feat: surface container errors and fix runner for ARC kubernetes-novolume mode

packages/k8s/README.md

@@ -26,13 +26,31 @@ rules:
   resources: ["secrets"]
   verbs: ["get", "list", "create", "delete"]
 ```
+- (Optional, recommended) Granting `events` read access lets the hooks attach
+  recent `Warning` events (e.g. `FailedScheduling`, `FailedMount`) to the error
+  message when a pod fails to come online. This permission is **not required** —
+  if it is missing the hooks still work, they just omit the event section from
+  diagnostics.
+```
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["get", "list"]
+```
 - The `ACTIONS_RUNNER_POD_NAME` env should be set to the name of the pod
 - The `ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER` env should be set to true to prevent the runner from running any jobs outside of a container
 - The runner pod should map a persistent volume claim into the `_work` directory
     - The `ACTIONS_RUNNER_CLAIM_NAME` env should be set to the persistent volume claim that contains the runner's working directory, otherwise it defaults to `${ACTIONS_RUNNER_POD_NAME}-work`
 - Some actions runner env's are expected to be set. These are set automatically by the runner.
     - `RUNNER_WORKSPACE` is expected to be set to the workspace of the runner
     - `GITHUB_WORKSPACE` is expected to be set to the workspace of the job
+- Optional tuning env's
+    - `ACTIONS_RUNNER_K8S_UNRECOVERABLE_WAITING_REASONS` — comma-separated list of
+      extra container `waiting` reasons that should be treated as deterministic
+      terminal failures (fail fast instead of waiting for the timeout). These are
+      *added* to the built-ins (`ImagePullBackOff`, `ErrImagePull`,
+      `InvalidImageName`, `CreateContainerConfigError`, `CreateContainerError`);
+      the built-ins can never be removed. Use with care — only list reasons that
+      are truly unrecoverable for your workloads (e.g. `CrashLoopBackOff`).
 
 
 ## Limitations

packages/k8s/jest.setup.js

@@ -1,2 +1 @@
-// eslint-disable-next-line filenames/match-regex, no-undef
 jest.setTimeout(500000)

packages/k8s/package.json

@@ -18,10 +18,10 @@
     "@actions/io": "^1.1.3",
     "@kubernetes/client-node": "^1.3.0",
     "hooklib": "file:../hooklib",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.2.0",
     "shlex": "^3.0.0",
     "tar-fs": "^3.1.0",
-    "uuid": "^11.1.0"
+    "uuid": "^11.1.1"
   },
   "devDependencies": {
     "@babel/core": "^7.28.3",

packages/k8s/src/hooks/prepare-job.ts

@@ -85,8 +85,43 @@ export async function prepareJob(
   } catch (err) {
     await prunePods()
     core.debug(`createPod failed: ${JSON.stringify(err)}`)
-    const message = (err as any)?.response?.body?.message || err
-    throw new Error(`failed to create job pod: ${message}`)
+    // The k8s client throws HttpException whose message is a multi-line string
+    // containing the raw HTTP dump. Extract the human-readable "message" field
+    // from the embedded JSON body so the log shows something like:
+    //   failed to create job pod:
+    //     spec.volumes[5].name: Duplicate value: "bad-hostpath"
+    // instead of the full HTTP dump.
+    const raw = err instanceof Error ? err.message : String(err)
+    let detail = raw
+    // The k8s HttpException message is a multi-line dump:
+    //   HTTP-Code: 422
+    //   Body: "{\"kind\":\"Status\",\"message\":\"...\", ...}"
+    //   Headers: {...}
+    // Extract the Body JSON string, unescape it, and pull out "message".
+    try {
+      const bodyStart = raw.indexOf('Body: "')
+      // The boundary may be '"\nHeaders:' (real newline) or the literal
+      // string ends before Headers — use the last '"' before 'Headers:' as fallback
+      const headersIdx = raw.indexOf('Headers:')
+      const bodyEnd = headersIdx !== -1
+        ? raw.lastIndexOf('"', headersIdx) - 0   // last " before Headers:
+        : raw.indexOf('"\nHeaders:')
+      if (bodyStart !== -1 && bodyEnd !== -1 && bodyEnd > bodyStart) {
+        const escaped = raw.substring(bodyStart + 7, bodyEnd)
+        // Body uses JSON string escaping: \" → " and \\ → \
+        const unescaped = escaped
+          .replace(/\\\\/g, '\x00') // protect \\ first
+          .replace(/\\"/g, '"')     // unescape \"
+          .replace(/\x00/g, '\\')  // restore \\
+        const parsed = JSON.parse(unescaped)
+        if (typeof parsed?.message === 'string') {
+          detail = parsed.message
+        }
+      }
+    } catch {
+      // Parsing failed — fall through and show the raw string
+    }
+    throw new Error(`failed to create job pod:\n  ${detail}`)
   }
 
   if (!createdPod?.metadata?.name) {
@@ -112,7 +147,11 @@ export async function prepareJob(
     )
   } catch (err) {
     await prunePods()
-    throw new Error(`pod failed to come online with error: ${err}`)
+    // Unwrap nested "Error: " prefix so the message renders as:
+    //   pod failed to come online:
+    //   <detail from waitForPodPhases, already formatted with sections>
+    const detail = err instanceof Error ? err.message : String(err)
+    throw new Error(`pod failed to come online:\n${detail}`)
   }
 
   await execCpToPod(createdPod.metadata.name, runnerWorkspace, '/__w')