@htekdev/actions-debugger 1.0.117 → 1.0.119

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/errors/caching-artifacts/caching-artifacts-069.yml +133 -0
  2. package/errors/caching-artifacts/caching-artifacts-070.yml +94 -0
  3. package/errors/concurrency-timing/concurrency-timing-056.yml +127 -0
  4. package/errors/concurrency-timing/concurrency-timing-057.yml +115 -0
  5. package/errors/concurrency-timing/workflow-run-head-branch-null-schedule-dispatch-concurrency.yml +135 -0
  6. package/errors/known-unsolved/known-unsolved-067.yml +117 -0
  7. package/errors/known-unsolved/known-unsolved-068.yml +124 -0
  8. package/errors/known-unsolved/node-action-post-step-wrong-inputs-nested-composite.yml +133 -0
  9. package/errors/known-unsolved/ubuntu-24-04-arm64-missing-binder-ashmem-kernel-modules.yml +149 -0
  10. package/errors/permissions-auth/permissions-auth-069.yml +161 -0
  11. package/errors/runner-environment/arc-autoscalinglistener-ephemeralrunnerset-stale-after-upgrade.yml +134 -0
  12. package/errors/runner-environment/broker-server-socket-exception-nat-timeout-linux.yml +114 -0
  13. package/errors/runner-environment/runner-environment-210.yml +105 -0
  14. package/errors/runner-environment/runner-environment-213.yml +142 -0
  15. package/errors/runner-environment/runner-environment-214.yml +107 -0
  16. package/errors/runner-environment/runner-environment-215.yml +93 -0
  17. package/errors/runner-environment/runner-environment-216.yml +82 -0
  18. package/errors/runner-environment/runner-environment-217.yml +99 -0
  19. package/errors/runner-environment/runner-environment-218.yml +111 -0
  20. package/errors/runner-environment/ubuntu-24-man-db-dpkg-trigger-apt-install-stall.yml +94 -0
  21. package/errors/runner-environment/ubuntu-26-04-missing-preinstalled-tools.yml +178 -0
  22. package/errors/runner-environment/upload-artifact-v6-proxy-headers-leak-strict-proxy-fail.yml +101 -0
  23. package/errors/silent-failures/silent-failures-108.yml +108 -0
  24. package/errors/silent-failures/silent-failures-109.yml +119 -0
  25. package/errors/silent-failures/silent-failures-110.yml +91 -0
  26. package/errors/silent-failures/silent-failures-111.yml +107 -0
  27. package/errors/triggers/pull-request-labeled-fires-all-labels-no-name-filter.yml +110 -0
  28. package/errors/yaml-syntax/duplicate-step-id-within-job-scope-validation-error.yml +130 -0
  29. package/errors/yaml-syntax/yaml-syntax-072.yml +93 -0
  30. package/errors/yaml-syntax/yaml-syntax-073.yml +103 -0
  31. package/package.json +1 -1
@@ -0,0 +1,107 @@
1
+ id: silent-failures-111
2
+ title: '`helm list` shows all release states by default in Helm 4 — scripts silently return unexpected releases'
3
+ category: silent-failures
4
+ severity: silent-failure
5
+ tags:
6
+ - helm
7
+ - helm-4
8
+ - ubuntu-26
9
+ - tool-upgrade
10
+ - output-change
11
+ - deploy-check
12
+ patterns:
13
+ - regex: 'helm list'
14
+ flags: 'i'
15
+ error_messages:
16
+ - '# No error message — helm list exits 0 but returns FAILED/SUPERSEDED/UNINSTALLED releases alongside DEPLOYED ones'
17
+ root_cause: |
18
+ In Helm 3, `helm list` (without flags) only returned releases in the DEPLOYED
19
+ state. To see releases in all states, you had to pass `-a`/`--all`.
