@htekdev/actions-debugger 1.0.117 → 1.0.119
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/errors/caching-artifacts/caching-artifacts-069.yml +133 -0
- package/errors/caching-artifacts/caching-artifacts-070.yml +94 -0
- package/errors/concurrency-timing/concurrency-timing-056.yml +127 -0
- package/errors/concurrency-timing/concurrency-timing-057.yml +115 -0
- package/errors/concurrency-timing/workflow-run-head-branch-null-schedule-dispatch-concurrency.yml +135 -0
- package/errors/known-unsolved/known-unsolved-067.yml +117 -0
- package/errors/known-unsolved/known-unsolved-068.yml +124 -0
- package/errors/known-unsolved/node-action-post-step-wrong-inputs-nested-composite.yml +133 -0
- package/errors/known-unsolved/ubuntu-24-04-arm64-missing-binder-ashmem-kernel-modules.yml +149 -0
- package/errors/permissions-auth/permissions-auth-069.yml +161 -0
- package/errors/runner-environment/arc-autoscalinglistener-ephemeralrunnerset-stale-after-upgrade.yml +134 -0
- package/errors/runner-environment/broker-server-socket-exception-nat-timeout-linux.yml +114 -0
- package/errors/runner-environment/runner-environment-210.yml +105 -0
- package/errors/runner-environment/runner-environment-213.yml +142 -0
- package/errors/runner-environment/runner-environment-214.yml +107 -0
- package/errors/runner-environment/runner-environment-215.yml +93 -0
- package/errors/runner-environment/runner-environment-216.yml +82 -0
- package/errors/runner-environment/runner-environment-217.yml +99 -0
- package/errors/runner-environment/runner-environment-218.yml +111 -0
- package/errors/runner-environment/ubuntu-24-man-db-dpkg-trigger-apt-install-stall.yml +94 -0
- package/errors/runner-environment/ubuntu-26-04-missing-preinstalled-tools.yml +178 -0
- package/errors/runner-environment/upload-artifact-v6-proxy-headers-leak-strict-proxy-fail.yml +101 -0
- package/errors/silent-failures/silent-failures-108.yml +108 -0
- package/errors/silent-failures/silent-failures-109.yml +119 -0
- package/errors/silent-failures/silent-failures-110.yml +91 -0
- package/errors/silent-failures/silent-failures-111.yml +107 -0
- package/errors/triggers/pull-request-labeled-fires-all-labels-no-name-filter.yml +110 -0
- package/errors/yaml-syntax/duplicate-step-id-within-job-scope-validation-error.yml +130 -0
- package/errors/yaml-syntax/yaml-syntax-072.yml +93 -0
- package/errors/yaml-syntax/yaml-syntax-073.yml +103 -0
- package/package.json +1 -1
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
id: silent-failures-111
|
|
2
|
+
title: '`helm list` shows all release states by default in Helm 4 — scripts silently return unexpected releases'
|
|
3
|
+
category: silent-failures
|
|
4
|
+
severity: silent-failure
|
|
5
|
+
tags:
|
|
6
|
+
- helm
|
|
7
|
+
- helm-4
|
|
8
|
+
- ubuntu-26
|
|
9
|
+
- tool-upgrade
|
|
10
|
+
- output-change
|
|
11
|
+
- deploy-check
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'helm list'
|
|
14
|
+
flags: 'i'
|
|
15
|
+
error_messages:
|
|
16
|
+
- '# No error message — helm list exits 0 but returns FAILED/SUPERSEDED/UNINSTALLED releases alongside DEPLOYED ones'
|
|
17
|
+
root_cause: |
|
|
18
|
+
In Helm 3, `helm list` (without flags) only returned releases in the DEPLOYED
|
|
19
|
+
state. To see releases in all states, you had to pass `-a`/`--all`.
|
|
20
|
+
|
|
21
|
+
In Helm 4 (installed on ubuntu-26.04), `helm list` returns releases of ALL
|
|
22
|
+
states by default: DEPLOYED, FAILED, SUPERSEDED, UNINSTALLED, PENDING_INSTALL,
|
|
23
|
+
PENDING_UPGRADE, PENDING_ROLLBACK. The `-a`/`--all` flag was temporarily removed
|
|
24
|
+
(helm/helm#31784) and restored as a deprecated no-op in Helm 4.1.1+.
|
|
25
|
+
|
|
26
|
+
This causes silent failures in two common patterns:
|
|
27
|
+
|
|
28
|
+
1. **Existence check**: `helm list --filter my-release | grep my-release` returns
|
|
29
|
+
a match even if the release is in a FAILED state, causing a subsequent
|
|
30
|
+
`helm upgrade` to proceed when `helm install` should have been used instead
|
|
31
|
+
(or vice versa).
