Skip to content

Commit c4a415d

Browse files
htekdevCopilot
htekdev
and
Copilot
authored
feat: add 3 new error entries (caching-artifacts x1, runner-environment x2) (#413)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent d4a3ade commit c4a415d

3 files changed

Lines changed: 284 additions & 0 deletions

File tree

‎errors/caching-artifacts/alpine-busybox-tar-p-flag-unsupported.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
id: caching-artifacts-150
2+
title: 'actions/cache Fails in Alpine Containers — BusyBox tar Does Not Support -P Flag'
3+
category: caching-artifacts
4+
severity: error
5+
tags:
6+
- alpine
7+
- busybox
8+
- tar
9+
- container
10+
- cache
11+
- linux
12+
patterns:
13+
- regex: 'tar: unrecognized option: P'
14+
flags: 'i'
15+
- regex: 'BusyBox.*?tar.*?unrecognized.*?option'
16+
flags: 'i'
17+
- regex: 'Tar failed with error: The process .*/bin/tar. failed with exit code 1'
18+
flags: 'i'
19+
error_messages:
20+
- "/bin/tar: unrecognized option: P"
21+
- "BusyBox v1.31.1 () multi-call binary."
22+
- "[warning]Tar failed with error: The process '/bin/tar' failed with exit code 1"
23+
root_cause: |
24+
The `actions/cache` action uses GNU tar with the `-P` flag (preserve absolute path names)
25+
when creating and extracting cache archives. Alpine Linux containers ship with BusyBox,
26+
which provides a minimal tar implementation that does not recognise the `-P` flag.
27+
28+
When the cache step runs inside an Alpine container, `/bin/tar` is BusyBox tar and the
29+
command fails immediately with "unrecognized option: P". The restore step returns exit
30+
code 1 and the workflow stops or the cache is silently skipped depending on fail-on-cache-miss.
31+
32+
This is a long-standing issue first reported in actions/cache#352 and re-surfaced in
33+
actions/cache#1765 (June 2026). No workaround has been added to the action itself.
34+
fix: |
35+
Install GNU tar in the Alpine container before the cache step using apk:
36+
37+
steps:
38+
- name: Install GNU tar (required for actions/cache)
39+
run: apk add --no-cache tar
40+
- name: Cache dependencies
41+
uses: actions/cache@v4
42+
with:
43+
path: ~/.cargo/registry
44+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
45+
46+
Alternatively, switch the job to a Debian/Ubuntu-based container image where
47+
GNU tar is already the default (/usr/bin/tar).
48+
fix_code:
49+
- language: yaml
50+
label: Install GNU tar in Alpine before using actions/cache
51+
code: |
52+
- name: Install GNU tar
53+
run: apk add --no-cache tar
54+
55+
- name: Cache dependencies
56+
uses: actions/cache@v4
57+
with:
58+
path: ~/.cargo/registry
59+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
60+
- language: yaml
61+
label: Switch to Debian/Ubuntu container to avoid BusyBox tar
62+
code: |
63+
jobs:
64+
build:
65+
runs-on: ubuntu-latest
66+
container:
67+
image: debian:bookworm-slim # GNU tar available by default
68+
steps:
69+
- uses: actions/cache@v4
70+
with:
71+
path: ~/.cargo/registry
72+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
73+
prevention:
74+
- "Run tar --version inside your Alpine container; if it shows BusyBox, add apk add --no-cache tar as the first step."
75+
- "Set container: debian:bookworm-slim or ubuntu:latest instead of alpine when the job uses actions/cache."
76+
- "Add apk add --no-cache tar as the very first step in any job that uses actions/cache inside an Alpine container."
77+
- "Check the actions/cache documentation for container compatibility notes before choosing a base image."
78+
docs:
79+
- url: "https://github.com/actions/cache/issues/1765"
80+
label: "actions/cache issue #1765 — Post cache not working on alpine runners (2026)"
81+
- url: "https://github.com/actions/cache/issues/352"
82+
label: "actions/cache issue #352 — Original Alpine BusyBox tar report"
83+
- url: "https://docs.github.com/en/actions/using-containerized-services/about-service-containers"
84+
label: "GitHub Docs — About service containers"

