@htekdev/actions-debugger 1.0.123 → 1.0.125
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/errors/caching-artifacts/caching-artifacts-073.yml +100 -0
- package/errors/caching-artifacts/caching-artifacts-074.yml +117 -0
- package/errors/known-unsolved/known-unsolved-070.yml +83 -0
- package/errors/known-unsolved/known-unsolved-071.yml +122 -0
- package/errors/known-unsolved/known-unsolved-072.yml +143 -0
- package/errors/permissions-auth/permissions-auth-071.yml +144 -0
- package/errors/permissions-auth/permissions-auth-072.yml +112 -0
- package/errors/permissions-auth/permissions-auth-073.yml +127 -0
- package/errors/permissions-auth/permissions-auth-074.yml +106 -0
- package/errors/permissions-auth/permissions-auth-075.yml +137 -0
- package/errors/runner-environment/runner-environment-224.yml +74 -0
- package/errors/runner-environment/runner-environment-225.yml +85 -0
- package/errors/runner-environment/runner-environment-226.yml +91 -0
- package/errors/runner-environment/runner-environment-227.yml +106 -0
- package/errors/runner-environment/runner-environment-228.yml +117 -0
- package/errors/runner-environment/runner-environment-229.yml +119 -0
- package/errors/runner-environment/runner-environment-230.yml +129 -0
- package/errors/runner-environment/runner-environment-231.yml +90 -0
- package/errors/runner-environment/runner-environment-232.yml +131 -0
- package/errors/runner-environment/runner-environment-233.yml +90 -0
- package/errors/runner-environment/runner-environment-234.yml +114 -0
- package/errors/runner-environment/runner-environment-235.yml +151 -0
- package/errors/silent-failures/silent-failures-112.yml +97 -0
- package/errors/silent-failures/silent-failures-113.yml +110 -0
- package/errors/silent-failures/silent-failures-114.yml +116 -0
- package/errors/silent-failures/silent-failures-115.yml +130 -0
- package/errors/silent-failures/silent-failures-116.yml +117 -0
- package/errors/silent-failures/silent-failures-117.yml +137 -0
- package/errors/silent-failures/silent-failures-118.yml +156 -0
- package/errors/yaml-syntax/yaml-syntax-075.yml +128 -0
- package/errors/yaml-syntax/yaml-syntax-076.yml +107 -0
- package/package.json +1 -1
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
id: runner-environment-224
|
|
2
|
+
title: 'windows-2025-vs2026 UWP builds with PlatformToolset v143 fail with MSB8020'
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- windows
|
|
7
|
+
- uwp
|
|
8
|
+
- msvc
|
|
9
|
+
- vs2026
|
|
10
|
+
- v143
|
|
11
|
+
- v145
|
|
12
|
+
- msbuild
|
|
13
|
+
- migration
|
|
14
|
+
patterns:
|
|
15
|
+
- regex: 'MSB8020: The build tools for ''v143'' application Type UWP \(Platform Toolset = ''Visual Studio 2022''\) cannot be found'
|
|
16
|
+
flags: i
|
|
17
|
+
- regex: '<PlatformToolset>v143</PlatformToolset>'
|
|
18
|
+
flags: i
|
|
19
|
+
- regex: 'windows-2025-vs2026'
|
|
20
|
+
flags: i
|
|
21
|
+
error_messages:
|
|
22
|
+
- 'MSBUILD : error MSB8020: The build tools for ''v143'' application Type UWP (Platform Toolset = ''Visual Studio 2022'') cannot be found.'
|
|
23
|
+
- 'The same project builds cleanly on windows-2025 (VS 2022) because v143 is the native toolset there.'
|
|
24
|
+
root_cause: |
|
|
25
|
+
The `windows-2025-vs2026` image is a Visual Studio 2026 image. It ships the VS 2026
|
|
26
|
+
native MSVC toolset (`v145`), but it does NOT include the legacy VS 2022 UWP toolset
|
|
27
|
+
overlay for `PlatformToolset=v143`.
|
|
28
|
+
|
|
29
|
+
Legacy UWP C++ projects often keep `<PlatformToolset>v143</PlatformToolset>` in the
|
|
30
|
+
`.vcxproj` file. That works on `windows-2025` (VS 2022), but when the same workflow is
|
|
31
|
+
moved to `windows-2025-vs2026` — or when `windows-latest` rolls onto the VS 2026 image —
|
|
32
|
+
MSBuild fails at `PrepareForBuild` with MSB8020 before compilation starts.
|
|
33
|
+
|
|
34
|
+
Issue #14101 was later clarified by the reporter: the break is real, but the root cause is
|
|
35
|
+
not a partially missing component. The image is behaving as a VS 2026-only environment, and
|
|
36
|
+
the workflow is still targeting an older UWP toolset that is no longer present there.
|
|
37
|
+
fix: |
|
|
38
|
+
Option 1 — Migrate the project to `PlatformToolset=v145` (recommended on VS 2026 images).
|
|
39
|
+
|
|
40
|
+
Option 2 — If the project must stay on `v143`, pin the workflow to a VS 2022 image such as
|
|
41
|
+
`windows-2025` instead of `windows-2025-vs2026` or `windows-latest`.
|
|
42
|
+
|
|
43
|
+
Option 3 — Isolate legacy UWP builds in a dedicated workflow that stays on VS 2022 while the
|
|
44
|
+
rest of the repository migrates to VS 2026.
