@htekdev/actions-debugger 1.0.61 → 1.0.62
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
id: permissions-auth-044
|
|
2
|
+
title: "OIDC token sub claim format changes inside reusable workflow jobs, breaking cloud provider trust policies"
|
|
3
|
+
category: permissions-auth
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- oidc
|
|
7
|
+
- reusable-workflow
|
|
8
|
+
- aws
|
|
9
|
+
- gcp
|
|
10
|
+
- trust-policy
|
|
11
|
+
- sub-claim
|
|
12
|
+
- job-workflow-ref
|
|
13
|
+
patterns:
|
|
14
|
+
- regex: 'Not authorized to perform sts:AssumeRoleWithWebIdentity'
|
|
15
|
+
flags: i
|
|
16
|
+
- regex: 'failed to generate Google Cloud federated token'
|
|
17
|
+
flags: i
|
|
18
|
+
- regex: 'Credentials could not be loaded.*Could not load credentials from any providers'
|
|
19
|
+
flags: i
|
|
20
|
+
error_messages:
|
|
21
|
+
- "An error occurred (AccessDenied) when calling the AssumeRoleWithWebIdentity operation: Not authorized to perform sts:AssumeRoleWithWebIdentity"
|
|
22
|
+
- "Error: google-github-actions/auth failed to generate Google Cloud federated token for..."
|
|
23
|
+
- "Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers"
|
|
24
|
+
root_cause: |
|
|
25
|
+
When a job runs inside a reusable workflow (called via uses:), GitHub changes the format of
|
|
26
|
+
the OIDC token sub claim to include the calling workflow's path. For a direct job the sub is:
|
|
27
|
+
repo:ORG/REPO:ref:refs/heads/main
|
|
28
|
+
For a job inside a reusable workflow the sub becomes:
|
|
29
|
+
repo:ORG/REPO:job_workflow_ref:ORG/REPO/.github/workflows/reusable.yml@refs/heads/main
|
|
30
|
+
AWS IAM OIDC trust policies and GCP Workload Identity Federation attribute conditions that
|
|
31
|
+
were configured to match the simpler ref-based sub format now reject the OIDC token with an
|
|
32
|
+
AccessDenied error. The error message gives no indication that the sub claim format changed —
|
|
33
|
+
it looks identical to any other OIDC trust policy mismatch.
|
|
34
|
+
fix: |
|
|
35
|
+
Update the cloud provider's OIDC trust policy to match the new sub claim format used by
|
|
36
|
+
reusable workflow jobs. For AWS, update the IAM trust policy StringLike condition to match
|
|
37
|
+
job_workflow_ref instead of ref. For GCP, update the attribute condition in the Workload
|
|
38
|
+
Identity Pool provider. Alternatively, use GitHub's OIDC subject claim customization feature
|
|
39
|
+
(repo Settings → Actions → General → OIDC subject claims) to define a consistent sub claim
|
|
40
|
+
template that works for both caller and reusable workflow jobs.
|
|
41
|
+
fix_code:
|
|
42
|
+
- language: yaml
|
|
43
|
+
label: "Reusable workflow with id-token permission declared (required)"
|
|
44
|
+
code: |
|
|
45
|
+
# In the reusable workflow file (.github/workflows/reusable.yml):
|
|
46
|
+
on:
|
|
47
|
+
workflow_call:
|
|
48
|
+
|
|
49
|
+
permissions:
|
|
50
|
+
id-token: write
|
|
51
|
+
contents: read
|
|
52
|
+
|
|
53
|
+
jobs:
|
|
54
|
+
deploy:
|
|
55
|
+
runs-on: ubuntu-latest
|
|
56
|
+
steps:
|
|
57
|
+
- name: Configure AWS credentials
|
|
58
|
+
uses: aws-actions/configure-aws-credentials@v4
|
|
59
|
+
with:
|
|
60
|
+
role-to-assume: arn:aws:iam::123456789:role/my-role
|
|
61
|
+
aws-region: us-east-1
|
|
62
|
+
- language: yaml
|
|
63
|
+
label: "AWS IAM trust policy StringLike condition for reusable workflow sub claim"