|
|
32
|
+
|
|
33
|
+
2. **Release count**: Scripts that count `helm list | wc -l` to assert a number
|
|
34
|
+
of deployed releases now count more releases than expected.
|
|
35
|
+
|
|
36
|
+
3. **CI deploy gate**: Pipelines that run `helm list` to verify a deployment
|
|
37
|
+
succeeded will see FAILED releases included in output and may incorrectly
|
|
38
|
+
conclude the deployment is present/healthy.
|
|
39
|
+
|
|
40
|
+
No error is thrown — `helm list` exits 0 in all cases. The bug is in the
|
|
41
|
+
consuming script's assumption about Helm 3 behavior.
|
|
42
|
+
fix: |
|
|
43
|
+
Filter `helm list` output explicitly by state using the `--deployed` flag
|
|
44
|
+
or the `--filter`+`--output json` approach to check actual release status.
|
|
45
|
+
|
|
46
|
+
In Helm 4, use `helm status <release>` to get the definitive state of a
|
|
47
|
+
specific release rather than parsing `helm list` output.
|
|
48
|
+
fix_code:
|
|
49
|
+
- language: yaml
|
|
50
|
+
label: 'Use --deployed flag to replicate Helm 3 default behavior'
|
|
51
|
+
code: |
|
|
52
|
+
- name: Check if release is deployed
|
|
53
|
+
run: |
|
|
54
|
+
# Helm 4 on ubuntu-26.04: helm list shows ALL states by default.
|
|
55
|
+
# Use --deployed to replicate Helm 3 default behavior:
|
|
56
|
+
DEPLOYED=$(helm list --deployed --filter "^my-release$" --short)
|
|
57
|
+
if [ -n "$DEPLOYED" ]; then
|
|
58
|
+
echo "Release is deployed — running upgrade"
|
|
59
|
+
helm upgrade my-release ./chart
|
|
60
|
+
else
|
|
61
|
+
echo "No deployed release found — running install"
|
|
62
|
+
helm install my-release ./chart
|
|
63
|
+
fi
|
|
64
|
+
|
|
65
|
+
- language: yaml
|
|
66
|
+
label: 'Use helm status for definitive state check'
|
|
67
|
+
code: |
|
|
68
|
+
- name: Check release status
|
|
69
|
+
run: |
|
|
70
|
+
# helm status exits non-zero if the release does not exist.
|
|
71
|
+
# Use --output json to get machine-parseable state:
|
|
72
|
+
STATUS=$(helm status my-release --output json 2>/dev/null | jq -r '.info.status' || echo "not-found")
|
|
73
|
+
echo "Release status: $STATUS"
|
|
74
|
+
if [ "$STATUS" = "deployed" ]; then
|
|
75
|
+
echo "Healthy — proceeding"
|
|
76
|
+
elif [ "$STATUS" = "failed" ]; then
|
|
77
|
+
echo "Previous install failed — rolling back before upgrade"
|
|
78
|
+
helm rollback my-release 0 # Roll back to last successful
|
|
79
|
+
else
|
|
80
|
+
echo "Installing fresh"
|
|
81
|
+
helm install my-release ./chart
|
|
82
|
+
fi
|
|
83
|
+
|
|
84
|
+
- language: yaml
|
|
85
|
+
label: 'Use helm list --output json for precise state parsing'
|
|
86
|
+
code: |
|
|
87
|
+
- name: List only deployed releases
|
|
88
|
+
run: |
|
|
89
|
+
# Explicitly request only DEPLOYED state, output JSON for safe parsing:
|
|
90
|
+
helm list --deployed --output json | jq '.[] | .name + " (" + .status + ")"'
|
|
91
|
+
# Do NOT rely on: helm list | grep release-name
|
|
92
|
+
# In Helm 4, this matches FAILED/SUPERSEDED releases too.
|
|
93
|
+
prevention:
|
|
94
|
+
- "Never use `helm list | grep <release>` as a deployment check — it matches any release state in Helm 4."
|
|
95
|
+
- "Use `helm list --deployed` or `helm status <release>` for definitive deployed-state checks."
|
|
96
|
+
- "When migrating to ubuntu-26.04, audit all scripts that parse `helm list` output."
|
|
97
|
+
- "Add `--output json` to `helm list` calls and parse `status` field explicitly rather than relying on line-presence checks."
|
|
98
|
+
- "Pin Helm 3 with `azure/setup-helm` if your scripts are not yet Helm 4 compatible."