|
|
45
|
+
fix_code:
|
|
46
|
+
- language: xml
|
|
47
|
+
label: 'Migrate the project file to the VS 2026 toolset'
|
|
48
|
+
code: |
|
|
49
|
+
<PropertyGroup Label="Configuration">
|
|
50
|
+
<ConfigurationType>StaticLibrary</ConfigurationType>
|
|
51
|
+
<PlatformToolset>v145</PlatformToolset>
|
|
52
|
+
</PropertyGroup>
|
|
53
|
+
|
|
54
|
+
- language: yaml
|
|
55
|
+
label: 'Keep legacy UWP builds on the VS 2022 image'
|
|
56
|
+
code: |
|
|
57
|
+
jobs:
|
|
58
|
+
build-uwp:
|
|
59
|
+
runs-on: windows-2025
|
|
60
|
+
steps:
|
|
61
|
+
- uses: actions/checkout@v4
|
|
62
|
+
- name: Build legacy UWP project
|
|
63
|
+
run: msbuild MyApp.sln /p:Configuration=Release /p:Platform=x64
|
|
64
|
+
prevention:
|
|
65
|
+
- 'Audit Windows workflows for `<PlatformToolset>v143</PlatformToolset>` before moving them to `windows-2025-vs2026` or `windows-latest`.'
|
|
66
|
+
- 'Treat Visual Studio image migrations as toolchain migrations, not just path changes.'
|
|
67
|
+
- 'Pin `runs-on` explicitly for legacy UWP projects until the toolset migration is complete.'
|
|
68
|
+
docs:
|
|
69
|
+
- url: 'https://github.com/actions/runner-images/issues/14101'
|
|
70
|
+
label: 'actions/runner-images#14101 — windows-2025-vs2026 UWP project fails with MSB8020 on v143'
|
|
71
|
+
- url: 'https://github.com/actions/runner-images/issues/14017'
|
|
72
|
+
label: 'actions/runner-images#14017 — Windows 2025 / VS 2026 rollout announcement'
|
|
73
|
+
- url: 'https://learn.microsoft.com/en-us/cpp/build/reference/msbuild-visual-cpp-overview'
|
|
74
|
+
label: 'Microsoft Docs — MSBuild and Visual C++ toolsets'
|
|
@@ -0,0 +1,85 @@
|
|
|
1
|
+
id: runner-environment-225
|
|
2
|
+
title: 'macOS-26 arm runners can miss the iOS 26.1 simulator runtime needed by Xcode 26.1.1'
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- macos
|
|
7
|
+
- macos-26
|
|
8
|
+
- arm64
|
|
9
|
+
- xcode
|
|
10
|
+
- simulator
|
|
11
|
+
- ios
|
|
12
|
+
- xcodebuild
|
|
13
|
+
- runner-image
|
|
14
|
+
patterns:
|
|
15
|
+
- regex: 'Unable to find a destination matching the provided destination specifier:'
|
|
16
|
+
flags: i
|
|
17
|
+
- regex: 'iOS 26\.1 is not installed\. Please download and install the platform from Xcode > Settings > Components\.'
|
|
18
|
+
flags: i
|
|
19
|
+
- regex: 'Exit status: 70'
|
|
20
|
+
flags: i
|
|
21
|
+
error_messages:
|
|
22
|
+
- 'xcodebuild: error: Unable to find a destination matching the provided destination specifier:'
|
|
23
|
+
- '{ platform:iOS, id:dvtdevice-DVTiPhonePlaceholder-iphoneos:placeholder, name:Any iOS Device, error:iOS 26.1 is not installed. Please download and install the platform from Xcode > Settings > Components. }'
|
|
24
|
+
- 'Exit status: 70'
|
|
25
|
+
root_cause: |
|
|
26
|
+
The macOS 26 arm64 image version `20260520.0098.1` can expose Xcode 26.1.1 without shipping
|
|
27
|
+
the matching iOS 26.1 simulator/runtime components that Apple tooling expects for that Xcode.
|
|
28
|
+
|
|
29
|
+
Workflows that switch to Xcode 26.1.1 and build for iOS hit an immediate xcodebuild destination
|
|
30
|
+
failure because the placeholder device reports `iOS 26.1 is not installed`. The problem is on the
|
|
31
|
+
runner image, not in the project: the requested platform runtime is simply absent from the hosted
|
|
32
|
+
image at execution time.
|
|
33
|
+
|
|
34
|
+
This differs from the later macOS 26 default-Xcode migration entry: here the failure is a missing
|
|
35
|
+
runtime on the selected Xcode/image combination, not a project that needs to unpin from an older
|
|
36
|
+
Xcode.
|
|
37
|
+
fix: |
|
|
38
|
+
Option 1 — Select an Xcode version whose simulator/runtime set is actually present on the image.
|
|
39
|
+
|
|
40
|
+
Option 2 — Use `OS=latest` or another available simulator destination after checking the installed
|
|
41
|
+
runtimes with `xcrun simctl list runtimes`.
|
|
42
|
+
|
|
43
|
+
Option 3 — Wait for the next runner-image rollout that includes the missing iOS 26.1 runtime if the
|
|
44
|
+
project explicitly requires Xcode 26.1.1.