20
+
21
+ In Helm 4 (installed on ubuntu-26.04), `helm list` returns releases of ALL
22
+ states by default: DEPLOYED, FAILED, SUPERSEDED, UNINSTALLED, PENDING_INSTALL,
23
+ PENDING_UPGRADE, PENDING_ROLLBACK. The `-a`/`--all` flag was temporarily removed
24
+ (helm/helm#31784) and restored as a deprecated no-op in Helm 4.1.1+.
25
+
26
+ This causes silent failures in two common patterns:
27
+
28
+ 1. **Existence check**: `helm list --filter my-release | grep my-release` returns
29
+ a match even if the release is in a FAILED state, causing a subsequent
30
+ `helm upgrade` to proceed when `helm install` should have been used instead
31
+ (or vice versa).
32
+
33
+ 2. **Release count**: Scripts that count `helm list | wc -l` to assert a number
34
+ of deployed releases now count more releases than expected.
35
+
36
+ 3. **CI deploy gate**: Pipelines that run `helm list` to verify a deployment
37
+ succeeded will see FAILED releases included in output and may incorrectly
38
+ conclude the deployment is present/healthy.
39
+
40
+ No error is thrown — `helm list` exits 0 in all cases. The bug is in the
41
+ consuming script's assumption about Helm 3 behavior.
42
+ fix: |
43
+ Filter `helm list` output explicitly by state using the `--deployed` flag
44
+ or the `--filter`+`--output json` approach to check actual release status.
45
+
46
+ In Helm 4, use `helm status <release>` to get the definitive state of a
47
+ specific release rather than parsing `helm list` output.
48
+ fix_code:
49
+ - language: yaml
50
+ label: 'Use --deployed flag to replicate Helm 3 default behavior'
51
+ code: |
52
+ - name: Check if release is deployed
53
+ run: |
54
+ # Helm 4 on ubuntu-26.04: helm list shows ALL states by default.
55
+ # Use --deployed to replicate Helm 3 default behavior:
56
+ DEPLOYED=$(helm list --deployed --filter "^my-release$" --short)
57
+ if [ -n "$DEPLOYED" ]; then
58
+ echo "Release is deployed — running upgrade"
59
+ helm upgrade my-release ./chart
60
+ else
61
+ echo "No deployed release found — running install"
62
+ helm install my-release ./chart
63
+ fi
64
+
65
+ - language: yaml
66
+ label: 'Use helm status for definitive state check'
67
+ code: |
68
+ - name: Check release status
69
+ run: |
70
+ # helm status exits non-zero if the release does not exist.
71
+ # Use --output json to get machine-parseable state:
72
+ STATUS=$(helm status my-release --output json 2>/dev/null | jq -r '.info.status' || echo "not-found")
73
+ echo "Release status: $STATUS"
74
+ if [ "$STATUS" = "deployed" ]; then
75
+ echo "Healthy — proceeding"
76
+ elif [ "$STATUS" = "failed" ]; then
77
+ echo "Previous install failed — rolling back before upgrade"
78
+ helm rollback my-release 0 # Roll back to last successful
79
+ else
80
+ echo "Installing fresh"
81
+ helm install my-release ./chart
82
+ fi
83
+
84
+ - language: yaml
85
+ label: 'Use helm list --output json for precise state parsing'
86
+ code: |
87
+ - name: List only deployed releases
88
+ run: |
89
+ # Explicitly request only DEPLOYED state, output JSON for safe parsing:
90
+ helm list --deployed --output json | jq '.[] | .name + " (" + .status + ")"'
91
+ # Do NOT rely on: helm list | grep release-name
92
+ # In Helm 4, this matches FAILED/SUPERSEDED releases too.
93
+ prevention:
94
+ - "Never use `helm list | grep <release>` as a deployment check — it matches any release state in Helm 4."
95
+ - "Use `helm list --deployed` or `helm status <release>` for definitive deployed-state checks."
96
+ - "When migrating to ubuntu-26.04, audit all scripts that parse `helm list` output."
