@htekdev/actions-debugger 1.0.44 → 1.0.45
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,97 @@
|
|
|
1
|
+
id: known-unsolved-035
|
|
2
|
+
title: "workflow_run trigger only fires for same-repo workflows — cross-repo chaining not supported"
|
|
3
|
+
category: known-unsolved
|
|
4
|
+
severity: limitation
|
|
5
|
+
tags:
|
|
6
|
+
- workflow_run
|
|
7
|
+
- cross-repo
|
|
8
|
+
- triggers
|
|
9
|
+
- repository-dispatch
|
|
10
|
+
- known-limitation
|
|
11
|
+
- event-chaining
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'workflow_run.*never.*trigger|on.*workflow_run.*different.*repo'
|
|
14
|
+
flags: "i"
|
|
15
|
+
- regex: 'cross.repo.*workflow.run|workflow_run.*external.*repo'
|
|
16
|
+
flags: "i"
|
|
17
|
+
error_messages:
|
|
18
|
+
- "workflow_run trigger does not fire for workflows in a different repository"
|
|
19
|
+
root_cause: |
|
|
20
|
+
The on: workflow_run trigger only listens to workflow completion events in the same
|
|
21
|
+
repository. It cannot subscribe to events from workflows in external repositories,
|
|
22
|
+
even within the same organization or enterprise. Teams building cross-repository
|
|
23
|
+
CI/CD chains (e.g., "when repo-A build finishes, trigger repo-B deploy") discover
|
|
24
|
+
that the downstream workflow simply never starts — there is no error, just silence.
|
|
25
|
+
|
|
26
|
+
This is a platform design decision: workflow_run was built for intra-repo fan-out
|
|
27
|
+
(e.g., running security scans after CI passes) and not for cross-repo event routing.
|
|
28
|
+
|
|
29
|
+
Common scenarios where this limitation is hit:
|
|
30
|
+
- Platform team repo triggering deploy workflows in service repos
|
|
31
|
+
- Shared library repo signaling consumers after a release
|
|
32
|
+
- Monorepo-to-polyrepo migration preserving CI event chains
|
|
33
|
+
- Organization-wide rollout pipelines spanning multiple repositories
|
|
34
|
+
fix: |
|
|
35
|
+
Use repository_dispatch for cross-repo event chaining. The upstream workflow sends
|
|
36
|
+
a POST to the GitHub REST API to create a repository_dispatch event in the downstream
|
|
37
|
+
repo. The downstream workflow listens on on: repository_dispatch: types: [...].
|
|
38
|
+
|
|
39
|
+
This requires a PAT (classic) with repo scope, or a GitHub App token with contents:
|
|
40
|
+
write or actions: write on the downstream repository. The peter-evans/repository-dispatch
|
|
41
|
+
action is the most widely used wrapper.
|
|
42
|
+
fix_code:
|
|
43
|
+
- language: yaml
|
|
44
|
+
label: "Upstream (repo-A): dispatch event to repo-B on workflow completion"
|
|
45
|
+
code: |
|
|
46
|
+
# .github/workflows/build.yml in repo-A
|
|
47
|
+
on:
|
|
48
|
+
push:
|
|
49
|
+
branches: [main]
|
|
50
|
+
|
|
51
|
+
jobs:
|
|
52
|
+
build:
|
|
53
|
+
runs-on: ubuntu-latest
|
|
54
|
+
steps:
|
|
55
|
+
- name: Build
|
|
56
|
+
run: make build
|
|
57
|
+
|
|
58
|
+
- name: Trigger deployment in repo-B
|
|
59
|
+
uses: peter-evans/repository-dispatch@v3
|
|
60
|
+
with:
|
|
61
|
+
token: ${{ secrets.CROSS_REPO_PAT }}
|
|
62
|
+
repository: my-org/repo-B
|
|
63
|
+
event-type: repo-a-build-complete
|
|
64
|
+
client-payload: >-
|
|
65
|
+
{"sha": "${{ github.sha }}", "ref": "${{ github.ref }}",
|
|
66
|
+
"run_id": "${{ github.run_id }}"}
|
|
67
|
+
- language: yaml
|
|
68
|
+
label: "Downstream (repo-B): receive repository_dispatch from repo-A"