|
|
64
|
+
code: |
|
|
65
|
+
# Update AWS IAM role trust policy Condition block to match reusable workflow sub format.
|
|
66
|
+
# Old (direct job): "repo:ORG/REPO:ref:refs/heads/main"
|
|
67
|
+
# New (reusable job): "repo:ORG/REPO:job_workflow_ref:ORG/REPO/.github/workflows/reusable.yml@refs/heads/main"
|
|
68
|
+
#
|
|
69
|
+
# Use a wildcard to allow both patterns:
|
|
70
|
+
# "token.actions.githubusercontent.com:sub": "StringLike": ["repo:ORG/REPO:*"]
|
|
71
|
+
prevention:
|
|
72
|
+
- "When refactoring direct jobs into reusable workflows, update cloud OIDC trust policies before deploying"
|
|
73
|
+
- "Use GitHub subject claim customization to define a consistent sub format that works across direct and reusable jobs"
|
|
74
|
+
- "Document the expected OIDC sub claim format in the reusable workflow README alongside cloud policy requirements"
|
|
75
|
+
- "Test OIDC authentication in a staging cloud environment when moving jobs into reusable workflows"
|
|
76
|
+
docs:
|
|
77
|
+
- url: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/using-openid-connect-with-reusable-workflows
|
|
78
|
+
label: "GitHub Docs: Using OIDC with reusable workflows"
|
|
79
|
+
- url: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-subject-claims-for-an-organization-or-repository
|
|
80
|
+
label: "GitHub Docs: Customizing OIDC subject claims"
|
|
81
|
+
- url: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html
|
|
82
|
+
label: "AWS Docs: Creating IAM OIDC identity providers"
|
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
id: runner-environment-123
|
|
2
|
+
title: "actions/checkout@v6 breaks Docker container actions that use git authentication"
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: error
|
|
5
|
+
tags:
|
|
6
|
+
- checkout
|
|
7
|
+
- v6
|
|
8
|
+
- docker
|
|
9
|
+
- container-action
|
|
10
|
+
- git-auth
|
|
11
|
+
- breaking-change
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'fatal: could not read Username for.*No such device or address'
|
|
14
|
+
flags: i
|
|
15
|
+
- regex: 'fatal: Authentication failed for.*github\.com'
|
|
16
|
+
flags: i
|
|
17
|
+
- regex: 'fatal: credential helper.*is not executable'
|
|
18
|
+
flags: i
|
|
19
|
+
error_messages:
|
|
20
|
+
- "fatal: could not read Username for 'https://github.com/': No such device or address"
|
|
21
|
+
- "fatal: Authentication failed for 'https://github.com/org/repo.git/'"
|
|
22
|
+
- "Error: The process '/usr/bin/git' failed with exit code 128"
|
|
23
|
+
root_cause: |
|
|
24
|
+
actions/checkout@v6 changed credential storage: credentials are now written to the runner's
|
|
25
|
+
native credential manager rather than the global gitconfig file. Docker container actions run
|
|
26
|
+
in isolated containers without access to the runner host's credential store, so any git
|
|
27
|
+
operations inside a Docker-based action or container: job that require authentication fail.
|
|
28
|
+
This is a breaking change from v5, where credentials were written to gitconfig and could be
|
|
29
|
+
inherited by Docker containers. The v6 runner PR #4011 introduced this mechanism and Docker
|
|
30
|
+
container action support is gated behind a feature flag not yet enabled for all runners.
|
|
31
|
+
fix: |
|
|
32
|
+
Pin to actions/checkout@v5 for workflows that rely on Docker container actions making
|
|
33
|
+
authenticated git calls. Monitor the actions/checkout issue tracker for v6 Docker container
|
|
34
|
+
action support. Alternatively, pass the GITHUB_TOKEN as an environment variable to the Docker
|
|
35
|
+
action and configure credentials inside the container's own entrypoint script.