97
+ - "Add `--output json` to `helm list` calls and parse `status` field explicitly rather than relying on line-presence checks."
98
+ - "Pin Helm 3 with `azure/setup-helm` if your scripts are not yet Helm 4 compatible."
99
+ docs:
100
+ - url: 'https://github.com/helm/helm/issues/31784'
101
+ label: 'helm/helm#31784 — Breaking change to helm list CLI command in v4'
102
+ - url: 'https://helm.sh/docs/topics/v4_migration/'
103
+ label: 'Helm v4 Migration Guide'
104
+ - url: 'https://helm.sh/docs/helm/helm_list/'
105
+ label: 'helm list command reference'
106
+ - url: 'https://github.com/actions/runner-images/commit/9e3319d6b4acc306925295853d0ff41ddd5c40f0'
107
+ label: 'runner-images commit: ubuntu-26.04 installs Helm 4'
@@ -0,0 +1,110 @@
1
+ id: triggers-070
2
+ title: '`on: pull_request: types: [labeled]` fires for every label applied to a PR —
3
+ no trigger-level label-name filter exists; must use `if:` condition'
4
+ category: triggers
5
+ severity: silent-failure
6
+ tags:
7
+ - pull_request
8
+ - labeled
9
+ - label
10
+ - types
11
+ - label-name-filter
12
+ - deployment-gate
13
+ patterns:
14
+ - regex: 'types:\s*[\[\n].*labeled'
15
+ flags: 'si'
16
+ error_messages:
17
+ - "No error — workflow runs for every label applied to the PR, including unrelated labels"
18
+ - "No error — workflow run count is higher than expected; runs appear for all label events"
19
+ root_cause: |
20
+ When `types: [labeled]` is added to a `pull_request` trigger, the workflow fires for
21
+ EVERY label applied to the pull request — not only a specific label. There is no
22
+ trigger-level filter for label names. GitHub Actions does not support syntax like
23
+ `types: [labeled: 'deploy-preview']` or `label: 'X'` at the trigger level.
24
+
25
+ Teams building label-gated workflows (deploy-preview, run-integration-tests,
26
+ approved-for-staging, force-rebuild) are surprised to find the workflow fires for
27
+ entirely unrelated labels ('bug', 'enhancement', 'wontfix', 'good first issue').
28
+ The result is:
29
+ - Excessive workflow runs that show up in the Actions tab for every label event
30
+ - Wasted CI minutes for runs that skip all meaningful steps
31
+ - Unexpected side effects if the workflow performs mutations (deploy, comment, notify)
32
+ that should only happen for the specific label
33
+
34
+ This is distinct from the related issue triggers-030 ("labeled NOT in default types"):
35
+ - triggers-030: workflow NEVER fires because labeled is missing from default types
36
+ - triggers-070: workflow fires TOO OFTEN because ALL label events trigger it
37
+
38
+ The behavior is documented: `types: [labeled]` is a webhook activity type filter,
39
+ not a payload content filter. Payload-level filtering (label name, PR author, etc.)
40
+ must be done via `if:` conditions on jobs or steps.
41
+ fix: |
42
+ Add a job-level `if:` condition filtering on `github.event.label.name`. This is the
43
+ only mechanism — no trigger-level label-name filtering exists.
44
+
45
+ Key context properties for label-based filtering:
46
+ - `github.event.action` — 'labeled' or 'unlabeled'
47
+ - `github.event.label.name` — the label JUST applied (only set for labeled/unlabeled events)
48
+ - `github.event.pull_request.labels.*.name` — ALL current labels on the PR (useful for
49
+ opened/synchronize/reopened events where a label may already be present)
50
+ fix_code:
51
+ - language: yaml
52
+ label: 'WRONG — fires for every label including unrelated ones'
53
+ code: |
54
+ on:
55
+ pull_request:
56
+ types: [labeled]
57
+
58
+ jobs:
59
+ deploy-preview:
60
+ runs-on: ubuntu-latest
61
+ steps:
62
+ - run: echo "Deploying preview..."