|
|
99
|
+
docs:
|
|
100
|
+
- url: 'https://github.com/helm/helm/issues/31784'
|
|
101
|
+
label: 'helm/helm#31784 — Breaking change to helm list CLI command in v4'
|
|
102
|
+
- url: 'https://helm.sh/docs/topics/v4_migration/'
|
|
103
|
+
label: 'Helm v4 Migration Guide'
|
|
104
|
+
- url: 'https://helm.sh/docs/helm/helm_list/'
|
|
105
|
+
label: 'helm list command reference'
|
|
106
|
+
- url: 'https://github.com/actions/runner-images/commit/9e3319d6b4acc306925295853d0ff41ddd5c40f0'
|
|
107
|
+
label: 'runner-images commit: ubuntu-26.04 installs Helm 4'
|
|
@@ -0,0 +1,110 @@
|
|
|
1
|
+
id: triggers-070
|
|
2
|
+
title: '`on: pull_request: types: [labeled]` fires for every label applied to a PR —
|
|
3
|
+
no trigger-level label-name filter exists; must use `if:` condition'
|
|
4
|
+
category: triggers
|
|
5
|
+
severity: silent-failure
|
|
6
|
+
tags:
|
|
7
|
+
- pull_request
|
|
8
|
+
- labeled
|
|
9
|
+
- label
|
|
10
|
+
- types
|
|
11
|
+
- label-name-filter
|
|
12
|
+
- deployment-gate
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'types:\s*[\[\n].*labeled'
|
|
15
|
+
flags: 'si'
|
|
16
|
+
error_messages:
|
|
17
|
+
- "No error — workflow runs for every label applied to the PR, including unrelated labels"
|
|
18
|
+
- "No error — workflow run count is higher than expected; runs appear for all label events"
|
|
19
|
+
root_cause: |
|
|
20
|
+
When `types: [labeled]` is added to a `pull_request` trigger, the workflow fires for
|
|
21
|
+
EVERY label applied to the pull request — not only a specific label. There is no
|
|
22
|
+
trigger-level filter for label names. GitHub Actions does not support syntax like
|
|
23
|
+
`types: [labeled: 'deploy-preview']` or `label: 'X'` at the trigger level.
|
|
24
|
+
|
|
25
|
+
Teams building label-gated workflows (deploy-preview, run-integration-tests,
|
|
26
|
+
approved-for-staging, force-rebuild) are surprised to find the workflow fires for
|
|
27
|
+
entirely unrelated labels ('bug', 'enhancement', 'wontfix', 'good first issue').
|
|
28
|
+
The result is:
|
|
29
|
+
- Excessive workflow runs that show up in the Actions tab for every label event
|
|
30
|
+
- Wasted CI minutes for runs that skip all meaningful steps
|
|
31
|
+
- Unexpected side effects if the workflow performs mutations (deploy, comment, notify)
|
|
32
|
+
that should only happen for the specific label
|
|
33
|
+
|
|
34
|
+
This is distinct from the related issue triggers-030 ("labeled NOT in default types"):
|
|
35
|
+
- triggers-030: workflow NEVER fires because labeled is missing from default types
|
|
36
|
+
- triggers-070: workflow fires TOO OFTEN because ALL label events trigger it
|
|
37
|
+
|
|
38
|
+
The behavior is documented: `types: [labeled]` is a webhook activity type filter,
|
|
39
|
+
not a payload content filter. Payload-level filtering (label name, PR author, etc.)
|
|
40
|
+
must be done via `if:` conditions on jobs or steps.
|
|
41
|
+
fix: |
|
|
42
|
+
Add a job-level `if:` condition filtering on `github.event.label.name`. This is the
|
|
43
|
+
only mechanism — no trigger-level label-name filtering exists.
|
|
44
|
+
|
|
45
|
+
Key context properties for label-based filtering:
|
|
46
|
+
- `github.event.action` — 'labeled' or 'unlabeled'
|
|
47
|
+
- `github.event.label.name` — the label JUST applied (only set for labeled/unlabeled events)
|
|
48
|
+
- `github.event.pull_request.labels.*.name` — ALL current labels on the PR (useful for
|
|
49
|
+
opened/synchronize/reopened events where a label may already be present)
|
|
50
|
+
fix_code:
|
|
51
|
+
- language: yaml
|
|
52
|
+
label: 'WRONG — fires for every label including unrelated ones'
|
|
53
|
+
code: |
|
|
54
|
+
on:
|
|
55
|
+
pull_request:
|
|
56
|
+
types: [labeled]
|
|
57
|
+
|
|
58
|
+
jobs:
|
|
59
|
+
deploy-preview:
|
|
60
|
+
runs-on: ubuntu-latest
|
|
61
|
+
steps:
|
|
62
|
+
- run: echo "Deploying preview..."