|
|
36
|
+
fix_code:
|
|
37
|
+
- language: yaml
|
|
38
|
+
label: "Pin to actions/checkout@v5 for Docker container action compatibility"
|
|
39
|
+
code: |
|
|
40
|
+
- name: Checkout repository
|
|
41
|
+
uses: actions/checkout@v5
|
|
42
|
+
with:
|
|
43
|
+
token: ${{ secrets.GITHUB_TOKEN }}
|
|
44
|
+
- language: yaml
|
|
45
|
+
label: "Pass token as env var to Docker action for container-side credential setup"
|
|
46
|
+
code: |
|
|
47
|
+
- name: Run Docker-based action with explicit token
|
|
48
|
+
uses: org/my-docker-action@v1
|
|
49
|
+
env:
|
|
50
|
+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
51
|
+
prevention:
|
|
52
|
+
- "Pin actions/checkout to a tested major version and review release notes before upgrading to a new major"
|
|
53
|
+
- "Audit workflows for Docker container actions that perform authenticated repository operations before upgrading checkout"
|
|
54
|
+
- "Test Docker-based custom actions in CI against the new checkout version before rolling out"
|
|
55
|
+
docs:
|
|
56
|
+
- url: https://github.com/actions/checkout/issues/2313
|
|
57
|
+
label: "actions/checkout#2313: v6 breaks Docker actions that use git authentication"
|
|
58
|
+
- url: https://github.com/orgs/community/discussions/179107
|
|
59
|
+
label: "GitHub Community: actions/checkout v6 changes discussion"
|
|
60
|
+
- url: https://github.com/actions/runner/pull/4011
|
|
61
|
+
label: "actions/runner PR#4011: credential manager changes introduced in v6"
|
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
id: runner-environment-124
|
|
2
|
+
title: "actions/setup-go@v6 GOTOOLCHAIN auto mode downloads unexpected Go version from go.mod toolchain directive"
|
|
3
|
+
category: runner-environment
|
|
4
|
+
severity: silent-failure
|
|
5
|
+
tags:
|
|
6
|
+
- setup-go
|
|
7
|
+
- v6
|
|
8
|
+
- gotoolchain
|
|
9
|
+
- go-version
|
|
10
|
+
- toolchain-directive
|
|
11
|
+
- breaking-change
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'go: downloading go\d+\.\d+\.\d+ \('
|
|
14
|
+
flags: i
|
|
15
|
+
- regex: 'toolchain go\d+\.\d+\.\d+ cannot be used because it would require a later version'
|
|
16
|
+
flags: i
|
|
17
|
+
- regex: 'go: toolchain go\d+\.\d+\.\d+ not available on GOPROXY'
|
|
18
|
+
flags: i
|
|
19
|
+
error_messages:
|
|
20
|
+
- "go: downloading go1.23.4 (linux/amd64)"
|
|
21
|
+
- "toolchain go1.23.4 cannot be used because it would require a later version"
|
|
22
|
+
- "go: toolchain go1.23.4 not available on GOPROXY"
|
|
23
|
+
root_cause: |
|
|
24
|
+
actions/setup-go@v6 (released September 2025) changed toolchain handling to honor Go 1.21+
|
|
25
|
+
GOTOOLCHAIN semantics. When a go.mod file contains a 'toolchain goX.Y.Z' directive and
|
|
26
|
+
GOTOOLCHAIN is set to 'auto' (the default for Go 1.21+), Go will automatically download the
|
|
27
|
+
toolchain version specified in go.mod rather than using the version installed by setup-go.
|
|
28
|
+
The workflow runs with a different Go version than the one specified in the go-version: input,
|
|
29
|
+
causing unexpected behavior, build failures, or unintended Go version usage. In v5, setup-go
|
|
30
|
+
implicitly set GOTOOLCHAIN=local, preventing automatic toolchain downloads. v6 removed this
|
|
31
|
+
implicit override, meaning go.mod toolchain directives now take effect in CI.