63
+ # Runs for EVERY label: 'bug', 'wontfix', 'enhancement', 'deploy-preview', etc.
64
+ - language: yaml
65
+ label: 'RIGHT — filter by specific label name with job-level if:'
66
+ code: |
67
+ on:
68
+ pull_request:
69
+ types: [labeled]
70
+
71
+ jobs:
72
+ deploy-preview:
73
+ if: github.event.label.name == 'deploy-preview'
74
+ runs-on: ubuntu-latest
75
+ steps:
76
+ - run: echo "Deploying preview for PR #${{ github.event.pull_request.number }}"
77
+ - language: yaml
78
+ label: 'RIGHT — label gate that works for both labeled events AND already-labeled PRs'
79
+ code: |
80
+ on:
81
+ pull_request:
82
+ types:
83
+ - opened
84
+ - synchronize
85
+ - reopened
86
+ - labeled # fires when any label is applied; filter below by name
87
+
88
+ jobs:
89
+ deploy-preview:
90
+ if: |
91
+ (github.event.action == 'labeled' && github.event.label.name == 'deploy-preview') ||
92
+ (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'deploy-preview'))
93
+ runs-on: ubuntu-latest
94
+ steps:
95
+ - run: echo "Deploying preview..."
96
+ prevention:
97
+ - "Always pair `types: [labeled]` with `if: github.event.label.name == 'your-label'` at the job
98
+ level to gate on the specific label."
99
+ - 'Document which label triggers which workflow in a comment near the trigger definition.'
100
+ - 'Test label-gated workflows by applying both the expected label AND an unrelated label to verify
101
+ the `if:` filter correctly skips unintended runs.'
102
+ - 'Consider using only `types: [labeled]` (not opened/sync/reopened) if the workflow should only
103
+ run when the label is freshly applied, not on every code push to already-labeled PRs.'
104
+ docs:
105
+ - url: 'https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request'
106
+ label: 'GitHub Docs: pull_request event — labeled activity type'
107
+ - url: 'https://docs.github.com/en/webhooks/webhook-events-and-payloads#pull_request'
108
+ label: 'GitHub Webhook Docs: pull_request payload (label field)'
109
+ - url: 'https://stackoverflow.com/questions/62325286/run-github-actions-when-pull-requests-have-a-specific-label'
110
+ label: 'Stack Overflow: Run GitHub Actions when pull requests have a specific label (43 votes)'
@@ -0,0 +1,130 @@
1
+ id: yaml-syntax-071
2
+ title: 'Duplicate `id:` values within the same job or composite action cause instant
3
+ workflow validation failure'
4
+ category: yaml-syntax
5
+ severity: error
6
+ tags:
7
+ - step-id
8
+ - duplicate
9
+ - validation
10
+ - composite-action
11
+ - copy-paste
12
+ patterns:
13
+ - regex: 'The identifier .* may not be used more than once within the same scope'
14
+ flags: 'i'
15
+ - regex: 'TemplateValidationException.*may not be used more than once'
16
+ flags: 'i'
17
+ error_messages:
18
+ - "The workflow is not valid. .github/workflows/ci.yml (Line: N, Col: N): The identifier 'checkout'
19
+ may not be used more than once within the same scope."
20
+ - "The identifier 'meta' may not be used more than once within the same scope."
21
+ - "GitHub.DistributedTask.ObjectTemplating.TemplateValidationException: The template is not valid."
22
+ root_cause: |
23
+ Step IDs (`id:`) must be unique within a single job or composite action. If two or more
24
+ steps within the same scope share the same `id:` value, GitHub Actions rejects the entire
25
+ workflow before any step runs, throwing a `TemplateValidationException`.
