@htekdev/actions-debugger 1.0.57 → 1.0.58
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
id: caching-artifacts-040
|
|
2
|
+
title: "actions/download-artifact@v4 cross-workflow download silently returns no artifacts without actions: read permission"
|
|
3
|
+
category: caching-artifacts
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- download-artifact
|
|
7
|
+
- v4
|
|
8
|
+
- cross-workflow
|
|
9
|
+
- permissions
|
|
10
|
+
- actions-read
|
|
11
|
+
- run-id
|
|
12
|
+
- breaking-change
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'Unable to find any artifacts for the associated workflow'
|
|
15
|
+
flags: 'i'
|
|
16
|
+
- regex: 'No artifacts found for the associated workflow run'
|
|
17
|
+
flags: 'i'
|
|
18
|
+
- regex: 'run-id:.*\d+'
|
|
19
|
+
flags: 'i'
|
|
20
|
+
- regex: 'Resource not accessible by integration'
|
|
21
|
+
flags: 'i'
|
|
22
|
+
error_messages:
|
|
23
|
+
- "Unable to find any artifacts for the associated workflow"
|
|
24
|
+
- "No artifacts found for the associated workflow run"
|
|
25
|
+
- "Resource not accessible by integration"
|
|
26
|
+
- "Error: Artifact download failed: 403 Forbidden"
|
|
27
|
+
root_cause: |
|
|
28
|
+
actions/download-artifact@v4 introduced the ability to download artifacts produced
|
|
29
|
+
by a *different* workflow run (not just the current run) by specifying the `run-id`
|
|
30
|
+
input. This cross-workflow download requires the `actions: read` permission on the
|
|
31
|
+
GITHUB_TOKEN.
|
|
32
|
+
|
|
33
|
+
Workflows that do not explicitly declare `permissions: actions: read` will use the
|
|
34
|
+
default GITHUB_TOKEN permissions. In repositories where the default token permissions
|
|
35
|
+
are set to "read for all" at the org level, `actions` read may be granted by default
|
|
36
|
+
— but in repositories with restrictive default permissions or when only specific
|
|
37
|
+
permissions are declared in the workflow, `actions: read` is NOT automatically
|
|
38
|
+
included.
|
|
39
|
+
|
|
40
|
+
The misleading aspect is the error message: "Unable to find any artifacts for the
|
|
41
|
+
associated workflow" suggests the artifact does not exist, when in fact the issue is
|
|
42
|
+
a 403 permission denial. The action does not distinguish between "artifact not found"
|
|
43
|
+
and "access denied" in its error output.
|
|
44
|
+
|
|
45
|
+
This is a new permission requirement introduced in v4 that did not exist in v3
|
|
46
|
+
(which only supported downloading from the current workflow run and did not need
|
|
47
|
+
`actions` read access).
|
|
48
|
+
|
|
49
|
+
Common trigger scenario: a workflow that processes artifacts from a different trigger
|
|
50
|
+
(e.g., a deployment workflow that downloads build artifacts from a build workflow run)
|
|
51
|
+
is upgraded from download-artifact@v3 to @v4 and the `run-id` input is added — but
|
|
52
|
+
the required `permissions: actions: read` block is not added.
|
|
53
|
+
fix: |
|
|
54
|
+
Add `actions: read` to the permissions block of the job or workflow that uses
|
|
55
|
+
`actions/download-artifact@v4` with a `run-id` input referencing a different workflow.
|
|
56
|
+
|
|
57
|
+
If the workflow or job already has a `permissions` block, add `actions: read` to it.
|
|
58
|
+
If there is no `permissions` block, add one with the minimum required permissions
|
|
59
|
+
including `actions: read` and `contents: read`.