‎errors/runner-environment/checkout-git-config-global-auth-placeholder-fail.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
id: runner-environment-497
2+
title: 'actions/checkout Auth Setup Fails When GIT_CONFIG_GLOBAL Is Set in Runner Environment'
3+
category: runner-environment
4+
severity: error
5+
tags:
6+
- checkout
7+
- git-config
8+
- GIT_CONFIG_GLOBAL
9+
- self-hosted
10+
- auth
11+
- submodules
12+
- git-credentials
13+
patterns:
14+
- regex: 'Unable to replace auth placeholder in.*?\.gitconfig'
15+
flags: 'i'
16+
- regex: 'Error.*?Unable to replace.*?placeholder.*?gitconfig'
17+
flags: 'i'
18+
- regex: 'Failed to configure the global config'
19+
flags: 'i'
20+
error_messages:
21+
- "##[error]Unable to replace auth placeholder in /home/runner/work/_temp/<uuid>/.gitconfig"
22+
- "Error: Unable to replace auth placeholder"
23+
root_cause: |
24+
When actions/checkout sets up global git authentication (triggered by submodules: true,
25+
persist-credentials: true, or private-repo checkout), it creates a temporary gitconfig
26+
by following these steps:
27+
28+
1. Copies ~/.gitconfig into a temp directory (e.g. /home/runner/work/_temp/<uuid>/).
29+
2. Overrides the HOME environment variable to point at that temp directory.
30+
3. Writes an auth token placeholder via `git config --global url.<base>.insteadOf`
31+
— expecting it to land in the temp config because HOME now points there.
32+
4. Reads the temp config back and replaces the placeholder with the real token.
33+
34+
The problem: git honours GIT_CONFIG_GLOBAL OVER HOME when locating the global
35+
config file. If GIT_CONFIG_GLOBAL is already set in the runner environment (a common
36+
practice on self-hosted runners to isolate per-job git config), step 3 writes to
37+
THAT file instead of the temp config. Step 4 reads the temp config, finds no
38+
placeholder, and fails with "Unable to replace auth placeholder".
39+
40+
This is an open bug in actions/checkout (issue #2449). The checkout action only
41+
overrides HOME, but never pins GIT_CONFIG_GLOBAL.
42+
fix: |
43+
Unset GIT_CONFIG_GLOBAL for the checkout step using the step-level env block:
44+
45+
- name: Checkout
46+
uses: actions/checkout@v4
47+
env:
48+
GIT_CONFIG_GLOBAL: "" # unset so checkout controls global config
49+
with:
50+
submodules: true
51+
52+
If using actions/checkout@v6, also try persist-credentials: false combined with
53+
manually configured HTTPS credentials. Track actions/checkout#2449 for an
54+
official fix that pins GIT_CONFIG_GLOBAL alongside HOME.
55+
fix_code:
56+
- language: yaml
57+
label: Unset GIT_CONFIG_GLOBAL for the checkout step
58+
code: |
59+
- name: Checkout
60+
uses: actions/checkout@v4
61+
env:
62+
GIT_CONFIG_GLOBAL: "" # prevent git from redirecting config writes
63+
with:
64+
submodules: true
65+
token: ${{ secrets.GITHUB_TOKEN }}
66+
- language: yaml
67+
label: Unset at job level to protect all checkout steps
68+
code: |
69+
jobs:
70+
build:
71+
runs-on: self-hosted
72+
env:
73+
GIT_CONFIG_GLOBAL: "" # reset for all steps in this job
74+
steps:
75+
- uses: actions/checkout@v4
76+
with:
77+
submodules: true
78+
prevention:
79+
- "Avoid setting GIT_CONFIG_GLOBAL at workflow or job level when using actions/checkout."
80+
- "On self-hosted runners, use GIT_CONFIG_NOSYSTEM=1 instead of GIT_CONFIG_GLOBAL for job isolation where possible."
81+
- "If GIT_CONFIG_GLOBAL must be set on the runner host, override it to an empty string in the checkout step env block."
82+
- "Track actions/checkout#2449 and upgrade to the patched version once released."
83+
docs:
84+
- url: "https://github.com/actions/checkout/issues/2449"
85+
label: "actions/checkout issue #2449 — Fix global auth when GIT_CONFIG_GLOBAL is set"
86+
- url: "https://git-scm.com/docs/git-config#Documentation/git-config.txt-GITCONFIGGLOBAL"
87+
label: "Git documentation — GIT_CONFIG_GLOBAL environment variable"
88+
- url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions"
89+
label: "GitHub Docs — Security hardening for GitHub Actions"