|
|
69
|
+
code: |
|
|
70
|
+
# .github/workflows/deploy.yml in repo-B
|
|
71
|
+
on:
|
|
72
|
+
repository_dispatch:
|
|
73
|
+
types: [repo-a-build-complete]
|
|
74
|
+
|
|
75
|
+
jobs:
|
|
76
|
+
deploy:
|
|
77
|
+
runs-on: ubuntu-latest
|
|
78
|
+
steps:
|
|
79
|
+
- name: Deploy
|
|
80
|
+
run: |
|
|
81
|
+
echo "Triggered by SHA: ${{ github.event.client_payload.sha }}"
|
|
82
|
+
echo "Source run: ${{ github.event.client_payload.run_id }}"
|
|
83
|
+
# deploy steps here
|
|
84
|
+
prevention:
|
|
85
|
+
- "Use repository_dispatch for cross-repository event chaining — workflow_run is same-repo only"
|
|
86
|
+
- "Document this limitation in workflow comments so future maintainers don't spend time debugging non-firing triggers"
|
|
87
|
+
- "Consider reusable workflows (workflow_call) for sharing logic within an org instead of cross-repo triggers"
|
|
88
|
+
- "For org-wide fan-out, a central platform repo dispatching to all downstream repos is a common pattern"
|
|
89
|
+
docs:
|
|
90
|
+
- url: "https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_run"
|
|
91
|
+
label: "GitHub Docs: workflow_run trigger"
|
|
92
|
+
- url: "https://docs.github.com/en/rest/repos/repos#create-a-repository-dispatch-event"
|
|
93
|
+
label: "GitHub REST API: Create a repository dispatch event"
|
|
94
|
+
- url: "https://github.com/peter-evans/repository-dispatch"
|
|
95
|
+
label: "peter-evans/repository-dispatch action"
|
|
96
|
+
- url: "https://github.com/orgs/community/discussions/26323"
|
|
97
|
+
label: "GitHub Community #26323: workflow_run cross-repo limitation confirmed"
|
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
id: runner-environment-100
|
|
2
|
+
title: "ubuntu-24.04 libmysqlclient-dev renamed to default-libmysqlclient-dev — apt install fails"
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- ubuntu-24.04
|
|
7
|
+
- apt
|
|
8
|
+
- mysql
|
|
9
|
+
- libmysqlclient
|
|
10
|
+
- migration
|
|
11
|
+
- package-rename
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'Package .libmysqlclient-dev. has no installation candidate'
|
|
14
|
+
flags: "i"
|
|
15
|
+
- regex: 'Unable to locate package openjdk-8|libmysqlclient-dev.*no installation'
|
|
16
|
+
flags: "i"
|
|
17
|
+
error_messages:
|
|
18
|
+
- "E: Package 'libmysqlclient-dev' has no installation candidate"
|
|
19
|
+
- "Package 'libmysqlclient-dev' has no installation candidate"
|
|
20
|
+
root_cause: |
|
|
21
|
+
In Ubuntu 24.04 (Noble Numbat), the libmysqlclient-dev package was removed from
|
|
22
|
+
the default apt repositories. MySQL 8.x development headers are now provided by
|
|
23
|
+
default-libmysqlclient-dev (a metapackage resolving to MySQL or MariaDB headers)
|
|
24
|
+
or the MariaDB-specific libmariadb-dev. Workflows migrating from ubuntu-22.04
|
|
25
|
+
(which carried libmysqlclient-dev) to ubuntu-24.04 fail at the apt-get install
|
|
26
|
+
step. This affects Django (mysqlclient), Ruby on Rails (mysql2 gem), PHP (mysqli
|
|
27
|
+
extension compile), and Go applications using CGO MySQL bindings.
|
|
28
|
+
fix: |
|
|
29
|
+
Replace libmysqlclient-dev with default-libmysqlclient-dev, which resolves to
|
|
30
|
+
the correct MySQL or MariaDB dev headers on Ubuntu 22.04 and 24.04. For projects
|
|
31
|
+
strictly requiring Oracle MySQL headers, add the official MySQL APT repository
|
|
32
|
+
before installing.