|
|
60
|
+
fix_code:
|
|
61
|
+
- language: yaml
|
|
62
|
+
label: "Add actions: read permission for cross-workflow artifact download"
|
|
63
|
+
code: |
|
|
64
|
+
jobs:
|
|
65
|
+
deploy:
|
|
66
|
+
runs-on: ubuntu-latest
|
|
67
|
+
permissions:
|
|
68
|
+
actions: read # Required for download-artifact@v4 with run-id
|
|
69
|
+
contents: read
|
|
70
|
+
steps:
|
|
71
|
+
- name: Download build artifacts from build workflow
|
|
72
|
+
uses: actions/download-artifact@v4
|
|
73
|
+
with:
|
|
74
|
+
name: build-output
|
|
75
|
+
run-id: ${{ github.event.inputs.build_run_id }}
|
|
76
|
+
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
77
|
+
- language: yaml
|
|
78
|
+
label: "Workflow-level permissions for cross-workflow download"
|
|
79
|
+
code: |
|
|
80
|
+
on:
|
|
81
|
+
workflow_dispatch:
|
|
82
|
+
inputs:
|
|
83
|
+
build_run_id:
|
|
84
|
+
description: 'Run ID of the build workflow'
|
|
85
|
+
required: true
|
|
86
|
+
type: string
|
|
87
|
+
|
|
88
|
+
permissions:
|
|
89
|
+
actions: read
|
|
90
|
+
contents: read
|
|
91
|
+
|
|
92
|
+
jobs:
|
|
93
|
+
deploy:
|
|
94
|
+
runs-on: ubuntu-latest
|
|
95
|
+
steps:
|
|
96
|
+
- uses: actions/download-artifact@v4
|
|
97
|
+
with:
|
|
98
|
+
name: dist
|
|
99
|
+
run-id: ${{ inputs.build_run_id }}
|
|
100
|
+
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
101
|
+
prevention:
|
|
102
|
+
- "Whenever `run-id` is added to a download-artifact@v4 step, immediately add `actions: read` to the job permissions block"
|
|
103
|
+
- "Do not rely on default token permissions for cross-workflow operations — always declare explicit permission blocks"
|
|
104
|
+
- "Test cross-workflow downloads in a feature branch before merging — the permission error is deterministic, not flaky"
|
|
105
|
+
- "Add `github-token: ${{ secrets.GITHUB_TOKEN }}` explicitly to download-artifact@v4 steps that use run-id, as it clarifies the token in use"
|
|
106
|
+
docs:
|
|
107
|
+
- url: "https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/storing-workflow-data-as-artifacts#downloading-artifacts-from-a-previous-workflow-run"
|
|
108
|
+
label: "GitHub Docs — Downloading artifacts from a previous workflow run"
|
|
109
|
+
- url: "https://github.com/actions/download-artifact/releases/tag/v4.0.0"
|
|
110
|
+
label: "actions/download-artifact v4.0.0 release notes — cross-workflow download"
|
|
111
|
+
- url: "https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token#defining-access-for-the-github_token-scopes"
|
|
112
|
+
label: "GitHub Docs — GITHUB_TOKEN permission scopes"
|
|
@@ -0,0 +1,125 @@
|
|
|
1
|
+
id: permissions-auth-042
|
|
2
|
+
title: "actions/attest-build-provenance requires both id-token: write AND attestations: write — missing attestations permission causes 403"
|
|
3
|
+
category: permissions-auth
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- attestations
|
|
7
|
+
- attest-build-provenance
|
|
8
|
+
- id-token
|
|
9
|
+
- permissions
|
|
10
|
+
- supply-chain
|
|
11
|
+
- sigstore
|
|
12
|
+
- 403
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'attestations.*write.*required|write.*attestations.*required'
|
|
15
|
+
flags: 'i'
|
|
16
|
+
- regex: 'Resource not accessible by integration.*attest'
|
|
17
|
+
flags: 'i'
|
|
18
|
+
- regex: 'Error: Failed to create attestation'
|
|
19
|
+
flags: 'i'
|
|
20
|
+
- regex: 'permissions.*attestations.*write'
|
|
21
|
+
flags: 'i'
|
|
22
|
+
error_messages:
|
|
23
|
+
- "Error: Failed to create attestation: Resource not accessible by integration"
|
|
24
|
+
- "Error: Failed to create attestation: 403 Forbidden"
|
|
25
|
+
- "RequestError [HttpError]: Resource not accessible by integration"
|
|
26
|
+
- "Error: Attestation creation failed: must have `attestations: write` permission"
|
|
27
|
+
root_cause: |
|
|
28
|
+
GitHub's artifact attestation feature (GA May 2024, https://github.blog/changelog/2024-05-02-github-artifact-attestations-is-generally-available/)
|
|
29
|
+
allows workflows to generate Sigstore-compatible provenance attestations for build
|
|
30
|
+
artifacts using `actions/attest-build-provenance` or `actions/attest`.