|
|
45
|
+
fix_code:
|
|
46
|
+
- language: yaml
|
|
47
|
+
label: 'Probe runtimes before building and use an installed simulator version'
|
|
48
|
+
code: |
|
|
49
|
+
jobs:
|
|
50
|
+
ios-build:
|
|
51
|
+
runs-on: macos-26-arm64
|
|
52
|
+
steps:
|
|
53
|
+
- uses: actions/checkout@v4
|
|
54
|
+
- name: Show installed runtimes
|
|
55
|
+
run: xcrun simctl list runtimes
|
|
56
|
+
- name: Build with an installed simulator runtime
|
|
57
|
+
run: |
|
|
58
|
+
xcodebuild build \
|
|
59
|
+
-scheme MyApp \
|
|
60
|
+
-destination 'platform=iOS Simulator,OS=latest,name=iPhone 17 Pro'
|
|
61
|
+
|
|
62
|
+
- language: yaml
|
|
63
|
+
label: 'Pin to a different Xcode already supported by the image'
|
|
64
|
+
code: |
|
|
65
|
+
jobs:
|
|
66
|
+
ios-build:
|
|
67
|
+
runs-on: macos-26-arm64
|
|
68
|
+
steps:
|
|
69
|
+
- uses: actions/checkout@v4
|
|
70
|
+
- uses: maxim-lobanov/setup-xcode@v1
|
|
71
|
+
with:
|
|
72
|
+
xcode-version: '26.4.1'
|
|
73
|
+
- name: Build
|
|
74
|
+
run: xcodebuild build -scheme MyApp -destination 'generic/platform=iOS'
|
|
75
|
+
prevention:
|
|
76
|
+
- 'Always dump `xcrun simctl list runtimes` in CI when adopting a new Xcode/image combination.'
|
|
77
|
+
- 'Prefer `OS=latest` unless your workflow truly requires one exact simulator runtime.'
|
|
78
|
+
- 'Pin both the runner label and Xcode version during major Apple platform transitions.'
|
|
79
|
+
docs:
|
|
80
|
+
- url: 'https://github.com/actions/runner-images/issues/14146'
|
|
81
|
+
label: 'actions/runner-images#14146 — macos-26 arm runner missing iOS simulator 26.1'
|
|
82
|
+
- url: 'https://developer.apple.com/documentation/xcode/installing-additional-simulator-runtimes'
|
|
83
|
+
label: 'Apple Docs — Installing additional simulator runtimes'
|
|
84
|
+
- url: 'https://github.com/maxim-lobanov/setup-xcode'
|
|
85
|
+
label: 'maxim-lobanov/setup-xcode action'
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
id: runner-environment-226
|
|
2
|
+
title: '.NET MAUI iOS publish on macOS-26 can fail because Xcode 26.5 lacks the simulator runtime actool expects'
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- macos
|
|
7
|
+
- macos-26
|
|
8
|
+
- maui
|
|
9
|
+
- dotnet
|
|
10
|
+
- ios
|
|
11
|
+
- xcode
|
|
12
|
+
- actool
|
|
13
|
+
- runner-image
|
|
14
|
+
patterns:
|
|
15
|
+
- regex: 'No simulator runtime version from \["23B86", "23C54", "23E254a"\] available to use with iphonesimulator SDK version 23F5054d'
|
|
16
|
+
flags: i
|
|
17
|
+
- regex: 'xcrun: error: unable to find utility "actool"'
|
|
18
|
+
flags: i
|
|
19
|
+
- regex: 'This version of \.NET for iOS \(26\.5\.9001\) requires Xcode 26\.5'
|
|
20
|
+
flags: i
|
|
21
|
+
error_messages:
|
|
22
|
+
- 'No simulator runtime version from ["23B86", "23C54", "23E254a"] available to use with iphonesimulator SDK version 23F5054d'
|
|
23
|
+
- 'xcrun: error: unable to find utility "actool"'
|
|
24
|
+
- 'This version of .NET for iOS (26.5.9001) requires Xcode 26.5'
|
|
25
|
+
root_cause: |
|
|
26
|
+
On the early macOS 26 hosted image rollout, users building .NET MAUI iOS apps with
|
|
27
|
+
`Microsoft.iOS.Sdk` 26.5.9001 were forced into an impossible toolchain combination.
|
|
28
|
+
|
|
29
|
+
`Microsoft.iOS.Sdk` 26.5.9001 requires Xcode 26.5, so downgrading to Xcode 26.4.1 is not a valid
|
|
30
|
+
long-term fix. But the Xcode 26.5 paths that were present on the image had two different failure
|
|
31
|
+
modes:
|
|
32
|
+
- selecting `/Applications/Xcode_26.5.app` or `/Applications/Xcode_26.5.0.app` could not resolve
|
|
33
|
+
`actool`
|
|
34
|
+
- selecting `/Applications/Xcode_26.5_beta_2.app` resolved `actool`, but the required simulator
|
|
35
|
+
runtime for SDK `23F5054d` was not installed
|
|
36
|
+
|
|
37
|
+
GitHub later confirmed that the Xcode 26.5 runtime would arrive on the next image update. Until
|
|
38
|
+
that rollout completed, the hosted image simply did not provide a fully working Xcode 26.5 + MAUI
|
|
39
|
+
iOS 26.5.9001 combination.
|
|
40
|
+
fix: |
|
|
41
|
+
There is no complete workflow-only fix when the hosted image is missing the runtime that Xcode and
|
|
42
|
+
the .NET iOS workload require.