26
+
27
+ Step IDs form the keys of the `steps` context object. Duplicate keys would make
28
+ `${{ steps.checkout.outputs.ref }}` ambiguous — the platform rejects this ambiguity at
29
+ parse time rather than silently choosing one arbitrarily at runtime.
30
+
31
+ The most common root cause is copy-pasting steps within a job — particularly repeating
32
+ `actions/checkout`, `docker/metadata-action`, or `actions/setup-node` blocks — without
33
+ updating or removing the `id:` field on the duplicate. Composite action authors also
34
+ hit this when a second action step is added without checking existing IDs.
35
+
36
+ The error message reports only the SECOND occurrence's line and column, not both —
37
+ making it harder to locate the original conflicting step in long step lists.
38
+ (Tracked as actions/runner#3121 as an open bug requesting improved error reporting.)
39
+ fix: |
40
+ Ensure every step that declares an `id:` uses a unique value within its job or composite
41
+ action scope. Steps that are not referenced by later steps can omit `id:` entirely —
42
+ only steps whose outputs are used in expressions (`${{ steps.X.outputs.Y }}`) need an ID.
43
+ fix_code:
44
+ - language: yaml
45
+ label: 'WRONG — duplicate id: "meta" causes TemplateValidationException'
46
+ code: |
47
+ jobs:
48
+ build:
49
+ runs-on: ubuntu-latest
50
+ steps:
51
+ - name: Extract metadata for Docker Hub
52
+ id: meta # first declaration
53
+ uses: docker/metadata-action@v5
54
+ with:
55
+ images: myorg/myapp
56
+
57
+ - name: Extract metadata for GHCR
58
+ id: meta # DUPLICATE — workflow rejected
59
+ uses: docker/metadata-action@v5
60
+ with:
61
+ images: ghcr.io/myorg/myapp
62
+
63
+ - uses: docker/build-push-action@v6
64
+ with:
65
+ tags: ${{ steps.meta.outputs.tags }}
66
+ - language: yaml
67
+ label: 'RIGHT — unique IDs for each step'
68
+ code: |
69
+ jobs:
70
+ build:
71
+ runs-on: ubuntu-latest
72
+ steps:
73
+ - name: Extract metadata for Docker Hub
74
+ id: meta-dockerhub
75
+ uses: docker/metadata-action@v5
76
+ with:
77
+ images: myorg/myapp
78
+
79
+ - name: Extract metadata for GHCR
80
+ id: meta-ghcr
81
+ uses: docker/metadata-action@v5
82
+ with:
83
+ images: ghcr.io/myorg/myapp
84
+
85
+ - name: Build and push to Docker Hub
86
+ uses: docker/build-push-action@v6
87
+ with:
88
+ tags: ${{ steps.meta-dockerhub.outputs.tags }}
89
+ labels: ${{ steps.meta-dockerhub.outputs.labels }}
90
+
91
+ - name: Build and push to GHCR
92
+ uses: docker/build-push-action@v6
93
+ with:
94
+ tags: ${{ steps.meta-ghcr.outputs.tags }}
95
+ labels: ${{ steps.meta-ghcr.outputs.labels }}
96
+ - language: yaml
97
+ label: 'RIGHT — omit id: on steps whose outputs are never referenced'
98
+ code: |
99
+ jobs:
100
+ build:
101
+ runs-on: ubuntu-latest
102
+ steps:
103
+ - uses: actions/checkout@v4
104
+ # No id: needed — outputs not referenced by other steps
105
+
106
+ - uses: actions/setup-node@v4
107
+ with:
108
+ node-version: '20'
109
+ # No id: needed — only referenced outputs need a step id
110
+
111
+ - id: version
112
+ run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
113
+
114
+ - run: echo "Building version ${{ steps.version.outputs.version }}"
115
+ prevention:
116
+ - 'When copy-pasting steps within a job, immediately update or remove the `id:` field on
117
+ the duplicate to avoid the conflict.'