|
|
31
|
+
|
|
32
|
+
These actions require TWO permissions on the GITHUB_TOKEN:
|
|
33
|
+
1. `id-token: write` — to fetch an OIDC token from GitHub's identity provider
|
|
34
|
+
(used to sign the attestation with Sigstore)
|
|
35
|
+
2. `attestations: write` — to store the attestation in GitHub's attestation store
|
|
36
|
+
(new permission introduced with the attestation feature)
|
|
37
|
+
|
|
38
|
+
Most early documentation examples, blog posts, and quickstarts only show
|
|
39
|
+
`id-token: write`, omitting `attestations: write`. Developers following these
|
|
40
|
+
examples get a cryptic 403 "Resource not accessible by integration" error when
|
|
41
|
+
the attest step runs, with no clear indication that a second permission is missing.
|
|
42
|
+
|
|
43
|
+
The error is consistent and not environment-specific — it will fail on every run
|
|
44
|
+
until the `attestations: write` permission is added.
|
|
45
|
+
|
|
46
|
+
Additionally, organization-level policies may restrict the use of attestations.
|
|
47
|
+
If the organization has disabled artifact attestations, the 403 will occur even
|
|
48
|
+
with both permissions present — the error message does not distinguish between
|
|
49
|
+
"missing permission" and "feature disabled by org policy".
|
|
50
|
+
fix: |
|
|
51
|
+
Add BOTH `id-token: write` AND `attestations: write` to the permissions block
|
|
52
|
+
of the job that runs the attest-build-provenance action.
|
|
53
|
+
|
|
54
|
+
If your workflow or job already declares a `permissions` block, add both entries
|
|
55
|
+
to it. If your workflow has no permissions block, add one with both required
|
|
56
|
+
permissions plus any other permissions your workflow needs (e.g., `contents: read`
|
|
57
|
+
for checkout).
|
|
58
|
+
|
|
59
|
+
Note: `attestations: write` is only available on github.com. GitHub Enterprise
|
|
60
|
+
Server (GHES) requires GHES 3.12+ for attestation support.
|
|
61
|
+
fix_code:
|
|
62
|
+
- language: yaml
|
|
63
|
+
label: "Correct permissions for actions/attest-build-provenance"
|
|
64
|
+
code: |
|
|
65
|
+
jobs:
|
|
66
|
+
build-and-attest:
|
|
67
|
+
runs-on: ubuntu-latest
|
|
68
|
+
permissions:
|
|
69
|
+
id-token: write # Required: OIDC token for Sigstore signing
|
|
70
|
+
attestations: write # Required: write attestation to GitHub store
|
|
71
|
+
contents: read # Required: checkout
|
|
72
|
+
|
|
73
|
+
steps:
|
|
74
|
+
- uses: actions/checkout@v4
|
|
75
|
+
|
|
76
|
+
- name: Build artifact
|
|
77
|
+
run: |
|
|
78
|
+
npm ci
|
|
79
|
+
npm run build
|
|
80
|
+
tar -czf dist.tar.gz dist/
|
|
81
|
+
|
|
82
|
+
- name: Generate build provenance attestation
|
|
83
|
+
uses: actions/attest-build-provenance@v2
|
|
84
|
+
with:
|
|
85
|
+
subject-path: dist.tar.gz
|
|
86
|
+
- language: yaml
|
|
87
|
+
label: "Attest multiple subjects (container image + artifact)"
|
|
88
|
+
code: |
|
|
89
|
+
jobs:
|
|
90
|
+
release:
|
|
91
|
+
runs-on: ubuntu-latest
|
|
92
|
+
permissions:
|
|
93
|
+
id-token: write
|
|
94
|
+
attestations: write
|
|
95
|
+
contents: read
|
|
96
|
+