|
|
43
|
+
|
|
44
|
+
Current options:
|
|
45
|
+
- wait for the next runner-image rollout that includes the Xcode 26.5 runtime
|
|
46
|
+
- temporarily downgrade the .NET iOS workload to a version compatible with Xcode 26.4.1
|
|
47
|
+
- add a preflight check so the job fails fast with a clear message instead of burning minutes in publish
|
|
48
|
+
fix_code:
|
|
49
|
+
- language: yaml
|
|
50
|
+
label: 'Fail fast if the required Xcode 26.5 simulator runtime is absent'
|
|
51
|
+
code: |
|
|
52
|
+
jobs:
|
|
53
|
+
publish-ios:
|
|
54
|
+
runs-on: macos-26
|
|
55
|
+
steps:
|
|
56
|
+
- uses: actions/checkout@v4
|
|
57
|
+
- name: Check installed runtimes
|
|
58
|
+
run: |
|
|
59
|
+
xcrun simctl list runtimes
|
|
60
|
+
xcodebuild -version
|
|
61
|
+
- name: Guard against missing Xcode 26.5 runtime
|
|
62
|
+
run: |
|
|
63
|
+
xcrun simctl list runtimes | grep '23F5054d' || {
|
|
64
|
+
echo 'Required Xcode 26.5 simulator runtime is missing on this image.'
|
|
65
|
+
exit 1
|
|
66
|
+
}
|
|
67
|
+
|
|
68
|
+
- language: yaml
|
|
69
|
+
label: 'Pin Xcode 26.4.1 while using a matching older iOS workload'
|
|
70
|
+
code: |
|
|
71
|
+
jobs:
|
|
72
|
+
publish-ios:
|
|
73
|
+
runs-on: macos-26
|
|
74
|
+
steps:
|
|
75
|
+
- uses: actions/checkout@v4
|
|
76
|
+
- uses: maxim-lobanov/setup-xcode@v1
|
|
77
|
+
with:
|
|
78
|
+
xcode-version: '26.4.1'
|
|
79
|
+
- name: Publish with a workload version that matches Xcode 26.4.1
|
|
80
|
+
run: dotnet publish -f net9.0-ios -c Release -r ios-arm64
|
|
81
|
+
prevention:
|
|
82
|
+
- 'Check `xcrun simctl list runtimes` whenever you adopt a new Xcode or .NET iOS workload on hosted macOS images.'
|
|
83
|
+
- 'Pin both Xcode and the .NET iOS workload version together during Apple platform transitions.'
|
|
84
|
+
- 'Add a fast runtime preflight before long `dotnet publish` steps so broken image rollouts fail immediately.'
|
|
85
|
+
docs:
|
|
86
|
+
- url: 'https://github.com/actions/runner-images/issues/14128'
|
|
87
|
+
label: 'actions/runner-images#14128 — macOS-26 hosted image missing simulator runtime required by Xcode 26.5'
|
|
88
|
+
- url: 'https://github.com/actions/runner-images/pull/14114'
|
|
89
|
+
label: 'runner-images pull request referenced in the fix confirmation'
|
|
90
|
+
- url: 'https://learn.microsoft.com/en-us/dotnet/maui/ios/deployment/'
|
|
91
|
+
label: 'Microsoft Docs — .NET MAUI iOS deployment'
|
|
@@ -0,0 +1,106 @@
|
|
|
1
|
+
id: runner-environment-227
|
|
2
|
+
title: 'Bash script handler unquoted path breaks job hooks and run steps in directories with spaces'
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- bash
|
|
7
|
+
- hooks
|
|
8
|
+
- spaces
|
|
9
|
+
- path
|
|
10
|
+
- job-hooks
|
|
11
|
+
- self-hosted
|
|
12
|
+
- script-handler
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'bash: .+: No such file or directory'
|
|
15
|
+
flags: 'i'
|
|
16
|
+
- regex: 'ACTIONS_RUNNER_HOOK_JOB_STARTED.+No such file'
|
|
17
|
+
flags: 'i'
|
|
18
|
+
- regex: 'bash.*--noprofile.*--norc.*-e.*-o pipefail'
|
|
19
|
+
flags: 'i'
|
|
20
|
+
error_messages:
|
|
21
|
+
- 'bash: /Volumes/My: No such file or directory'
|
|
22
|
+
- 'bash: Shared Files/hook.sh: No such file or directory'
|
|
23
|
+
- 'Error: Process completed with exit code 127.'
|
|
24
|
+
root_cause: |
|
|
25
|
+
In the GitHub Actions runner source code, the default argument template for the bash
|
|
26
|
+
shell handler (`ScriptHandlerHelpers.cs`) does not quote the script path placeholder:
|
|
27
|
+
|
|
28
|
+
_defaultArguments["bash"] = "--noprofile --norc -e -o pipefail {0}";
|
|
29
|
+
|
|
30
|
+
When `{0}` is replaced with a path containing spaces — such as
|
|
31
|
+
`/Volumes/My Shared Files/hook.sh` — the resulting command becomes:
|
|
32
|
+
|
|
33
|
+
bash --noprofile --norc -e -o pipefail /Volumes/My Shared Files/hook.sh
|
|
34
|
+
|
|
35
|
+
Bash treats this as three separate arguments: `/Volumes/My`, `Shared`, and
|
|
36
|
+
`Files/hook.sh`. The first token is not a valid path, so bash exits with
|
|
37
|
+
"No such file or directory" and exit code 127.