118
+ - 'Use actionlint or a YAML linter locally before pushing — both catch duplicate step IDs
119
+ and report the error with line numbers for both occurrences.'
120
+ - 'Only assign `id:` to steps whose outputs are referenced in expressions elsewhere in the
121
+ job; leave unreferenced steps without `id:`.'
122
+ - 'Apply the same uniqueness rule to composite actions — step IDs within a composite action
123
+ must also be unique within the action file.'
124
+ docs:
125
+ - url: 'https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsid'
126
+ label: 'GitHub Docs: jobs.<job_id>.steps[*].id'
127
+ - url: 'https://github.com/actions/runner/issues/3121'
128
+ label: 'actions/runner#3121 — Request to improve duplicate step ID error message (Jan 2024)'
129
+ - url: 'https://ghlint.twisterrob.net/issues/default/DuplicateStepId/'
130
+ label: 'GH-Lint: DuplicateStepId rule documentation'
@@ -0,0 +1,93 @@
1
+ id: yaml-syntax-072
2
+ title: 'concurrency queue: max rejected as "Unknown Property" by act and actionlint (May 2026 schema lag)'
3
+ category: yaml-syntax
4
+ severity: error
5
+ tags:
6
+ - concurrency
7
+ - queue
8
+ - act
9
+ - actionlint
10
+ - schema-validation
11
+ - local-ci
12
+ - queue-max
13
+ patterns:
14
+ - regex: 'Unknown Property queue'
15
+ flags: 'i'
16
+ - regex: 'Failed to match concurrency-mapping.*Unknown Property queue'
17
+ flags: 'is'
18
+ - regex: 'concurrency.*queue.*unknown|queue.*max.*schema.*invalid'
19
+ flags: 'i'
20
+ - regex: 'actionlint.*"queue".*unknown key'
21
+ flags: 'i'
22
+ error_messages:
23
+ - "Line: 4 Column 3: Unknown Property queue"
24
+ - "Failed to match concurrency-mapping: Line: 6 Column 3: Unknown Property queue"
25
+ - 'Actions YAML Schema Validation Error detected: Unknown Property queue'
26
+ - 'unknown key "queue" for "concurrency"'
27
+ root_cause: |
28
+ GitHub added the `queue` field to the concurrency block in May 2026 (Changelog:
29
+ "GitHub Actions concurrency groups now allow larger queues"). The new field accepts
30
+ `single` (default — one pending run) or `max` (up to 100 queued runs).
31
+
32
+ Local workflow tooling has not been updated to recognize this field:
33
+
34
+ - **nektos/act ≤0.2.88** — `pkg/schema/workflow_schema.json` defines `concurrency-mapping`
35
+ with only `group` and `cancel-in-progress`. Any workflow using `queue: max` or
36
+ `queue: single` fails immediately at schema validation, before any step runs.
37
+
38
+ - **rhysd/actionlint ≤1.7.8** — the actionlint parser similarly rejects `queue` as an
39
+ unknown concurrency key, blocking pre-commit hooks and CI lint gates.
40
+
41
+ This is a **tooling lag** — the workflow is perfectly valid on GitHub.com and runs
42
+ correctly in hosted runners. The failure only occurs in local development environments
43
+ and CI pipelines that use act or actionlint for pre-flight validation.
44
+
45
+ SchemaStore (github-workflow.json) already encodes the `queue` enum, so VS Code's
46
+ GitHub Actions extension does NOT exhibit this error.
47
+ fix: |
48
+ Until act and actionlint release updated versions with queue support, use one of:
49
+
50
+ 1. Upgrade act to a version that includes PR #6097 (queue schema fix) — check
51
+ github.com/nektos/act for the minimum patched version.
52
+
53
+ 2. Upgrade actionlint to a version that includes the fix for issue #657.