‎errors/runner-environment/checkout-v6-credentials-docker-container-action-not-available.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
id: runner-environment-498
2+
title: 'actions/checkout@v6 Persisted Credentials Not Available Inside Subsequent Docker Container Actions'
3+
category: runner-environment
4+
severity: error
5+
tags:
6+
- checkout
7+
- checkout-v6
8+
- docker
9+
- container-action
10+
- credentials
11+
- git-auth
12+
- persist-credentials
13+
- v6-regression
14+
patterns:
15+
- regex: 'fatal: could not read Username for .https://github\.com.: terminal prompts disabled'
16+
flags: 'i'
17+
- regex: 'fatal: repository .https://github\.com/.*?. not found'
18+
flags: 'i'
19+
- regex: 'remote: Repository not found\.'
20+
flags: 'i'
21+
- regex: 'Authentication failed for .https://github\.com'
22+
flags: 'i'
23+
error_messages:
24+
- "fatal: could not read Username for 'https://github.com': terminal prompts disabled"
25+
- "remote: Repository not found."
26+
- "fatal: repository 'https://github.com/<org>/<repo>/' not found"
27+
- "Error: Authentication failed for 'https://github.com/'"
28+
root_cause: |
29+
actions/checkout@v6 introduced a new credential persistence mechanism that requires
30+
runner v2.329.0+. In this design the checkout action stores git credentials via the
31+
runner's credential-store rather than writing to the container's filesystem, enabling
32+
persistent access across steps.
33+
34+
However, subsequent DOCKER CONTAINER ACTIONS run inside an isolated container
35+
filesystem that does not mount or inherit the host runner's credential store. Git
36+
operations inside a Docker container action that attempt to authenticate against
37+
GitHub will fail because:
38+
39+
1. The credential helper configured by checkout@v6 points to a host-side file or
40+
socket that is not mounted inside the container.
41+
2. The container's git has no fallback credentials and interactive prompts are
42+
disabled in CI (GIT_TERMINAL_PROMPT=0).
43+
3. Even with persist-credentials: true (the default), the container cannot read
44+
the stored credentials.
45+
46+
The v6-beta release notes stated that Docker container action support would be
47+
available from runner v2.329.0+, but this was not fully implemented as of June 2026.
48+
This is an open upstream bug (actions/checkout#2359).
49+
fix: |
50+
Downgrade to actions/checkout@v4 in any workflow that includes Docker container
51+
actions that require git access. checkout@v4 stores credentials in ~/.git-credentials
52+
on the host filesystem, which IS accessible to Docker container actions via the
53+
default workspace mount.
54+
55+
- name: Checkout
56+
uses: actions/checkout@v4 # v4 credentials are accessible to Docker container actions
57+
with:
58+
fetch-depth: 0
59+
token: ${{ secrets.GITHUB_TOKEN }}
60+
persist-credentials: true
61+
62+
If v6 is required, pass the token to the Docker container action explicitly as an
63+
environment variable and configure git inside the container manually.
64+
fix_code:
65+
- language: yaml
66+
label: Downgrade to checkout@v4 when workflow uses Docker container actions
67+
code: |
68+
steps:
69+
# v4 stores credentials in ~/.git-credentials accessible to Docker containers
70+
- name: Checkout
71+
uses: actions/checkout@v4
72+
with:
73+
fetch-depth: 0
74+
token: ${{ secrets.GITHUB_TOKEN }}
75+
persist-credentials: true
76+
77+
# Docker container action can now access git credentials
78+
- name: Run Docker container action
79+
uses: org/docker-container-action@v1
80+
with:
81+
token: ${{ secrets.GITHUB_TOKEN }}
82+
- language: yaml
83+
label: Pass token explicitly to Docker container action (v6 workaround)
84+
code: |
85+
steps:
86+
- name: Checkout
87+
uses: actions/checkout@v6
88+
with:
89+
persist-credentials: false # disable v6 mechanism
90+
91+
# Manually configure credentials accessible inside the container
92+
- name: Configure git credentials
93+
run: |
94+
git config --global credential.helper store
95+
echo "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com" \
96+
>> ~/.git-credentials
97+
98+
- name: Run Docker container action
99+
uses: org/docker-container-action@v1
100+
prevention:
101+
- "Check the release notes before upgrading checkout versions in workflows that include Docker container actions."
102+
- "Pin checkout to @v4 in workflows that use Docker container actions until actions/checkout#2359 is resolved."
103+
- "After upgrading checkout versions, verify end-to-end in a test branch before rolling out to all workflows."
104+
- "Track actions/checkout#2359 for the upstream fix and re-evaluate once it ships."
105+
docs:
106+
- url: "https://github.com/actions/checkout/issues/2359"
107+
label: "actions/checkout issue #2359 — v6 credentials don't work with Docker container actions"
108+
- url: "https://github.com/actions/checkout/releases/tag/v6.0.0"
109+
label: "actions/checkout v6 release notes"
110+
- url: "https://docs.github.com/en/actions/sharing-automations/creating-actions/creating-a-docker-container-action"
111+
label: "GitHub Docs — Creating a Docker container action"

0 commit comments

Comments
 (0)