|
|
38
|
+
|
|
39
|
+
By contrast, the PowerShell and cmd templates DO quote the path:
|
|
40
|
+
_defaultArguments["pwsh"] = "-command \"& '{0}'\"";
|
|
41
|
+
_defaultArguments["powershell"] = "-command \". '{0}'\"";
|
|
42
|
+
_defaultArguments["cmd"] = "/D /E:ON /V:OFF /S /C \"CALL \"{0}\"\"";
|
|
43
|
+
|
|
44
|
+
Only bash and sh are affected. The affected scenarios include:
|
|
45
|
+
- Job hooks (ACTIONS_RUNNER_HOOK_JOB_STARTED, ACTIONS_RUNNER_HOOK_JOB_COMPLETED)
|
|
46
|
+
when the hook script resides in a directory whose path contains spaces — a common
|
|
47
|
+
case on macOS with Tart VMs that mount shared directories at
|
|
48
|
+
`/Volumes/My Shared Files/`.
|
|
49
|
+
- `run:` steps where the runner's _work directory path contains spaces (less common
|
|
50
|
+
but possible on custom self-hosted runner installations).
|
|
51
|
+
|
|
52
|
+
The bug affects all released runner versions (no version introduced it — the
|
|
53
|
+
template has always been unquoted). A fix was proposed in the issue but had not
|
|
54
|
+
shipped as of the issue filing date.
|
|
55
|
+
fix: |
|
|
56
|
+
Workaround: avoid spaces in the path to hook scripts and runner working directories.
|
|
57
|
+
|
|
58
|
+
1. Move hook scripts to a path with no spaces (e.g., `/opt/runner-hooks/hook.sh`
|
|
59
|
+
instead of `/Volumes/My Shared Files/hooks/hook.sh`).
|
|
60
|
+
Set ACTIONS_RUNNER_HOOK_JOB_STARTED=/opt/runner-hooks/job-started.sh in the
|
|
61
|
+
runner environment (`.env` file or system environment).
|
|
62
|
+
|
|
63
|
+
2. On macOS with Tart VMs, use a symlink from a space-free path to the shared
|
|
64
|
+
volume's hook script:
|
|
65
|
+
ln -s "/Volumes/My Shared Files/hook.sh" /opt/hooks/job-started.sh
|
|
66
|
+
Set the env var to the symlink path.
|
|
67
|
+
|
|
68
|
+
3. Wrap the script invocation in a no-space wrapper script that calls the real path.
|
|
69
|
+
|
|
70
|
+
There is no supported way to override the bash argument template at the user level.
|
|
71
|
+
The permanent fix requires a runner source code change (quoting `{0}`).
|
|
72
|
+
fix_code:
|
|
73
|
+
- language: bash
|
|
74
|
+
label: 'Create a space-free symlink to the actual hook script'
|
|
75
|
+
code: |
|
|
76
|
+
# On macOS: create a symlink from a no-space path to the hook in the shared volume
|
|
77
|
+
mkdir -p /opt/runner-hooks
|
|
78
|
+
ln -sf "/Volumes/My Shared Files/hooks/job-started.sh" /opt/runner-hooks/job-started.sh
|
|
79
|
+
ln -sf "/Volumes/My Shared Files/hooks/job-completed.sh" /opt/runner-hooks/job-completed.sh
|
|
80
|
+
|
|
81
|
+
# In the runner's .env file (located in the runner install directory):
|
|
82
|
+
# ACTIONS_RUNNER_HOOK_JOB_STARTED=/opt/runner-hooks/job-started.sh
|
|
83
|
+
# ACTIONS_RUNNER_HOOK_JOB_COMPLETED=/opt/runner-hooks/job-completed.sh
|
|
84
|
+
|
|
85
|
+
- language: bash
|
|
86
|
+
label: 'Move hook scripts to a space-free directory at runner setup time'
|
|
87
|
+
code: |
|
|
88
|
+
# Preferred: install hook scripts in a path with no spaces from the start
|
|
89
|
+
sudo mkdir -p /usr/local/runner-hooks
|
|
90
|
+
sudo cp ./hooks/job-started.sh /usr/local/runner-hooks/
|
|
91
|
+
sudo chmod +x /usr/local/runner-hooks/job-started.sh
|
|
92
|
+
|
|
93
|
+
# In .env:
|
|
94
|
+
# ACTIONS_RUNNER_HOOK_JOB_STARTED=/usr/local/runner-hooks/job-started.sh
|
|
95
|
+
prevention:
|
|
96
|
+
- 'Always install runner hook scripts under paths with no spaces — use /opt/, /usr/local/, or /home/<user>/ prefixes.'
|
|
97
|
+
- 'On macOS Tart VM hosts, avoid mounting shared directories with spaces in the volume name; use snake_case or hyphenated names (e.g., My_Shared_Files).'
|
|
98
|
+
- 'After configuring ACTIONS_RUNNER_HOOK_JOB_STARTED, test the hook manually by running bash --noprofile --norc -e -o pipefail <path> to catch path issues before the runner is live.'
|
|
99
|
+
- 'If the runner work directory path contains spaces, reconfigure the runner with a clean no-space _work path.'