|
|
63
|
+
# Runs for EVERY label: 'bug', 'wontfix', 'enhancement', 'deploy-preview', etc.
|
|
64
|
+
- language: yaml
|
|
65
|
+
label: 'RIGHT — filter by specific label name with job-level if:'
|
|
66
|
+
code: |
|
|
67
|
+
on:
|
|
68
|
+
pull_request:
|
|
69
|
+
types: [labeled]
|
|
70
|
+
|
|
71
|
+
jobs:
|
|
72
|
+
deploy-preview:
|
|
73
|
+
if: github.event.label.name == 'deploy-preview'
|
|
74
|
+
runs-on: ubuntu-latest
|
|
75
|
+
steps:
|
|
76
|
+
- run: echo "Deploying preview for PR #${{ github.event.pull_request.number }}"
|
|
77
|
+
- language: yaml
|
|
78
|
+
label: 'RIGHT — label gate that works for both labeled events AND already-labeled PRs'
|
|
79
|
+
code: |
|
|
80
|
+
on:
|
|
81
|
+
pull_request:
|
|
82
|
+
types:
|
|
83
|
+
- opened
|
|
84
|
+
- synchronize
|
|
85
|
+
- reopened
|
|
86
|
+
- labeled # fires when any label is applied; filter below by name
|
|
87
|
+
|
|
88
|
+
jobs:
|
|
89
|
+
deploy-preview:
|
|
90
|
+
if: |
|
|
91
|
+
(github.event.action == 'labeled' && github.event.label.name == 'deploy-preview') ||
|
|
92
|
+
(github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'deploy-preview'))
|
|
93
|
+
runs-on: ubuntu-latest
|
|
94
|
+
steps:
|
|
95
|
+
- run: echo "Deploying preview..."
|
|
96
|
+
prevention:
|
|
97
|
+
- "Always pair `types: [labeled]` with `if: github.event.label.name == 'your-label'` at the job
|
|
98
|
+
level to gate on the specific label."
|
|
99
|
+
- 'Document which label triggers which workflow in a comment near the trigger definition.'
|
|
100
|
+
- 'Test label-gated workflows by applying both the expected label AND an unrelated label to verify
|
|
101
|
+
the `if:` filter correctly skips unintended runs.'
|
|
102
|
+
- 'Consider using only `types: [labeled]` (not opened/sync/reopened) if the workflow should only
|
|
103
|
+
run when the label is freshly applied, not on every code push to already-labeled PRs.'
|
|
104
|
+
docs:
|
|
105
|
+
- url: 'https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request'
|
|
106
|
+
label: 'GitHub Docs: pull_request event — labeled activity type'
|
|
107
|
+
- url: 'https://docs.github.com/en/webhooks/webhook-events-and-payloads#pull_request'
|
|
108
|
+
label: 'GitHub Webhook Docs: pull_request payload (label field)'
|
|
109
|
+
- url: 'https://stackoverflow.com/questions/62325286/run-github-actions-when-pull-requests-have-a-specific-label'
|
|
110
|
+
label: 'Stack Overflow: Run GitHub Actions when pull requests have a specific label (43 votes)'
|
|
@@ -0,0 +1,130 @@
|
|
|
1
|
+
id: yaml-syntax-071
|
|
2
|
+
title: 'Duplicate `id:` values within the same job or composite action cause instant
|
|
3
|
+
workflow validation failure'
|
|
4
|
+
category: yaml-syntax
|
|
5
|
+
severity: error
|
|
6
|
+
tags:
|
|
7
|
+
- step-id
|
|
8
|
+
- duplicate
|
|
9
|
+
- validation
|
|
10
|
+
- composite-action
|
|
11
|
+
- copy-paste
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'The identifier .* may not be used more than once within the same scope'
|
|
14
|
+
flags: 'i'
|
|
15
|
+
- regex: 'TemplateValidationException.*may not be used more than once'
|
|
16
|
+
flags: 'i'
|
|
17
|
+
error_messages:
|
|
18
|
+
- "The workflow is not valid. .github/workflows/ci.yml (Line: N, Col: N): The identifier 'checkout'
|
|
19
|
+
may not be used more than once within the same scope."
|
|
20
|
+
- "The identifier 'meta' may not be used more than once within the same scope."
|
|
21
|
+
- "GitHub.DistributedTask.ObjectTemplating.TemplateValidationException: The template is not valid."
|
|
22
|
+
root_cause: |
|
|
23
|
+
Step IDs (`id:`) must be unique within a single job or composite action. If two or more
|
|
24
|
+
steps within the same scope share the same `id:` value, GitHub Actions rejects the entire
|
|
25
|
+
workflow before any step runs, throwing a `TemplateValidationException`.
|
|
26
|
+
|
|
27
|
+
Step IDs form the keys of the `steps` context object. Duplicate keys would make
|
|
28
|
+
`${{ steps.checkout.outputs.ref }}` ambiguous — the platform rejects this ambiguity at
|
|
29
|
+
parse time rather than silently choosing one arbitrarily at runtime.