|
|
33
|
+
fix_code:
|
|
34
|
+
- language: yaml
|
|
35
|
+
label: "Replace libmysqlclient-dev with default-libmysqlclient-dev"
|
|
36
|
+
code: |
|
|
37
|
+
- name: Install MySQL development headers
|
|
38
|
+
run: |
|
|
39
|
+
sudo apt-get update
|
|
40
|
+
# libmysqlclient-dev removed in Ubuntu 24.04 — use default-libmysqlclient-dev
|
|
41
|
+
sudo apt-get install -y default-libmysqlclient-dev
|
|
42
|
+
- language: yaml
|
|
43
|
+
label: "Alternative: MariaDB headers explicitly"
|
|
44
|
+
code: |
|
|
45
|
+
- name: Install MariaDB development headers
|
|
46
|
+
run: |
|
|
47
|
+
sudo apt-get update
|
|
48
|
+
sudo apt-get install -y libmariadb-dev pkg-config
|
|
49
|
+
- language: yaml
|
|
50
|
+
label: "Alternative: Oracle MySQL APT repo for strict MySQL requirement"
|
|
51
|
+
code: |
|
|
52
|
+
- name: Add Oracle MySQL APT repository
|
|
53
|
+
run: |
|
|
54
|
+
wget https://dev.mysql.com/get/mysql-apt-config_0.8.33-1_all.deb
|
|
55
|
+
sudo dpkg -i mysql-apt-config_0.8.33-1_all.deb
|
|
56
|
+
sudo apt-get update
|
|
57
|
+
sudo apt-get install -y libmysqlclient-dev
|
|
58
|
+
prevention:
|
|
59
|
+
- "Grep workflow files for libmysqlclient-dev before migrating from ubuntu-22.04 to ubuntu-24.04"
|
|
60
|
+
- "Use default-libmysqlclient-dev in all new workflows — it works on both Ubuntu 22.04 and 24.04"
|
|
61
|
+
- "Pin MySQL client library versions in requirements.txt or Gemfile rather than relying on system headers"
|
|
62
|
+
- "Add an ubuntu-24.04 job to the matrix before retiring ubuntu-22.04 to catch apt package renames early"
|
|
63
|
+
docs:
|
|
64
|
+
- url: "https://packages.ubuntu.com/noble/default-libmysqlclient-dev"
|
|
65
|
+
label: "Ubuntu Noble: default-libmysqlclient-dev"
|
|
66
|
+
- url: "https://dev.mysql.com/doc/refman/8.0/en/linux-installation-apt-repo.html"
|
|
67
|
+
label: "MySQL APT Repository Guide"
|
|
68
|
+
- url: "https://github.com/actions/runner-images/issues/9932"
|
|
69
|
+
label: "runner-images #9932: Ubuntu 24.04 MySQL package rename"
|
|
@@ -0,0 +1,73 @@
|
|
|
1
|
+
id: runner-environment-101
|
|
2
|
+
title: "ubuntu-24.04 openjdk-8-jdk unavailable via apt — must use actions/setup-java"
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- ubuntu-24.04
|
|
7
|
+
- java
|
|
8
|
+
- openjdk
|
|
9
|
+
- apt
|
|
10
|
+
- migration
|
|
11
|
+
- jdk8
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'Package .openjdk-8-(jdk|jre|jre-headless). has no installation candidate'
|
|
14
|
+
flags: "i"
|
|
15
|
+
- regex: 'Unable to locate package openjdk-8'
|
|
16
|
+
flags: "i"
|
|
17
|
+
error_messages:
|
|
18
|
+
- "E: Package 'openjdk-8-jdk' has no installation candidate"
|
|
19
|
+
- "E: Unable to locate package openjdk-8-jdk"
|
|
20
|
+
- "E: Package 'openjdk-8-jre-headless' has no installation candidate"
|
|
21
|
+
root_cause: |
|
|
22
|
+
Ubuntu 24.04 (Noble) dropped OpenJDK 8 from its official apt repositories because
|
|
23
|
+
OpenJDK 8 reached end-of-life upstream. Workflows that install Java via
|
|
24
|
+
apt-get install -y openjdk-8-jdk succeed on ubuntu-22.04 but fail immediately on
|
|
25
|
+
ubuntu-24.04 with "no installation candidate". Common affected scenarios include:
|
|
26
|
+
|
|
27
|
+
- Legacy Android builds requiring Java 8 compile target
|
|
28
|
+
- Apache Ant or Maven builds with a Java 8 minimum
|
|
29
|
+
- Older Spring Boot projects targeting Java 8
|
|
30
|
+
- Workflows that manually set JAVA_HOME after apt-get install
|
|
31
|
+
|
|
32
|
+
The actions/setup-java action with the temurin distribution still supports Java 8
|
|
33
|
+
and is the recommended cross-platform replacement.