|
|
100
|
+
docs:
|
|
101
|
+
- url: 'https://github.com/actions/runner/issues/4404'
|
|
102
|
+
label: 'actions/runner#4404 — Bash script handler does not quote the script path'
|
|
103
|
+
- url: 'https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/running-scripts-before-or-after-a-job'
|
|
104
|
+
label: 'GitHub Docs — Running scripts before or after a job (job hooks)'
|
|
105
|
+
- url: 'https://github.com/actions/runner/blob/main/src/Runner.Worker/Handlers/ScriptHandlerHelpers.cs'
|
|
106
|
+
label: 'actions/runner source — ScriptHandlerHelpers.cs (unquoted bash template)'
|
|
@@ -0,0 +1,117 @@
|
|
|
1
|
+
id: runner-environment-228
|
|
2
|
+
title: 'setup-node@v6 cache detection fails when .yarnrc.yml contains approvedGitRepositories (yarn 4.14+)'
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- setup-node
|
|
7
|
+
- yarn
|
|
8
|
+
- cache
|
|
9
|
+
- yarnrc
|
|
10
|
+
- approvedGitRepositories
|
|
11
|
+
- yarn-4
|
|
12
|
+
- cache-detection
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'Unrecognized or legacy configuration settings found: approvedGitRepositories'
|
|
15
|
+
flags: 'i'
|
|
16
|
+
- regex: "The 'yarn config get cacheFolder' command failed with exit code"
|
|
17
|
+
flags: 'i'
|
|
18
|
+
- regex: 'yarn config get cacheFolder.*exit code: 1'
|
|
19
|
+
flags: 'i'
|
|
20
|
+
error_messages:
|
|
21
|
+
- "Usage Error: Unrecognized or legacy configuration settings found: approvedGitRepositories - run \"yarn config -v\" to see the list of settings supported in Yarn"
|
|
22
|
+
- "Error: The 'yarn config get cacheFolder' command failed with exit code: 1"
|
|
23
|
+
root_cause: |
|
|
24
|
+
Yarn 4.14 introduced the `approvedGitRepositories` security setting in `.yarnrc.yml`.
|
|
25
|
+
This key enforces an allowlist of Git repository URLs that yarn is permitted to fetch
|
|
26
|
+
packages from, blocking unapproved source URLs with:
|
|
27
|
+
|
|
28
|
+
"Request to '<url>' has been blocked because it doesn't match any of the
|
|
29
|
+
patterns in 'approvedGitRepositories'"
|
|
30
|
+
|
|
31
|
+
However, any `.yarnrc.yml` key that is unrecognized or deprecated by the currently
|
|
32
|
+
installed version of yarn causes yarn to abort ALL config commands with:
|
|
33
|
+
|
|
34
|
+
"Usage Error: Unrecognized or legacy configuration settings found: approvedGitRepositories"
|
|
35
|
+
|
|
36
|
+
The `actions/setup-node@v6` action detects the yarn cache folder path by executing
|
|
37
|
+
`yarn config get cacheFolder` early in the action — before any Node.js version is
|
|
38
|
+
installed and before yarn itself is updated. If the runner's bundled yarn version is
|
|
39
|
+
older than 4.14, it does not recognize `approvedGitRepositories` and aborts.
|
|
40
|
+
|
|
41
|
+
The action catches the non-zero exit code and surfaces the error:
|
|
42
|
+
"Error: The 'yarn config get cacheFolder' command failed with exit code: 1"
|
|
43
|
+
|
|
44
|
+
This failure prevents setup-node from resolving the yarn cache path, breaking the
|
|
45
|
+
entire step. Users frequently observe this when:
|
|
46
|
+
- Upgrading to yarn 4.14+ and adding `approvedGitRepositories` to `.yarnrc.yml`
|
|
47
|
+
- Running on hosted runners where the system yarn version is older than 4.14
|
|
48
|
+
- Running on self-hosted runners with a frozen yarn version
|
|
49
|
+
|
|
50
|
+
The root issue is that yarn's unrecognized-key validation is global — it aborts even
|
|
51
|
+
read-only config queries when any single key is unrecognized, even if that key is not
|
|
52
|
+
related to the query.
|
|
53
|
+
fix: |
|
|
54
|
+
Option 1 — Remove cache:yarn from setup-node (safest immediate fix).
|
|
55
|
+
Set cache: '' or omit the cache: input entirely. Manage yarn caching with a separate
|
|
56
|
+
actions/cache step pointed directly at the yarn cache directory.
|
|
57
|
+
|
|
58
|
+
Option 2 — Pin the yarn version in the runner environment to match .yarnrc.yml.
|
|
59
|
+
Ensure the yarn version on the runner is >= 4.14.0 so it recognizes
|
|
60
|
+
approvedGitRepositories before setup-node calls yarn config get.
|
|
61
|
+
|
|
62
|
+
Option 3 — Upgrade setup-node to a version that handles this gracefully.
|
|
63
|
+
Track actions/setup-node#1534 for a fix that makes cache folder detection resilient
|
|
64
|
+
to yarn config validation errors.
|
|
65
|
+
|
|
66
|
+
Option 4 — Use a separate cache step instead of setup-node's built-in cache.
|
|
67
|
+
This avoids the setup-node yarn version probe entirely.