|
|
30
|
+
|
|
31
|
+
The most common root cause is copy-pasting steps within a job — particularly repeating
|
|
32
|
+
`actions/checkout`, `docker/metadata-action`, or `actions/setup-node` blocks — without
|
|
33
|
+
updating or removing the `id:` field on the duplicate. Composite action authors also
|
|
34
|
+
hit this when a second action step is added without checking existing IDs.
|
|
35
|
+
|
|
36
|
+
The error message reports only the SECOND occurrence's line and column, not both —
|
|
37
|
+
making it harder to locate the original conflicting step in long step lists.
|
|
38
|
+
(Tracked as actions/runner#3121 as an open bug requesting improved error reporting.)
|
|
39
|
+
fix: |
|
|
40
|
+
Ensure every step that declares an `id:` uses a unique value within its job or composite
|
|
41
|
+
action scope. Steps that are not referenced by later steps can omit `id:` entirely —
|
|
42
|
+
only steps whose outputs are used in expressions (`${{ steps.X.outputs.Y }}`) need an ID.
|
|
43
|
+
fix_code:
|
|
44
|
+
- language: yaml
|
|
45
|
+
label: 'WRONG — duplicate id: "meta" causes TemplateValidationException'
|
|
46
|
+
code: |
|
|
47
|
+
jobs:
|
|
48
|
+
build:
|
|
49
|
+
runs-on: ubuntu-latest
|
|
50
|
+
steps:
|
|
51
|
+
- name: Extract metadata for Docker Hub
|
|
52
|
+
id: meta # first declaration
|
|
53
|
+
uses: docker/metadata-action@v5
|
|
54
|
+
with:
|
|
55
|
+
images: myorg/myapp
|
|
56
|
+
|
|
57
|
+
- name: Extract metadata for GHCR
|
|
58
|
+
id: meta # DUPLICATE — workflow rejected
|
|
59
|
+
uses: docker/metadata-action@v5
|
|
60
|
+
with:
|
|
61
|
+
images: ghcr.io/myorg/myapp
|
|
62
|
+
|
|
63
|
+
- uses: docker/build-push-action@v6
|
|
64
|
+
with:
|
|
65
|
+
tags: ${{ steps.meta.outputs.tags }}
|
|
66
|
+
- language: yaml
|
|
67
|
+
label: 'RIGHT — unique IDs for each step'
|
|
68
|
+
code: |
|
|
69
|
+
jobs:
|
|
70
|
+
build:
|
|
71
|
+
runs-on: ubuntu-latest
|
|
72
|
+
steps:
|
|
73
|
+
- name: Extract metadata for Docker Hub
|
|
74
|
+
id: meta-dockerhub
|
|
75
|
+
uses: docker/metadata-action@v5
|
|
76
|
+
with:
|
|
77
|
+
images: myorg/myapp
|
|
78
|
+
|
|
79
|
+
- name: Extract metadata for GHCR
|
|
80
|
+
id: meta-ghcr
|
|
81
|
+
uses: docker/metadata-action@v5
|
|
82
|
+
with:
|
|
83
|
+
images: ghcr.io/myorg/myapp
|
|
84
|
+
|
|
85
|
+
- name: Build and push to Docker Hub
|
|
86
|
+
uses: docker/build-push-action@v6
|
|
87
|
+
with:
|
|
88
|
+
tags: ${{ steps.meta-dockerhub.outputs.tags }}
|
|
89
|
+
labels: ${{ steps.meta-dockerhub.outputs.labels }}
|
|
90
|
+
|
|
91
|
+
- name: Build and push to GHCR
|
|
92
|
+
uses: docker/build-push-action@v6
|
|
93
|
+
with:
|
|
94
|
+
tags: ${{ steps.meta-ghcr.outputs.tags }}
|
|
95
|
+
labels: ${{ steps.meta-ghcr.outputs.labels }}
|
|
96
|
+
- language: yaml
|
|
97
|
+
label: 'RIGHT — omit id: on steps whose outputs are never referenced'
|
|
98
|
+
code: |
|
|
99
|
+
jobs:
|
|
100
|
+
build:
|
|
101
|
+
runs-on: ubuntu-latest
|
|
102
|
+
steps:
|
|
103
|
+
- uses: actions/checkout@v4
|
|
104
|
+
# No id: needed — outputs not referenced by other steps
|
|
105
|
+
|
|
106
|
+
- uses: actions/setup-node@v4
|
|
107
|
+
with:
|
|
108
|
+
node-version: '20'
|
|
109
|
+
# No id: needed — only referenced outputs need a step id
|
|
110
|
+
|
|
111
|
+
- id: version
|
|
112
|
+
run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
|
|
113
|
+
|
|
114
|
+
- run: echo "Building version ${{ steps.version.outputs.version }}"
|
|
115
|
+
prevention:
|
|
116
|
+
- 'When copy-pasting steps within a job, immediately update or remove the `id:` field on
|
|
117
|
+
the duplicate to avoid the conflict.'
