DISABLE_RUNNER_UPDATE has no effect

Checks

• I've already read https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md and I'm sure my issue is not covered in the troubleshooting guide.
• I'm not using a custom entrypoint in my runner image

Controller Version

v0.27.4

Helm Chart Version

No response

CertManager Version

No response

Deployment Method

Helm

cert-manager installation

Not using cert-manager, using AWS ACM certs instead

Checks

• This isn't a question or user support case (For Q&A and community support, go to Discussions. It might also be a good idea to contract with any of contributors and maintainers if your business is so critical and therefore you need priority support
• I've read releasenotes before submitting this issue and I'm sure it's not due to any recently-introduced backward-incompatible changes
• My actions-runner-controller version (v0.x.y) does support the feature
• I've already upgraded ARC (including the CRDs, see charts/actions-runner-controller/docs/UPGRADING.md for details) to the latest and it didn't fix the issue
• I've migrated to the workflow job webhook event (if you using webhook driven scaling)

Resource Definitions

apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: actions-runners-large-deployment
  namespace: runners
  labels:
    app: gha-runners-large
    environment: test
spec:
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
    spec:
      env:
        # Disable various runner entrypoint log levels 
        - name: LOG_DEBUG_DISABLED
          value: "true"
        - name: LOG_NOTICE_DISABLED
          value: "true"
        - name: LOG_WARNING_DISABLED
          value: "true"
        - name: LOG_ERROR_DISABLED
          value: "true"
        - name: LOG_SUCCESS_DISABLED
          value: "true"
        # Issues a sleep command at the start of the entrypoint
        - name: STARTUP_DELAY_IN_SECONDS
          value: "2"
        # Specify the duration to wait for the docker daemon to be available
        # The default duration of 120 seconds is sometimes too short
        # to reliably wait for the docker daemon to start
        # See https://github.com/actions/actions-runner-controller/issues/1804
        - name: WAIT_FOR_DOCKER_SECONDS
          value: "120"
        # Disables the wait for the docker daemon to be available check
        - name: DISABLE_WAIT_FOR_DOCKER
          value: "false"
        # Disables automatic runner updates
        # WARNING : Upon a new version of the actions/runner software being released 
        # GitHub stops allocating jobs to runners on the previous version of the
        # actions/runner software after 30 days.
        - name: DISABLE_RUNNER_UPDATE
          value: "true"
      organization: #obfuscated#
      ephemeral: true # recommended to not leak data between builds.
      serviceAccountName: "actions-runner"
      dockerdWithinRunnerContainer: false
      dockerVolumeMounts:
        - name: docker
          mountPath: /var/lib/docker
      volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: "obfuscated"
          mountPath: "/var/run/secrets/eks.amazonaws.com/obfuscated"
      volumes:
        - name: docker
          emptyDir: {}
        - name: work # this volume gets automatically used up for the workdir
          emptyDir: {}
        - name: tmp
          emptyDir: {}
        - name: "obfuscated"
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "obfuscated"
      labels:
        - large
        - test
        - runnerdeployment
      containers:
        - name: runner
          image: ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner:v2.305.0-ubuntu-20.04
          env:
            - name: obfuscated
              valueFrom:
                secretKeyRef:
                  key: "obfuscated"
                  name: obfuscated
                  optional: false
            - name: obfuscated
              valueFrom:
                secretKeyRef:
                  key: "obfuscated"
                  name: obfuscated
                  optional: false
          resources:
            limits:
              memory: "0.5Gi"
            requests:
              cpu: "1"
              memory: "0.5Gi"
        - name: docker
          image: docker:20.10.23-dind
          imagePullPolicy: IfNotPresent
          env:
            - name: RUNNER_FEATURE_FLAG_EPHEMERAL
              value: "true"
            - name: DOCKER_TLS_CERTDIR
              value: "/certs"               
            - name: "DOCKER_ENABLED"
              value: "true"
            - name: STARTUP_DELAY_IN_SECONDS
              value: "5"
          resources:
            limits:
              memory: "8Gi"
            requests:
              cpu: "2"
              memory: "8Gi"
          volumeMounts:
            - name: docker
              mountPath: "/var/lib/docker"

To Reproduce

1. Deploy the RunnerDeployment
2. Check the logs of the runners

Describe the bug

Although the environment variable DISABLE_RUNNER_UPDATE is set tp true as per https://github.com/actions/actions-runner-controller/blob/master/docs/using-entrypoint-features.md , the runners still update their versions at runtime whenever a new version is available

The only way to prevent is to set the environment variable under the runner containers section instead like so

      containers:
        - name: runner
          image: ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner:v2.305.0-ubuntu-20.04
          env:
            # Disables automatic runner updates
            # WARNING : Upon a new version of the actions/runner software being released 
            # GitHub stops allocating jobs to runners on the previous version of the
            # actions/runner software after 30 days.
            - name: DISABLE_RUNNER_UPDATE
              value: "true" 

Describe the expected behavior

Runner shouldn't update version at runtime

Whole Controller Logs

N/A

Whole Runner Pod Logs

N/A

Additional Context

No response

Start with docs/using-entrypoint-features.md and compare the RunnerDeployment-level env setting with the runner container's env in the supplied manifest. Trace how DISABLE_RUNNER_UPDATE reaches the runner entrypoint and add coverage for the documented placement. Done means the documented setting prevents runtime runner updates.