|
|
32
|
+
fix: |
|
|
33
|
+
Set GOTOOLCHAIN=local in the step environment to force Go to use exactly the version installed
|
|
34
|
+
by setup-go, ignoring the toolchain directive in go.mod. Alternatively, align the go-version:
|
|
35
|
+
input with the toolchain directive in go.mod, or use go-version-file: go.mod to let setup-go
|
|
36
|
+
read the version directly from the module file.
|
|
37
|
+
fix_code:
|
|
38
|
+
- language: yaml
|
|
39
|
+
label: "Set GOTOOLCHAIN=local to prevent auto-download — use exactly the installed version"
|
|
40
|
+
code: |
|
|
41
|
+
- name: Set up Go
|
|
42
|
+
uses: actions/setup-go@v6
|
|
43
|
+
with:
|
|
44
|
+
go-version: '1.22'
|
|
45
|
+
|
|
46
|
+
- name: Build
|
|
47
|
+
run: go build ./...
|
|
48
|
+
env:
|
|
49
|
+
GOTOOLCHAIN: local # disables auto-download; uses only the version from setup-go
|
|
50
|
+
- language: yaml
|
|
51
|
+
label: "Or read go-version directly from go.mod to stay aligned with the toolchain directive"
|
|
52
|
+
code: |
|
|
53
|
+
- name: Set up Go
|
|
54
|
+
uses: actions/setup-go@v6
|
|
55
|
+
with:
|
|
56
|
+
go-version-file: go.mod # reads 'go X.Y' line from go.mod; stays in sync automatically
|
|
57
|
+
prevention:
|
|
58
|
+
- "After upgrading to setup-go@v6, verify the actual Go version used in builds matches the go-version: input"
|
|
59
|
+
- "Add GOTOOLCHAIN=local to workflow env or per-step env to opt out of automatic toolchain download behavior"
|
|
60
|
+
- "Keep the go.mod toolchain directive in sync with the go-version: value specified in setup-go"
|
|
61
|
+
- "Use go-version-file: go.mod instead of an explicit go-version: value to stay automatically aligned"
|
|
62
|
+
docs:
|
|
63
|
+
- url: https://github.com/actions/setup-go/releases/tag/v6.0.0
|
|
64
|
+
label: "actions/setup-go v6.0.0 release notes — toolchain handling breaking change"
|
|
65
|
+
- url: https://github.com/actions/setup-go/pull/460
|
|
66
|
+
label: "actions/setup-go PR#460: Improve toolchain handling"
|
|
67
|
+
- url: https://go.dev/doc/toolchain
|
|
68
|
+
label: "Go documentation: Toolchains — GOTOOLCHAIN environment variable"
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
id: silent-failures-062
|
|
2
|
+
title: "actions/cache save failure emits Warning annotation but does not fail the workflow step"
|
|
3
|
+
category: silent-failures
|
|
4
|
+
severity: silent-failure
|
|
5
|
+
tags:
|
|
6
|
+
- cache
|
|
7
|
+
- cache-save
|
|
8
|
+
- warning
|
|
9
|
+
- non-fatal
|
|
10
|
+
- false-success
|
|
11
|
+
- cache-service
|
|
12
|
+
patterns:
|
|
13
|
+
- regex: 'Warning: Failed to save:.*Failed to CreateCacheEntry.*non-retryable'
|
|
14
|
+
flags: i
|
|
15
|
+
- regex: 'Warning: Failed to restore:.*Failed to GetCacheEntryDownloadURL.*non-retryable'
|
|
16
|
+
flags: i
|
|
17
|
+
error_messages:
|
|
18
|
+
- "Warning: Failed to save: Failed to CreateCacheEntry: Received non-retryable error: Failed request: (404) Not Found: invalid request"
|
|
19
|
+
- "Warning: Failed to restore: Failed to GetCacheEntryDownloadURL: Received non-retryable error: Failed request: (404) Not Found: invalid request"
|
|
20
|
+
root_cause: |
|
|
21
|
+
The actions/cache and actions/cache/save actions treat upload failures as non-fatal warnings
|
|
22
|
+
rather than step errors. When the GitHub cache backend returns an error (4xx/5xx), is
|
|
23
|
+
unavailable, or rejects the request, the action emits a yellow Warning annotation in the
|
|
24
|
+
workflow log but exits with code 0. The workflow step is marked green (success). Downstream
|
|
25
|
+
runs then see genuine "Cache not found" misses since nothing was persisted. Developers assume
|
|
26
|
+
the cache was saved based on the green checkmark, spending hours debugging unreliable cache
|
|
27
|
+
restore before finding the Warning annotation buried in the save step output. This behavior is
|
|
28
|
+
intentional — cache is treated as an optimization, not a requirement — but it means failures
|
|
29
|
+
are invisible unless annotations are actively checked.