packages: write # If pushing to GHCR
|
|
97
|
+
|
|
98
|
+
steps:
|
|
99
|
+
- uses: actions/checkout@v4
|
|
100
|
+
|
|
101
|
+
- name: Attest binary
|
|
102
|
+
uses: actions/attest-build-provenance@v2
|
|
103
|
+
with:
|
|
104
|
+
subject-path: bin/myapp
|
|
105
|
+
|
|
106
|
+
- name: Attest container image
|
|
107
|
+
uses: actions/attest-build-provenance@v2
|
|
108
|
+
with:
|
|
109
|
+
subject-name: ghcr.io/${{ github.repository }}/myapp
|
|
110
|
+
subject-digest: ${{ steps.push.outputs.digest }}
|
|
111
|
+
push-to-registry: true
|
|
112
|
+
prevention:
|
|
113
|
+
- "Always include BOTH `id-token: write` and `attestations: write` in the permissions block — neither alone is sufficient"
|
|
114
|
+
- "Copy the permissions block from the official actions/attest-build-provenance README examples, not from third-party blog posts"
|
|
115
|
+
- "Use `gh attestation verify <artifact>` locally to test that attestations were created successfully after the workflow runs"
|
|
116
|
+
- "For GHES deployments, verify the GHES version is 3.12+ before adding attestation steps to workflows"
|
|
117
|
+
docs:
|
|
118
|
+
- url: "https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds"
|
|
119
|
+
label: "GitHub Docs — Using artifact attestations to establish provenance"
|
|
120
|
+
- url: "https://github.blog/changelog/2024-05-02-github-artifact-attestations-is-generally-available/"
|
|
121
|
+
label: "GitHub Changelog — Artifact attestations GA (May 2024)"
|
|
122
|
+
- url: "https://github.com/actions/attest-build-provenance"
|
|
123
|
+
label: "actions/attest-build-provenance — README and required permissions"
|
|
124
|
+
- url: "https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token"
|
|
125
|
+
label: "GitHub Docs — GITHUB_TOKEN permission scopes (attestations: write)"
|
|
@@ -0,0 +1,102 @@
|
|
|
1
|
+
id: runner-environment-118
|
|
2
|
+
title: "Node.js 20 actions deprecated — forced to Node.js 24 runtime starting June 16, 2026"
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: warning
|
|
5
|
+
tags:
|
|
6
|
+
- node-20
|
|
7
|
+
- node-24
|
|
8
|
+
- deprecation
|
|
9
|
+
- actions-runtime
|
|
10
|
+
- checkout
|
|
11
|
+
- setup-node
|
|
12
|
+
- self-hosted-runner
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'Node\.js 20 actions are deprecated'
|
|
15
|
+
flags: 'i'
|
|
16
|
+
- regex: 'forced to run with Node\.js 24 by default'
|
|
17
|
+
flags: 'i'
|
|
18
|
+
- regex: 'using:\s*node20'
|
|
19
|
+
flags: 'i'
|
|
20
|
+
- regex: 'ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION'
|
|
21
|
+
flags: 'i'
|
|
22
|
+
error_messages:
|
|
23
|
+
- "Node.js 20 actions are deprecated. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026."
|
|
24
|
+
- "Node.js 20 will be removed from the runner on September 16th, 2026."
|
|
25
|
+
- "Please check if updated versions of these actions are available that support Node.js 24."
|
|
26
|
+
root_cause: |
|
|
27
|
+
GitHub deprecated Node.js 20 as the runtime for GitHub Actions in September 2025
|
|
28
|
+
(https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/).