|
|
118
|
+
- 'Use actionlint or a YAML linter locally before pushing — both catch duplicate step IDs
|
|
119
|
+
and report the error with line numbers for both occurrences.'
|
|
120
|
+
- 'Only assign `id:` to steps whose outputs are referenced in expressions elsewhere in the
|
|
121
|
+
job; leave unreferenced steps without `id:`.'
|
|
122
|
+
- 'Apply the same uniqueness rule to composite actions — step IDs within a composite action
|
|
123
|
+
must also be unique within the action file.'
|
|
124
|
+
docs:
|
|
125
|
+
- url: 'https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsid'
|
|
126
|
+
label: 'GitHub Docs: jobs.<job_id>.steps[*].id'
|
|
127
|
+
- url: 'https://github.com/actions/runner/issues/3121'
|
|
128
|
+
label: 'actions/runner#3121 — Request to improve duplicate step ID error message (Jan 2024)'
|
|
129
|
+
- url: 'https://ghlint.twisterrob.net/issues/default/DuplicateStepId/'
|
|
130
|
+
label: 'GH-Lint: DuplicateStepId rule documentation'
|
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
id: yaml-syntax-072
|
|
2
|
+
title: 'concurrency queue: max rejected as "Unknown Property" by act and actionlint (May 2026 schema lag)'
|
|
3
|
+
category: yaml-syntax
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- concurrency
|
|
7
|
+
- queue
|
|
8
|
+
- act
|
|
9
|
+
- actionlint
|
|
10
|
+
- schema-validation
|
|
11
|
+
- local-ci
|
|
12
|
+
- queue-max
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'Unknown Property queue'
|
|
15
|
+
flags: 'i'
|
|
16
|
+
- regex: 'Failed to match concurrency-mapping.*Unknown Property queue'
|
|
17
|
+
flags: 'is'
|
|
18
|
+
- regex: 'concurrency.*queue.*unknown|queue.*max.*schema.*invalid'
|
|
19
|
+
flags: 'i'
|
|
20
|
+
- regex: 'actionlint.*"queue".*unknown key'
|
|
21
|
+
flags: 'i'
|
|
22
|
+
error_messages:
|
|
23
|
+
- "Line: 4 Column 3: Unknown Property queue"
|
|
24
|
+
- "Failed to match concurrency-mapping: Line: 6 Column 3: Unknown Property queue"
|
|
25
|
+
- 'Actions YAML Schema Validation Error detected: Unknown Property queue'
|
|
26
|
+
- 'unknown key "queue" for "concurrency"'
|
|
27
|
+
root_cause: |
|
|
28
|
+
GitHub added the `queue` field to the concurrency block in May 2026 (Changelog:
|
|
29
|
+
"GitHub Actions concurrency groups now allow larger queues"). The new field accepts
|
|
30
|
+
`single` (default — one pending run) or `max` (up to 100 queued runs).
|
|
31
|
+
|
|
32
|
+
Local workflow tooling has not been updated to recognize this field:
|
|
33
|
+
|
|
34
|
+
- **nektos/act ≤0.2.88** — `pkg/schema/workflow_schema.json` defines `concurrency-mapping`
|
|
35
|
+
with only `group` and `cancel-in-progress`. Any workflow using `queue: max` or
|
|
36
|
+
`queue: single` fails immediately at schema validation, before any step runs.
|
|
37
|
+
|
|
38
|
+
- **rhysd/actionlint ≤1.7.8** — the actionlint parser similarly rejects `queue` as an
|
|
39
|
+
unknown concurrency key, blocking pre-commit hooks and CI lint gates.
|
|
40
|
+
|
|
41
|
+
This is a **tooling lag** — the workflow is perfectly valid on GitHub.com and runs
|
|
42
|
+
correctly in hosted runners. The failure only occurs in local development environments
|
|
43
|
+
and CI pipelines that use act or actionlint for pre-flight validation.
|
|
44
|
+
|
|
45
|
+
SchemaStore (github-workflow.json) already encodes the `queue` enum, so VS Code's
|
|
46
|
+
GitHub Actions extension does NOT exhibit this error.
|
|
47
|
+
fix: |
|
|
48
|
+
Until act and actionlint release updated versions with queue support, use one of:
|
|
49
|
+
|
|
50
|
+
1. Upgrade act to a version that includes PR #6097 (queue schema fix) — check
|
|
51
|
+
github.com/nektos/act for the minimum patched version.
|
|
52
|
+
|
|
53
|
+
2. Upgrade actionlint to a version that includes the fix for issue #657.
|
|
54
|
+
|
|
55
|
+
3. Skip schema validation for workflows that use queue (act: add --no-schema-valid flag;
|
|
56
|
+
actionlint: add -ignore 'queue' comment).
