Bump hook to 0.8.1

[nikola-jokic]

No description provided.

[Copilot]

Pull request overview

This PR updates the runner-container-hooks version from 0.8.0 to 0.8.1 for the k8s-novolume installation.

Changes:

• Bumps the hardcoded runner-container-hooks version from 0.8.0 to 0.8.1 in the Dockerfile

[Copilot]

This creates an inconsistency in runner-container-hooks versions. The k8s directory (line 20) uses RUNNER_CONTAINER_HOOKS_VERSION which is set to 0.7.0, while k8s-novolume now uses 0.8.1. Consider either:

1. Updating RUNNER_CONTAINER_HOOKS_VERSION to 0.8.1 and using it for both installations
2. Creating a separate ARG for the k8s-novolume version if the different versions are intentional
3. Documenting why different versions are needed if this is by design

Having different versions without clear justification makes maintenance harder and could lead to unexpected behavior differences.

[Copilot]

This curl + unzip pattern downloads runner-container-hooks.zip from a GitHub Releases tag and immediately extracts it without any checksum or signature verification, creating a supply-chain risk if the actions/runner-container-hooks release or tag is ever compromised. An attacker who can tamper with that release asset (or the tag it’s built from) could deliver malicious hooks that get baked into every built runner image. To mitigate this, pin the download to an immutable identifier (e.g., a commit SHA or exact asset hash) and verify the archive’s integrity (checksum or signature) before unzipping.