|
|
29
|
+
Starting June 16, 2026, actions that declare `using: node20` are force-upgraded to
|
|
30
|
+
Node.js 24 on hosted runners. Node.js 20 will be fully removed from hosted runners
|
|
31
|
+
on September 16, 2026.
|
|
32
|
+
|
|
33
|
+
This affects two distinct scenarios:
|
|
34
|
+
|
|
35
|
+
1. First-party GitHub-maintained actions (actions/checkout@v4, actions/setup-node@v4,
|
|
36
|
+
actions/upload-artifact@v4, etc.) — GitHub is updating these actions to ship Node.js 24
|
|
37
|
+
variants. Pinning to older major versions (e.g., @v4 without updating) will trigger
|
|
38
|
+
the deprecation warning until updated versions are pinned.
|
|
39
|
+
|
|
40
|
+
2. Community and custom actions that declare `using: node20` in their action.yml —
|
|
41
|
+
these will be silently force-upgraded to Node.js 24, which may break actions that
|
|
42
|
+
rely on Node.js 20 APIs, native modules compiled for Node 20, or behavior differences
|
|
43
|
+
between Node 20 and Node 24 (e.g., stricter URL parsing, OpenSSL changes).
|
|
44
|
+
|
|
45
|
+
3. Self-hosted runners with Node.js 18/20 installed — if the runner does not have
|
|
46
|
+
Node.js 24 available and FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 is set to true, the
|
|
47
|
+
action will fail to find a suitable runtime.
|
|
48
|
+
|
|
49
|
+
The deprecation warning appears as an annotation on every workflow run that uses an
|
|
50
|
+
affected action. While currently advisory, it becomes a hard failure on September 16, 2026.
|
|
51
|
+
fix: |
|
|
52
|
+
Update all first-party GitHub actions to their latest versions that ship Node.js 24
|
|
53
|
+
support. For actions/checkout, setup-node, upload-artifact, download-artifact, and
|
|
54
|
+
other official actions, check the latest release tag.
|
|
55
|
+
|
|
56
|
+
For self-hosted runners, install Node.js 24 on the runner host before June 16, 2026.
|
|
57
|
+
|
|
58
|
+
For custom or community actions you maintain, update action.yml to declare
|
|
59
|
+
`using: node24` and update package.json to target Node.js 24.
|
|
60
|
+
|
|
61
|
+
To opt in early and test Node.js 24 behavior before the forced cutover, set the
|
|
62
|
+
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 environment variable to `true` in your workflow
|
|
63
|
+
or at the runner level.
|
|
64
|
+
fix_code:
|
|
65
|
+
- language: yaml
|
|
66
|
+
label: "Update first-party actions to Node.js 24 compatible versions"
|
|
67
|
+
code: |
|
|
68
|
+
jobs:
|
|
69
|
+
build:
|
|
70
|
+
runs-on: ubuntu-latest
|
|
71
|
+
steps:
|
|
72
|
+
# Update to latest versions that support Node.js 24
|
|
73
|
+
- uses: actions/checkout@v4.2.2 # or latest v5 when available
|
|
74
|
+
- uses: actions/setup-node@v4.1.0 # or latest
|
|
75
|
+
- uses: actions/upload-artifact@v4.4.0 # or latest
|
|
76
|
+
- uses: actions/download-artifact@v4.2.0
|
|
77
|
+
- language: yaml
|
|
78
|
+
label: "Opt in early to Node.js 24 for testing"
|
|
79
|
+
code: |
|
|
80
|
+
env:
|
|
81
|
+
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
|
|
82
|
+
|
|
83
|
+
jobs:
|
|
84
|
+
build:
|
|
85
|
+
runs-on: ubuntu-latest
|
|
86
|
+
steps:
|
|
87
|
+
- uses: actions/checkout@v4
|
|
88
|
+
- name: Run build
|
|
89
|
+
run: npm ci && npm run build
|
|
90
|
+
prevention:
|
|
91
|
+
- "Pin actions to specific minor versions (e.g., @v4.2.2) and use Dependabot or Renovate to auto-update them"
|
|
92
|
+