|
|
34
|
+
fix: |
|
|
35
|
+
Replace apt-get install openjdk-8-jdk with actions/setup-java using the temurin
|
|
36
|
+
(Eclipse Adoptium, formerly AdoptOpenJDK) distribution. This resolves correctly
|
|
37
|
+
on ubuntu-22.04, ubuntu-24.04, macOS, and Windows runners. Migrate to Java 11 or
|
|
38
|
+
17 LTS if the project allows — Java 8 is past end-of-life.
|
|
39
|
+
fix_code:
|
|
40
|
+
- language: yaml
|
|
41
|
+
label: "Replace apt install with actions/setup-java for JDK 8"
|
|
42
|
+
code: |
|
|
43
|
+
- name: Set up Java 8
|
|
44
|
+
uses: actions/setup-java@v4
|
|
45
|
+
with:
|
|
46
|
+
distribution: temurin # Eclipse Adoptium (formerly AdoptOpenJDK)
|
|
47
|
+
java-version: '8'
|
|
48
|
+
# Prefer java-version: '17' or '21' where the project allows
|
|
49
|
+
- language: yaml
|
|
50
|
+
label: "Matrix: test multiple Java versions"
|
|
51
|
+
code: |
|
|
52
|
+
strategy:
|
|
53
|
+
matrix:
|
|
54
|
+
java: ['8', '11', '17', '21']
|
|
55
|
+
steps:
|
|
56
|
+
- uses: actions/setup-java@v4
|
|
57
|
+
with:
|
|
58
|
+
distribution: temurin
|
|
59
|
+
java-version: ${{ matrix.java }}
|
|
60
|
+
prevention:
|
|
61
|
+
- "Prefer actions/setup-java over apt-get for Java in all workflows — explicit version pinning works cross-platform"
|
|
62
|
+
- "Upgrade to Java 11 or 17 LTS where feasible — Java 8 is EOL"
|
|
63
|
+
- "Search workflow files for openjdk-8 before migrating the runner label to ubuntu-24.04"
|
|
64
|
+
- "Use distribution: zulu as an alternative Azul OpenJDK distribution if Temurin is not suitable"
|
|
65
|
+
docs:
|
|
66
|
+
- url: "https://github.com/actions/setup-java"
|
|
67
|
+
label: "actions/setup-java — supported distributions and versions"
|
|
68
|
+
- url: "https://adoptium.net/temurin/releases/?version=8"
|
|
69
|
+
label: "Eclipse Temurin Java 8 Releases"
|
|
70
|
+
- url: "https://packages.ubuntu.com/search?keywords=openjdk-8"
|
|
71
|
+
label: "Ubuntu Package Search: openjdk-8 availability"
|
|
72
|
+
- url: "https://github.com/actions/runner-images/issues/9848"
|
|
73
|
+
label: "runner-images #9848: openjdk-8 missing on Ubuntu 24.04"
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
id: runner-environment-102
|
|
2
|
+
title: "macOS 14+ xcrun altool removed — notarization workflows fail with 'unable to find utility'"
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- macos
|
|
7
|
+
- xcode
|
|
8
|
+
- notarization
|
|
9
|
+
- altool
|
|
10
|
+
- notarytool
|
|
11
|
+
- codesign
|
|
12
|
+
- migration
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'xcrun: error: unable to find utility .altool.'
|
|
15
|
+
flags: "i"
|
|
16
|
+
- regex: 'altool.*has been deprecated and is no longer supported|unable to find utility .altool.'
|
|
17
|
+
flags: "i"
|
|
18
|
+
error_messages:
|
|
19
|
+
- "xcrun: error: unable to find utility \"altool\", not a developer tool or in PATH"
|
|
20
|
+
- "altool has been deprecated and is no longer supported"
|
|
21
|
+
root_cause: |
|
|
22
|
+
xcrun altool was Apple's original notarization CLI tool. Apple deprecated it in
|
|
23
|
+
Xcode 13 (WWDC 2021) and removed it entirely in Xcode 15 (September 2023).
|
|
24
|
+
GitHub's macOS 14, macOS 15, and macOS 26 runners ship Xcode 15 or later, so
|
|
25
|
+
altool is not present on these runners.
|
|
26
|
+
|
|
27
|
+
Workflows that use any of the following commands fail immediately on macos-14+:
|
|
28
|
+
xcrun altool --notarize-app ...