|
|
30
|
+
fix: |
|
|
31
|
+
Check step-level annotations (the yellow warning triangle icon) on cache save steps, not just
|
|
32
|
+
the green/red status indicator. Use fail-on-cache-miss: true on restore steps when cache
|
|
33
|
+
availability is critical to your build speed so that a missing cache surfaces as a hard
|
|
34
|
+
failure. For save failures there is no built-in fail flag — add a downstream validation step
|
|
35
|
+
if guaranteed cache persistence is required. Always use supported cache action versions
|
|
36
|
+
(actions/cache@v3 or @v4) to ensure compatibility with the current cache backend service.
|
|
37
|
+
fix_code:
|
|
38
|
+
- language: yaml
|
|
39
|
+
label: "Use fail-on-cache-miss on restore to surface missing cache as an error"
|
|
40
|
+
code: |
|
|
41
|
+
- name: Restore build cache
|
|
42
|
+
id: restore-cache
|
|
43
|
+
uses: actions/cache/restore@v4
|
|
44
|
+
with:
|
|
45
|
+
key: ${{ runner.os }}-build-${{ hashFiles('**/package-lock.json') }}
|
|
46
|
+
path: ~/.npm
|
|
47
|
+
fail-on-cache-miss: true # step fails with error if nothing was previously saved
|
|
48
|
+
|
|
49
|
+
- name: Save build cache
|
|
50
|
+
if: always()
|
|
51
|
+
uses: actions/cache/save@v4
|
|
52
|
+
with:
|
|
53
|
+
key: ${{ runner.os }}-build-${{ hashFiles('**/package-lock.json') }}
|
|
54
|
+
path: ~/.npm
|
|
55
|
+
prevention:
|
|
56
|
+
- "Always check workflow annotations (yellow warning triangle) in addition to the step pass/fail status"
|
|
57
|
+
- "Use actions/cache@v4 or @v3 — deprecated pinned SHAs may fail silently after the cache backend migration"
|
|
58
|
+
- "Use fail-on-cache-miss: true on restore steps to make cache misses visible as hard failures"
|
|
59
|
+
- "Monitor the actions/cache issue tracker when cache restore reliability degrades — backend incidents are reported quickly"
|
|
60
|
+
docs:
|
|
61
|
+
- url: https://github.com/actions/cache/issues/1541
|
|
62
|
+
label: "actions/cache#1541: Bug: Failed to CreateCacheEntry (29 reactions, Feb 2025)"
|
|
63
|
+
- url: https://github.com/actions/cache/discussions/1510
|
|
64
|
+
label: "actions/cache Discussion#1510: Deprecation Notice — upgrade to latest before Feb 2025"
|
|
65
|
+
- url: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/caching-dependencies-to-speed-up-workflows
|
|
66
|
+
label: "GitHub Docs: Caching dependencies — fail-on-cache-miss option"
|
package/package.json
CHANGED