54
+
55
+ 3. Skip schema validation for workflows that use queue (act: add --no-schema-valid flag;
56
+ actionlint: add -ignore 'queue' comment).
57
+
58
+ 4. Temporarily remove queue: max while waiting for local tooling to catch up; GitHub.com
59
+ itself already supports it and local validation is the only blocker.
60
+ fix_code:
61
+ - language: yaml
62
+ label: 'Correct workflow syntax — valid on GitHub.com even if local tools reject it'
63
+ code: |
64
+ concurrency:
65
+ group: ${{ github.workflow }}-${{ github.ref }}
66
+ cancel-in-progress: false
67
+ queue: max # queues up to 100 pending runs instead of cancelling them
68
+ - language: yaml
69
+ label: 'Suppress actionlint error with inline ignore comment'
70
+ code: |
71
+ concurrency:
72
+ group: ${{ github.workflow }}-${{ github.ref }}
73
+ cancel-in-progress: false
74
+ queue: max # actionlint:ignore
75
+ - language: yaml
76
+ label: 'Skip act schema validation flag (temporary workaround)'
77
+ code: |
78
+ # In .actrc or CLI:
79
+ # act --no-schema-validate
80
+ prevention:
81
+ - 'Pin act and actionlint versions in your tooling and monitor their changelogs when GitHub Actions releases new YAML keys.'
82
+ - 'When a workflow is valid on GitHub.com but rejected locally, check if it uses a recently-added key (queue, timezone, etc.) that local tools have not caught up with.'
83
+ - 'Use the SchemaStore github-workflow.json schema in VS Code for real-time validation — it tends to be updated faster than act/actionlint.'
84
+ - 'Do not block PR merges on local-only actionlint errors when the same workflow runs successfully in GitHub Actions CI.'
85
+ docs:
86
+ - url: 'https://github.com/nektos/act/issues/6095'
87
+ label: 'nektos/act#6095 — concurrency.queue fails schema validation (May 2026)'
88
+ - url: 'https://github.com/rhysd/actionlint/issues/657'
89
+ label: 'rhysd/actionlint#657 — unknown key "queue" for concurrency'
90
+ - url: 'https://github.blog/changelog/2026-05-07-github-actions-concurrency-groups-now-allow-larger-queues/'
91
+ label: 'GitHub Changelog — concurrency groups now allow larger queues (May 2026)'
92
+ - url: 'https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#concurrencyqueue'
93
+ label: 'GitHub Docs — concurrency.queue syntax reference'
@@ -0,0 +1,103 @@
1
+ id: yaml-syntax-073
2
+ title: "setup-python 'python-version: 3.10' Parsed as YAML Float 3.1 — Wrong Python Version Installed"
3
+ category: yaml-syntax
4
+ severity: silent-failure
5
+ tags:
6
+ - setup-python
7
+ - yaml-float
8
+ - python-version
9
+ - version-mismatch
10
+ - silent-failure
11
+ patterns:
12
+ - regex: 'Version 3\.1 with arch .{0,20} not found'
13
+ flags: 'i'
14
+ - regex: "Installed Python 3\\.1\\."
15
+ flags: 'i'
16
+ - regex: 'python.version.*3\.10.*3\.1|3\.10.*yaml.*float'
17
+ flags: 'i'
18
+ error_messages:
19
+ - "Version 3.1 with arch x64 not found in the local, remote file."
20
+ - "Version 3.1 with arch x64 not found"
21
+ - "Installed Python 3.1.5"
22
+ - "Error: Version 3.1 was not found in the local cache"
23
+ root_cause: |
24
+ When 'python-version' is specified as a bare unquoted decimal like 3.10
25
+ in a workflow YAML file, the YAML parser interprets the value as a
26
+ floating-point number. The float representation of 3.10 is 3.1 (the
27
+ trailing zero is dropped during float-to-string conversion).