- "Add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true to workflow env to test Node.js 24 compatibility before the forced cutover"
|
|
93
|
+
- "For self-hosted runners, ensure Node.js 24 is installed and available on PATH before June 16, 2026"
|
|
94
|
+
- "Audit custom actions in your organization for `using: node20` declarations and update them to `using: node24`"
|
|
95
|
+
- "Subscribe to the GitHub Changelog (https://github.blog/changelog/) to catch runtime deprecations early"
|
|
96
|
+
docs:
|
|
97
|
+
- url: "https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/"
|
|
98
|
+
label: "GitHub Changelog — Deprecation of Node.js 20 on GitHub Actions runners (Sept 2025)"
|
|
99
|
+
- url: "https://docs.github.com/en/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runsusing"
|
|
100
|
+
label: "GitHub Docs — Action metadata syntax: runs.using"
|
|
101
|
+
- url: "https://nodejs.org/en/about/previous-releases"
|
|
102
|
+
label: "Node.js release schedule — LTS lifecycle"
|
|
@@ -0,0 +1,104 @@
|
|
|
1
|
+
id: silent-failures-059
|
|
2
|
+
title: "ubuntu-latest label changed to ubuntu-24.04 — workflows silently regress without any code change"
|
|
3
|
+
category: silent-failures
|
|
4
|
+
severity: silent-failure
|
|
5
|
+
tags:
|
|
6
|
+
- ubuntu-latest
|
|
7
|
+
- ubuntu-24.04
|
|
8
|
+
- runner-label
|
|
9
|
+
- breaking-change
|
|
10
|
+
- silent-regression
|
|
11
|
+
- changelog
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'runs-on:\s*ubuntu-latest'
|
|
14
|
+
flags: 'i'
|
|
15
|
+
- regex: 'GITHUB_ENV.*ubuntu-24\.04'
|
|
16
|
+
flags: 'i'
|
|
17
|
+
- regex: 'ImageVersion.*24\.04'
|
|
18
|
+
flags: 'i'
|
|
19
|
+
error_messages:
|
|
20
|
+
- "ubuntu-latest now points to ubuntu-24.04"
|
|
21
|
+
- "ImageVersion: 24.04"
|
|
22
|
+
- "DISTRIB_CODENAME=noble"
|
|
23
|
+
root_cause: |
|
|
24
|
+
GitHub periodically updates the `ubuntu-latest` runner label to point to a newer
|
|
25
|
+
Ubuntu LTS release. When GitHub updated `ubuntu-latest` from ubuntu-22.04 to
|
|
26
|
+
ubuntu-24.04, workflows using `runs-on: ubuntu-latest` silently started running on
|
|
27
|
+
a different operating system with no error, no annotation, and no workflow file change.
|
|
28
|
+
|
|
29
|
+
This is a silent failure because:
|
|
30
|
+
- The workflow YAML file is unchanged
|
|
31
|
+
- GitHub Actions does not emit any warning when the label target changes
|
|
32
|
+
- Workflow run logs show "ubuntu-24.04" only in the runner image annotation, which
|
|
33
|
+
many developers don't actively monitor
|
|
34
|
+
- All jobs complete with exit code 0 even though the software environment changed
|
|
35
|
+
|
|
36
|
+
Ubuntu 24.04 (Noble) introduced multiple breaking changes relative to 22.04 (Jammy):
|
|
37
|
+
- Python 3.12 as default (removes distutils, changes pip behavior)
|
|
38
|
+
- OpenSSL 3.3 with stricter TLS renegotiation defaults
|
|
39
|
+
- nftables replaces iptables (breaks Docker networking setups using iptables rules)
|
|
40
|
+
- python3-distutils apt package removed
|
|
41
|
+
- python alias may not resolve to python3 in all contexts
|
|
42
|
+
- libssl1.1 removed (only libssl3 available)
|
|
43
|
+
- Various default package versions changed (gcc, make, cmake)
|
|
44
|
+
|
|
45
|
+
Any workflow that relied on implicit ubuntu-22.04 behavior while pinning only
|
|
46
|
+
`ubuntu-latest` is at risk of silent behavioral changes, test flakiness, or
|
|
47
|
+
hard build failures that appear unrelated to any code change.