|
|
57
|
+
|
|
58
|
+
4. Temporarily remove queue: max while waiting for local tooling to catch up; GitHub.com
|
|
59
|
+
itself already supports it and local validation is the only blocker.
|
|
60
|
+
fix_code:
|
|
61
|
+
- language: yaml
|
|
62
|
+
label: 'Correct workflow syntax — valid on GitHub.com even if local tools reject it'
|
|
63
|
+
code: |
|
|
64
|
+
concurrency:
|
|
65
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
66
|
+
cancel-in-progress: false
|
|
67
|
+
queue: max # queues up to 100 pending runs instead of cancelling them
|
|
68
|
+
- language: yaml
|
|
69
|
+
label: 'Suppress actionlint error with inline ignore comment'
|
|
70
|
+
code: |
|
|
71
|
+
concurrency:
|
|
72
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
73
|
+
cancel-in-progress: false
|
|
74
|
+
queue: max # actionlint:ignore
|
|
75
|
+
- language: yaml
|
|
76
|
+
label: 'Skip act schema validation flag (temporary workaround)'
|
|
77
|
+
code: |
|
|
78
|
+
# In .actrc or CLI:
|
|
79
|
+
# act --no-schema-validate
|
|
80
|
+
prevention:
|
|
81
|
+
- 'Pin act and actionlint versions in your tooling and monitor their changelogs when GitHub Actions releases new YAML keys.'
|
|
82
|
+
- 'When a workflow is valid on GitHub.com but rejected locally, check if it uses a recently-added key (queue, timezone, etc.) that local tools have not caught up with.'
|
|
83
|
+
- 'Use the SchemaStore github-workflow.json schema in VS Code for real-time validation — it tends to be updated faster than act/actionlint.'
|
|
84
|
+
- 'Do not block PR merges on local-only actionlint errors when the same workflow runs successfully in GitHub Actions CI.'
|
|
85
|
+
docs:
|
|
86
|
+
- url: 'https://github.com/nektos/act/issues/6095'
|
|
87
|
+
label: 'nektos/act#6095 — concurrency.queue fails schema validation (May 2026)'
|
|
88
|
+
- url: 'https://github.com/rhysd/actionlint/issues/657'
|
|
89
|
+
label: 'rhysd/actionlint#657 — unknown key "queue" for concurrency'
|
|
90
|
+
- url: 'https://github.blog/changelog/2026-05-07-github-actions-concurrency-groups-now-allow-larger-queues/'
|
|
91
|
+
label: 'GitHub Changelog — concurrency groups now allow larger queues (May 2026)'
|
|
92
|
+
- url: 'https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#concurrencyqueue'
|
|
93
|
+
label: 'GitHub Docs — concurrency.queue syntax reference'
|
|
@@ -0,0 +1,103 @@
|
|
|
1
|
+
id: yaml-syntax-073
|
|
2
|
+
title: "setup-python 'python-version: 3.10' Parsed as YAML Float 3.1 — Wrong Python Version Installed"
|
|
3
|
+
category: yaml-syntax
|
|
4
|
+
severity: silent-failure
|
|
5
|
+
tags:
|
|
6
|
+
- setup-python
|
|
7
|
+
- yaml-float
|
|
8
|
+
- python-version
|
|
9
|
+
- version-mismatch
|
|
10
|
+
- silent-failure
|
|
11
|
+
patterns:
|
|
12
|
+
- regex: 'Version 3\.1 with arch .{0,20} not found'
|
|
13
|
+
flags: 'i'
|
|
14
|
+
- regex: "Installed Python 3\\.1\\."
|
|
15
|
+
flags: 'i'
|
|
16
|
+
- regex: 'python.version.*3\.10.*3\.1|3\.10.*yaml.*float'
|
|
17
|
+
flags: 'i'
|
|
18
|
+
error_messages:
|
|
19
|
+
- "Version 3.1 with arch x64 not found in the local, remote file."
|
|
20
|
+
- "Version 3.1 with arch x64 not found"
|
|
21
|
+
- "Installed Python 3.1.5"
|
|
22
|
+
- "Error: Version 3.1 was not found in the local cache"
|
|
23
|
+
root_cause: |
|
|
24
|
+
When 'python-version' is specified as a bare unquoted decimal like 3.10
|
|
25
|
+
in a workflow YAML file, the YAML parser interprets the value as a
|
|
26
|
+
floating-point number. The float representation of 3.10 is 3.1 (the
|
|
27
|
+
trailing zero is dropped during float-to-string conversion).