|
|
29
|
+
xcrun altool --notarization-info ...
|
|
30
|
+
xcrun altool --staple-archive ...
|
|
31
|
+
xcrun altool --notarization-history ...
|
|
32
|
+
|
|
33
|
+
This is a runner image migration break: workflows working on macos-12 or macos-13
|
|
34
|
+
(Xcode 14) silently stop working when the runner label switches to macos-14 or
|
|
35
|
+
macos-latest, which ships Xcode 15+. The failure is loud (non-zero exit from
|
|
36
|
+
xcrun) but easy to miss if teams assume the mac runner version did not change.
|
|
37
|
+
fix: |
|
|
38
|
+
Migrate to xcrun notarytool, the replacement for altool since Xcode 13. Notarytool
|
|
39
|
+
accepts the same Apple ID + app-specific password credentials or the more secure
|
|
40
|
+
App Store Connect API key (recommended for CI — avoids 2FA issues). Submissions
|
|
41
|
+
complete synchronously with --wait, replacing the polling loop previously required
|
|
42
|
+
by altool.
|
|
43
|
+
fix_code:
|
|
44
|
+
- language: yaml
|
|
45
|
+
label: "Migrate from altool to notarytool (Apple ID auth)"
|
|
46
|
+
code: |
|
|
47
|
+
- name: Notarize app
|
|
48
|
+
env:
|
|
49
|
+
APPLE_ID: ${{ secrets.APPLE_ID }}
|
|
50
|
+
APPLE_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
|
51
|
+
TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
52
|
+
run: |
|
|
53
|
+
xcrun notarytool submit MyApp.zip \
|
|
54
|
+
--apple-id "$APPLE_ID" \
|
|
55
|
+
--password "$APPLE_PASSWORD" \
|
|
56
|
+
--team-id "$TEAM_ID" \
|
|
57
|
+
--wait
|
|
58
|
+
|
|
59
|
+
- name: Staple notarization ticket
|
|
60
|
+
run: xcrun stapler staple MyApp.app
|
|
61
|
+
- language: yaml
|
|
62
|
+
label: "Preferred: App Store Connect API key auth (no 2FA issues)"
|
|
63
|
+
code: |
|
|
64
|
+
- name: Notarize with App Store Connect API key
|
|
65
|
+
env:
|
|
66
|
+
API_KEY_ID: ${{ secrets.AC_API_KEY_ID }}
|
|
67
|
+
API_KEY_ISSUER: ${{ secrets.AC_API_KEY_ISSUER }}
|
|
68
|
+
API_KEY_PATH: /tmp/AuthKey.p8
|
|
69
|
+
run: |
|
|
70
|
+
printf '%s' "${{ secrets.AC_API_KEY }}" > "$API_KEY_PATH"
|
|
71
|
+
xcrun notarytool submit MyApp.zip \
|
|
72
|
+
--key "$API_KEY_PATH" \
|
|
73
|
+
--key-id "$API_KEY_ID" \
|
|
74
|
+
--issuer "$API_KEY_ISSUER" \
|
|
75
|
+
--wait
|
|
76
|
+
prevention:
|
|
77
|
+
- "Migrate all xcrun altool commands to xcrun notarytool — altool is gone on any Xcode 15+ runner"
|
|
78
|
+
- "Prefer App Store Connect API key authentication in CI — avoids 2FA prompts and app-specific password rotation"
|
|
79
|
+
- "Search workflow files for altool before updating the macos runner label from macos-13 to macos-14 or macos-latest"
|
|
80
|
+
- "Test notarization on macos-14 alongside macos-13 before fully retiring the older runner label"
|
|
81
|
+
docs:
|
|
82
|
+
- url: "https://developer.apple.com/documentation/notaryapi"
|
|
83
|
+
label: "Apple: Notary API (notarytool)"
|
|
84
|
+
- url: "https://developer.apple.com/news/releases/xcode-15-release-notes/"
|
|
85
|
+
label: "Xcode 15 Release Notes — altool removal"
|
|
86
|
+
- url: "https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution/customizing-the-notarization-workflow"
|
|
87
|
+
label: "Apple: Customizing the notarization workflow"
|
|
88
|
+
- url: "https://github.com/actions/runner-images/discussions/7505"
|
|
89
|
+
label: "runner-images: macOS 14 Xcode 15 notarization migration"
|
package/package.json
CHANGED