|
|
48
|
+
fix: |
|
|
49
|
+
Pin the runner to an explicit Ubuntu version to opt out of automatic label
|
|
50
|
+
updates. Use `runs-on: ubuntu-22.04` if you need the previous behavior, or
|
|
51
|
+
explicitly migrate to `runs-on: ubuntu-24.04` and verify all workflow steps
|
|
52
|
+
work correctly.
|
|
53
|
+
|
|
54
|
+
To identify which runner version you are actually running, add a diagnostic step:
|
|
55
|
+
|
|
56
|
+
```bash
|
|
57
|
+
echo "Runner: $RUNNER_OS $ImageVersion"
|
|
58
|
+
lsb_release -a
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
Review each ubuntu-24.04 breaking change that applies to your workflow and
|
|
62
|
+
address them before pinning to ubuntu-24.04. See the related runner-environment
|
|
63
|
+
entries for specific package and API breakages.
|
|
64
|
+
fix_code:
|
|
65
|
+
- language: yaml
|
|
66
|
+
label: "Pin to explicit Ubuntu version instead of ubuntu-latest"
|
|
67
|
+
code: |
|
|
68
|
+
jobs:
|
|
69
|
+
build:
|
|
70
|
+
# Pin explicitly instead of ubuntu-latest to avoid silent label updates
|
|
71
|
+
runs-on: ubuntu-22.04 # or ubuntu-24.04 after testing
|
|
72
|
+
|
|
73
|
+
# To migrate to 24.04, test explicitly first:
|
|
74
|
+
# runs-on: ubuntu-24.04
|
|
75
|
+
steps:
|
|
76
|
+
- uses: actions/checkout@v4
|
|
77
|
+
- name: Show runner info
|
|
78
|
+
run: lsb_release -a && python3 --version
|
|
79
|
+
- language: yaml
|
|
80
|
+
label: "Matrix strategy to test across Ubuntu versions before committing"
|
|
81
|
+
code: |
|
|
82
|
+
jobs:
|
|
83
|
+
test:
|
|
84
|
+
strategy:
|
|
85
|
+
matrix:
|
|
86
|
+
os: [ubuntu-22.04, ubuntu-24.04]
|
|
87
|
+
runs-on: ${{ matrix.os }}
|
|
88
|
+
steps:
|
|
89
|
+
- uses: actions/checkout@v4
|
|
90
|
+
- name: Run tests
|
|
91
|
+
run: npm test
|
|
92
|
+
prevention:
|
|
93
|
+
- "Never use `ubuntu-latest` in production workflows — pin to an explicit version (ubuntu-22.04, ubuntu-24.04)"
|
|
94
|
+
- "Subscribe to GitHub Changelog announcements for runner label change notices before they go live"
|
|
95
|
+
- "Add a matrix build that tests both current and next Ubuntu LTS versions as part of ongoing CI"
|
|
96
|
+
- "Include a step that prints `lsb_release -a` to make runner version visible in logs without digging into annotations"
|
|
97
|
+
- "When migrating to a new Ubuntu version, run `apt-cache policy <package>` to verify package availability before deploying"
|
|
98
|
+
docs:
|
|
99
|
+
- url: "https://docs.github.com/en/actions/using-github-hosted-runners/using-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources"
|
|
100
|
+
label: "GitHub Docs — Supported runners (ubuntu-latest current target)"
|
|
101
|
+
- url: "https://github.blog/changelog/2025-01-16-github-actions-all-actions-on-ubuntu-latest-will-now-be-run-on-ubuntu-24-04/"
|
|
102
|
+
label: "GitHub Changelog — ubuntu-latest updated to ubuntu-24.04"
|
|
103
|
+
- url: "https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md"
|
|
104
|
+
label: "runner-images — Ubuntu 24.04 pre-installed software list"
|
package/package.json
CHANGED