|
|
28
|
+
|
|
29
|
+
actions/setup-python then receives the string "3.1" and attempts to
|
|
30
|
+
install Python version 3.1.x. Python 3.1 is an extremely old release
|
|
31
|
+
from 2009 and is not available in the tool cache. The action either:
|
|
32
|
+
|
|
33
|
+
a) Fails with "Version 3.1 with arch x64 not found" — if the version
|
|
34
|
+
is not in the manifest (common on GitHub-hosted runners).
|
|
35
|
+
b) Silently installs the latest 3.1.x if one happens to be cached,
|
|
36
|
+
giving developers an unexpectedly old Python environment with no
|
|
37
|
+
warning.
|
|
38
|
+
|
|
39
|
+
Affected version strings: any Python version where the minor version
|
|
40
|
+
ends in zero (3.10, 3.20 if it existed, etc.) or has trailing decimal
|
|
41
|
+
zeros (3.10.0 → still has the problem if written unquoted as 3.10).
|
|
42
|
+
|
|
43
|
+
The same YAML float coercion affects other setup-* actions:
|
|
44
|
+
- setup-go with go-version: 1.20 → "1.2" (yaml-syntax-027)
|
|
45
|
+
- setup-node with node-version: 18.10 → "18.1"
|
|
46
|
+
This entry specifically covers setup-python.
|
|
47
|
+
fix: |
|
|
48
|
+
Always quote the python-version value in YAML to force the parser to
|
|
49
|
+
treat it as a string, not a number.
|
|
50
|
+
fix_code:
|
|
51
|
+
- language: yaml
|
|
52
|
+
label: "Wrong — unquoted 3.10 parsed as float 3.1"
|
|
53
|
+
code: |
|
|
54
|
+
- name: Set up Python
|
|
55
|
+
uses: actions/setup-python@v5
|
|
56
|
+
with:
|
|
57
|
+
python-version: 3.10 # ❌ YAML parses as float → installs 3.1.x
|
|
58
|
+
|
|
59
|
+
- language: yaml
|
|
60
|
+
label: "Fixed — quoted string forces correct version"
|
|
61
|
+
code: |
|
|
62
|
+
- name: Set up Python
|
|
63
|
+
uses: actions/setup-python@v5
|
|
64
|
+
with:
|
|
65
|
+
python-version: '3.10' # ✅ Quoted string → installs 3.10.x
|
|
66
|
+
|
|
67
|
+
- language: yaml
|
|
68
|
+
label: "Fixed — matrix with quoted python versions"
|
|
69
|
+
code: |
|
|
70
|
+
jobs:
|
|
71
|
+
test:
|
|
72
|
+
strategy:
|
|
73
|
+
matrix:
|
|
74
|
+
python-version: ['3.9', '3.10', '3.11', '3.12']
|
|
75
|
+
# ^^^^^^ ^^^^^^ ^^^^^^ ^^^^^^
|
|
76
|
+
# All quoted — prevents YAML float coercion for any version
|
|
77
|
+
steps:
|
|
78
|
+
- uses: actions/setup-python@v5
|
|
79
|
+
with:
|
|
80
|
+
python-version: ${{ matrix.python-version }}
|
|
81
|
+
|
|
82
|
+
- language: yaml
|
|
83
|
+
label: "Alternative — use python-version-file to avoid manual version strings"
|
|
84
|
+
code: |
|
|
85
|
+
- uses: actions/setup-python@v5
|
|
86
|
+
with:
|
|
87
|
+
python-version-file: '.python-version'
|
|
88
|
+
# .python-version file contains: 3.10.14
|
|
89
|
+
# File-based version is read as plain text, not YAML — no float risk
|
|
90
|
+
|
|
91
|
+
prevention:
|
|
92
|
+
- "Always quote python-version values in YAML: '3.10' not 3.10."
|
|
93
|
+
- "Use python-version-file: '.python-version' or pyproject.toml to read version from a non-YAML source."
|
|
94
|
+
- "Apply the same quoting rule to all setup-* version inputs: '1.20' for Go, '18.10' for Node."
|
|
95
|
+
- "Run actionlint — it warns about unquoted version strings in matrix definitions."
|
|
96
|
+
- "Check 'Set up Python' step output in the Actions log — it shows the resolved version string."
|
|
97
|
+
docs:
|
|
98
|
+
- url: "https://github.com/actions/setup-python/issues/160"
|
|
99
|
+
label: "actions/setup-python#160 — python-version 3.10 parsed as float 3.1 (109 reactions)"
|
|
100
|
+
- url: "https://yaml.org/spec/1.2.2/#floating-point-scalars"
|
|
101
|
+
label: "YAML spec — floating-point scalar parsing rules"
|
|
102
|
+
- url: "https://github.com/actions/setup-python#supported-version-syntax"
|
|
103
|
+
label: "actions/setup-python — supported version syntax"
|
package/package.json
CHANGED