extracting it in a new container entrypoint before launching the job binary.
• Add a packaging invariant test to prevent regressions back to inheriting the expanded runner image.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
release_packaging_test.go	Adds invariants asserting the runner-job image carries a compressed runner archive and uses the entrypoint extraction approach.
cmd/github-actions-runner-job/entrypoint.sh	New runtime entrypoint that extracts the runner archive on first start and then execs the runner job binary.
cmd/github-actions-runner-job/Dockerfile	Switches to a smaller base, downloads the runner archive during build, and wires the new entrypoint + env vars.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.