|
|
68
|
+
fix_code:
|
|
69
|
+
- language: yaml
|
|
70
|
+
label: 'Remove cache:yarn from setup-node and use a standalone cache step'
|
|
71
|
+
code: |
|
|
72
|
+
- uses: actions/setup-node@v4
|
|
73
|
+
with:
|
|
74
|
+
node-version: 20
|
|
75
|
+
# Do NOT set cache: yarn — it triggers yarn config get cacheFolder
|
|
76
|
+
# which fails when approvedGitRepositories is in .yarnrc.yml
|
|
77
|
+
|
|
78
|
+
# Manage yarn cache manually
|
|
79
|
+
- name: Get yarn cache directory
|
|
80
|
+
id: yarn-cache-dir
|
|
81
|
+
run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
|
|
82
|
+
|
|
83
|
+
- uses: actions/cache@v4
|
|
84
|
+
with:
|
|
85
|
+
path: ${{ steps.yarn-cache-dir.outputs.dir }}
|
|
86
|
+
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
|
|
87
|
+
restore-keys: |
|
|
88
|
+
${{ runner.os }}-yarn-
|
|
89
|
+
|
|
90
|
+
- run: yarn install --immutable
|
|
91
|
+
|
|
92
|
+
- language: yaml
|
|
93
|
+
label: 'Pin yarn version to 4.14+ before setup-node runs'
|
|
94
|
+
code: |
|
|
95
|
+
- name: Enable corepack with matching yarn version
|
|
96
|
+
run: |
|
|
97
|
+
corepack enable
|
|
98
|
+
corepack prepare yarn@4.14.1 --activate
|
|
99
|
+
|
|
100
|
+
- uses: actions/setup-node@v4
|
|
101
|
+
with:
|
|
102
|
+
node-version: 20
|
|
103
|
+
cache: yarn # Now safe — yarn 4.14+ recognizes approvedGitRepositories
|
|
104
|
+
prevention:
|
|
105
|
+
- 'After adding any new key to .yarnrc.yml, verify it is recognized by running yarn config -v locally and confirming the key appears in the supported list.'
|
|
106
|
+
- 'When using setup-node cache:yarn with yarn 4+, pin the yarn version via packageManager in package.json or via corepack before the setup-node step.'
|
|
107
|
+
- 'Monitor actions/setup-node release notes for fixes to yarn cache detection resilience (issue #1534).'
|
|
108
|
+
- 'If .yarnrc.yml uses security features added in a recent yarn release, document the minimum required yarn version in your repo README and CI setup guide.'
|
|
109
|
+
docs:
|
|
110
|
+
- url: 'https://github.com/actions/setup-node/issues/1534'
|
|
111
|
+
label: 'actions/setup-node#1534 — Problem with yarn v4.14 config approvedGitRepositories'
|
|
112
|
+
- url: 'https://github.com/yarnpkg/berry/issues/7108'
|
|
113
|
+
label: 'yarnpkg/berry#7108 — approvedGitRepositories config key tracking issue'
|
|
114
|
+
- url: 'https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories'
|
|
115
|
+
label: 'Yarn docs — approvedGitRepositories configuration'
|
|
116
|
+
- url: 'https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#caching-packages-data'
|
|
117
|
+
label: 'setup-node — Advanced usage: caching packages data'
|
|
@@ -0,0 +1,119 @@
|
|
|
1
|
+
id: runner-environment-229
|
|
2
|
+
title: 'runner-container-hooks v0.8.0+ breaks local composite actions and event.json in Kubernetes job containers'
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- runner-container-hooks
|
|
7
|
+
- kubernetes
|
|
8
|
+
- ARC
|
|
9
|
+
- local-actions
|
|
10
|
+
- composite-action
|
|
11
|
+
- job-container
|
|
12
|
+
- GITHUB_EVENT_PATH
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: "Can't find 'action\\.yml', 'action\\.yaml' or 'Dockerfile' under '.+\\.github/actions/.+'"
|
|
15
|
+
flags: 'i'
|
|
16
|
+
- regex: 'GITHUB_EVENT_PATH .+/github/workflow/event\\.json does not exist'
|
|
17
|
+
flags: 'i'
|
|
18
|
+
- regex: 'Did you forget to run actions/checkout before running your local action'
|
|
19
|
+
flags: 'i'
|
|
20
|
+
error_messages:
|
|
21
|
+
- "Error: Can't find 'action.yml', 'action.yaml' or 'Dockerfile' under '/home/runner/_work/<repo>/<repo>/.github/actions/<action-name>'. Did you forget to run actions/checkout before running your local action?"
|
|
22
|
+
- "GITHUB_EVENT_PATH /github/workflow/event.json does not exist"
|
|
23
|
+
root_cause: |
|
|
24
|
+
In `runner-container-hooks` v0.8.0 (released with actions-runner v2.334.0),
|
|
25
|
+
PR #244 replaced the shared PersistentVolumeClaim (PVC) between the runner
|
|
26
|
+
pod and job pods with exec-based file copying.
|
|
27
|
+
|
|
28
|
+
Two distinct regressions were introduced:
|
|
29
|
+
|
|
30
|
+
**1. Local composite actions fail ("Can't find action.yml")**
|
|
31
|
+
In `runScriptStep`, only the `_temp` directory is synced back from the job
|
|
32
|
+
pod to the runner host after each step. When `actions/checkout` runs inside
|
|
33
|
+
the job pod, the entire repository (including `.github/actions/`) is written
|
|
34
|
+
to `/__w/<owner>/<repo>/` inside the pod — but it is never copied back to
|
|
35
|
+
the runner host filesystem.
|
|
36
|
+
|
|
37
|
+
The runner resolves local actions by reading `action.yml` from its own
|
|
38
|
+
filesystem before dispatching the hook for that step. Since the workspace
|
|
39
|
+
was never synced back, the runner cannot find the action definition and
|
|
40
|
+
fails with the "Did you forget to run actions/checkout?" error — even
|
|
41
|
+
though checkout ran successfully inside the pod.
|
|
42
|
+
|
|
43
|
+
`runContainerStep` is not affected: it copies the full `/__w` back from
|
|
44
|
+
the job pod because container action steps run in a separate pod.