28
+
29
+ actions/setup-python then receives the string "3.1" and attempts to
30
+ install Python version 3.1.x. Python 3.1 is an extremely old release
31
+ from 2009 and is not available in the tool cache. The action either:
32
+
33
+ a) Fails with "Version 3.1 with arch x64 not found" — if the version
34
+ is not in the manifest (common on GitHub-hosted runners).
35
+ b) Silently installs the latest 3.1.x if one happens to be cached,
36
+ giving developers an unexpectedly old Python environment with no
37
+ warning.
38
+
39
+ Affected version strings: any Python version where the minor version
40
+ ends in zero (3.10, 3.20 if it existed, etc.) or has trailing decimal
41
+ zeros (3.10.0 → still has the problem if written unquoted as 3.10).
42
+
43
+ The same YAML float coercion affects other setup-* actions:
44
+ - setup-go with go-version: 1.20 → "1.2" (yaml-syntax-027)
45
+ - setup-node with node-version: 18.10 → "18.1"
46
+ This entry specifically covers setup-python.
47
+ fix: |
48
+ Always quote the python-version value in YAML to force the parser to
49
+ treat it as a string, not a number.
50
+ fix_code:
51
+ - language: yaml
52
+ label: "Wrong — unquoted 3.10 parsed as float 3.1"
53
+ code: |
54
+ - name: Set up Python
55
+ uses: actions/setup-python@v5
56
+ with:
57
+ python-version: 3.10 # ❌ YAML parses as float → installs 3.1.x
58
+
59
+ - language: yaml
60
+ label: "Fixed — quoted string forces correct version"
61
+ code: |
62
+ - name: Set up Python
63
+ uses: actions/setup-python@v5
64
+ with:
65
+ python-version: '3.10' # ✅ Quoted string → installs 3.10.x
66
+
67
+ - language: yaml
68
+ label: "Fixed — matrix with quoted python versions"
69
+ code: |
70
+ jobs:
71
+ test:
72
+ strategy:
73
+ matrix:
74
+ python-version: ['3.9', '3.10', '3.11', '3.12']
75
+ # ^^^^^^ ^^^^^^ ^^^^^^ ^^^^^^
76
+ # All quoted — prevents YAML float coercion for any version
77
+ steps:
78
+ - uses: actions/setup-python@v5
79
+ with:
80
+ python-version: ${{ matrix.python-version }}
81
+
82
+ - language: yaml
83
+ label: "Alternative — use python-version-file to avoid manual version strings"
84
+ code: |
85
+ - uses: actions/setup-python@v5
86
+ with:
87
+ python-version-file: '.python-version'
88
+ # .python-version file contains: 3.10.14
89
+ # File-based version is read as plain text, not YAML — no float risk
90
+
91
+ prevention:
92
+ - "Always quote python-version values in YAML: '3.10' not 3.10."
93
+ - "Use python-version-file: '.python-version' or pyproject.toml to read version from a non-YAML source."
94
+ - "Apply the same quoting rule to all setup-* version inputs: '1.20' for Go, '18.10' for Node."
95
+ - "Run actionlint — it warns about unquoted version strings in matrix definitions."
96
+ - "Check 'Set up Python' step output in the Actions log — it shows the resolved version string."
97
+ docs:
98
+ - url: "https://github.com/actions/setup-python/issues/160"
99
+ label: "actions/setup-python#160 — python-version 3.10 parsed as float 3.1 (109 reactions)"
100
+ - url: "https://yaml.org/spec/1.2.2/#floating-point-scalars"
101
+ label: "YAML spec — floating-point scalar parsing rules"
102
+ - url: "https://github.com/actions/setup-python#supported-version-syntax"
103
+ label: "actions/setup-python — supported version syntax"
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@htekdev/actions-debugger",
3
- "version": "1.0.117",
3
+ "version": "1.0.119",
4
4
  "description": "65+ real GitHub Actions errors, queryable by agents. CLI + MCP server + Copilot skills + error database.",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",