|
|
45
|
+
|
|
46
|
+
**2. GITHUB_EVENT_PATH missing for jobs without custom volume mounts**
|
|
47
|
+
In v0.7.0, `/github/home` and `/github/workflow` were set up as volume
|
|
48
|
+
subPath mounts on every job container. PR #244 replaced these mounts with
|
|
49
|
+
a `prepareJobScript` call that copies these directories into place — but
|
|
50
|
+
only when `args.container.userMountVolumes` is non-empty. If the workflow
|
|
51
|
+
has no custom `volumes:` in the `container:` block, the script never runs
|
|
52
|
+
and `/github/workflow/event.json` is never created.
|
|
53
|
+
|
|
54
|
+
Any action that reads `GITHUB_EVENT_PATH` (e.g. `dorny/paths-filter`,
|
|
55
|
+
`tj-actions/changed-files`, `actions/github-script` reading the event
|
|
56
|
+
payload) then fails because the file does not exist.
|
|
57
|
+
|
|
58
|
+
Both regressions affect Kubernetes-based ARC (Actions Runner Controller)
|
|
59
|
+
setups using runner-container-hooks v0.8.0+. Standard GitHub-hosted runners
|
|
60
|
+
and self-hosted runners that do NOT use container-hooks are unaffected.
|
|
61
|
+
fix: |
|
|
62
|
+
**Immediate workaround:**
|
|
63
|
+
Pin `runner-container-hooks` to v0.7.0 by setting the container hooks
|
|
64
|
+
image in your ARC `HorizontalRunnerAutoscaler` or `RunnerDeployment`
|
|
65
|
+
configuration to use the v0.7.0 bundle (included in
|
|
66
|
+
`ghcr.io/actions/actions-runner:2.333.0`).
|
|
67
|
+
|
|
68
|
+
**For the local action failure specifically:**
|
|
69
|
+
After a fix is available upstream, the recommended approach is to upgrade
|
|
70
|
+
to a patched version of `runner-container-hooks` that copies `.github/`
|
|
71
|
+
back from the job pod after each `runScriptStep`.
|
|
72
|
+
|
|
73
|
+
**For the GITHUB_EVENT_PATH issue specifically:**
|
|
74
|
+
Ensure your `container:` block includes at least one `volumes:` entry to
|
|
75
|
+
trigger `prepareJobScript`, or wait for the upstream fix that unconditionally
|
|
76
|
+
runs the prepare script.
|
|
77
|
+
|
|
78
|
+
Track the upstream fix in actions/runner-container-hooks#337.
|
|
79
|
+
fix_code:
|
|
80
|
+
- language: yaml
|
|
81
|
+
label: 'Pin ARC runner to actions-runner v2.333.0 (uses hooks v0.7.0) to avoid regression'
|
|
82
|
+
code: |
|
|
83
|
+
# In your HorizontalRunnerAutoscaler spec, pin the runner image
|
|
84
|
+
# to the last version that uses runner-container-hooks v0.7.0:
|
|
85
|
+
spec:
|
|
86
|
+
template:
|
|
87
|
+
spec:
|
|
88
|
+
image: ghcr.io/actions/actions-runner:2.333.0
|
|
89
|
+
- language: yaml
|
|
90
|
+
label: 'Workaround for GITHUB_EVENT_PATH: add a dummy volume mount to trigger prepareJobScript'
|
|
91
|
+
code: |
|
|
92
|
+
jobs:
|
|
93
|
+
build:
|
|
94
|
+
runs-on: self-hosted
|
|
95
|
+
container:
|
|
96
|
+
image: my-ci-image:latest
|
|
97
|
+
# Adding any volume entry triggers prepareJobScript and restores
|
|
98
|
+
# /github/workflow/event.json inside the job container
|
|
99
|
+
volumes:
|
|
100
|
+
- /tmp:/tmp
|
|
101
|
+
steps:
|
|
102
|
+
- uses: actions/checkout@v4
|
|
103
|
+
- uses: dorny/paths-filter@v3
|
|
104
|
+
with:
|
|
105
|
+
filters: |
|
|
106
|
+
src:
|
|
107
|
+
- 'src/**'
|
|
108
|
+
prevention:
|
|
109
|
+
- 'When upgrading ARC runner images, check the bundled runner-container-hooks version and validate that local composite actions still work after the upgrade.'
|
|
110
|
+
- 'Pin runner images to a specific version tag rather than `latest` so unexpected upgrades do not break your workflows.'
|
|
111
|
+
- 'After upgrading runner-container-hooks, run a canary workflow that (a) uses a local composite action and (b) uses an action that reads GITHUB_EVENT_PATH to catch both regressions early.'
|
|
112
|
+
- 'Monitor the actions/runner-container-hooks releases page and the linked issue #337 for the official fix.'
|
|
113
|
+
docs:
|
|
114
|
+
- url: 'https://github.com/actions/runner-container-hooks/issues/337'
|
|
115
|
+
label: 'actions/runner-container-hooks#337 — Local actions fail after PR #244 removed shared volume'
|
|
116
|
+
- url: 'https://github.com/actions/runner-container-hooks/pull/244'
|
|
117
|
+
label: 'actions/runner-container-hooks#244 — Remove dependency on the runner''s volume (introduced regression)'
|
|
118
|
+
- url: 'https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller'
|
|
119
|
+
label: 'GitHub Docs — About Actions Runner Controller'
|