Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

v1.12.0 and newer releases don't support nested invocations from composite actions #299

Open
vprivat-ads opened this issue Nov 7, 2024 · 8 comments
Open

v1.12.0 and newer releases don't support nested invocations from composite actions #299

vprivat-ads opened this issue Nov 7, 2024 · 8 comments

Comments

@vprivat-ads
Copy link

The new release fails for our repository, because our organization name contains uppercase characters:

https://github.com/RS-PYTHON/rs-server/actions/runs/11725422733/job/32661677233#step:4:169

/usr/bin/docker run --name ghcrioRSPYTHONrsserverv02a6_5ffa5f (...) ghcr.io/RS-PYTHON/rs-server:v0.2a6
docker: invalid reference format: repository name (RS-PYTHON/rs-server) must be lowercase.

I guess in this line, $GITHUB_REPOSITORY shall be converted to lowercase as per this example.
@webknjaz
Copy link
Member

webknjaz commented Nov 7, 2024

No, that's not it. This is because it doesn't reference our existing image. It's probably caused by the use of a nested composite action that messes up the repo references. We'd need to figure out how to extract proper values in such an environment.
I suppose this could count as a regression but the reality is that we never tested this scenario so it was never on the supported list.
Would you volunteer to debug it?

@webknjaz
Copy link
Member

webknjaz commented Nov 7, 2024 •
edited
Loading

If we can't rely on ${{ github.action_repository }}, though, I'm not sure where to extract this value from.
The tag value is also wrong.

@webknjaz
Copy link
Member

webknjaz commented Nov 7, 2024

Essentially, it's a duplicate of #291 that I thought was fixed.
But the more I look into it, the more I realize that it might be a bug within GitHub itself (in how they set the context for the nested action invocations).

@webknjaz
Copy link
Member

webknjaz commented Nov 7, 2024

By the way, you're building wheels in the same job as publishing, which elevates privileges for the entire build the toolchain, including transitive dependencies. This is insecure and heavily discouraged.

@webknjaz webknjaz changed the title New release doesn't work with uppercase repositories v1.12.0 and newer releases don't support nested invocations from composite actions Nov 7, 2024
@webknjaz webknjaz pinned this issue Nov 7, 2024
@webknjaz webknjaz mentioned this issue Nov 7, 2024
Closed
@vprivat-ads
Copy link
Author

@webknjaz thank you for noticing the security issue, I'm going to check it.

@vprivat-ads
Copy link
Author

And yes I'm ok to help you debug it :)

@webknjaz
Copy link
Member

webknjaz commented Nov 8, 2024

@vprivat-ads so we need a way to access the running action's repo org/name + tag. I can come up with a workaround for the slug (a dirty hack but still). Yet, I have no idea how to access the version reiably.

FWIW, I think it's best to document the limitation and leave it be. It would cultivate better usage practices long-term.

This was referenced Nov 8, 2024
Merged
Merged
@vprivat-ads
Copy link
Author

@webknjaz ok, thank you! We have changed our workflows to get rid of the composite action, and fixed the security issue. Thanks a lot for your support 👍

fajpunk added a commit to lsst-sqre/build-and-publish-to-pypi that referenced this issue Nov 8, 2024
@fajpunk
DM-47489: Pin gh-action-pypi-publish to v1.11.0
b29c0e7 
Anything after v1.11.0 breaks invocation from composite actions:
pypa/gh-action-pypi-publish#299
@fajpunk fajpunk mentioned this issue Nov 8, 2024
Merged
@slundqui slundqui mentioned this issue Nov 11, 2024
Merged
br3ndonland added a commit to br3ndonland/gh-action-pypi-publish that referenced this issue Nov 12, 2024
@br3ndonland
Support nested composite actions
67be67f 
To reference metadata about composite actions, GitHub Actions provides
the `github.action_` context, including `github.action_path`,
`github.action_ref`, and `github.action_repository`.

GitHub Actions supports nested composite actions with a recursion limit
of 9 (9 nested composite actions). Unfortunately `github.action_` values
are not propagated correctly when running nested composite actions.
This is a bug in the GitHub Actions runner.

The suggested workaround is to use inputs to set the correct values.
This commit will implement the suggested workaround.

https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#github-context
actions/runner#2473 (comment)
pypa#299
@br3ndonland br3ndonland mentioned this issue Nov 12, 2024
Draft
br3ndonland added a commit to br3ndonland/gh-action-pypi-publish that referenced this issue Nov 12, 2024
@br3ndonland
Support nested composite actions
89eff37 
To reference metadata about composite actions, GitHub Actions provides
the `github.action_` context, including `github.action_path`,
`github.action_ref`, and `github.action_repository`.

GitHub Actions supports nested composite actions with a recursion limit
of 9 (9 nested composite actions). Unfortunately `github.action_` values
are not propagated correctly when running nested composite actions.
This is a bug in the GitHub Actions runner.

The suggested workaround is to use inputs to set the correct values.
This commit will implement the suggested workaround.

https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#github-context
actions/runner#2473 (comment)
pypa#299
br3ndonland added a commit to br3ndonland/gh-action-pypi-publish that referenced this issue Nov 12, 2024
@br3ndonland
Support nested composite actions
e236259 
To reference metadata about composite actions, GitHub Actions provides
the `github.action_` context, including `github.action_path`,
`github.action_ref`, and `github.action_repository`.

GitHub Actions supports nested composite actions with a recursion limit
of 9 (9 nested composite actions). Unfortunately `github.action_` values
are not propagated correctly when running nested composite actions.
This is a bug in the GitHub Actions runner.

The suggested workaround is to use inputs to set the correct values.
This commit will implement the suggested workaround.

https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#github-context
actions/runner#2473 (comment)
pypa#299
br3ndonland added a commit to br3ndonland/gh-action-pypi-publish that referenced this issue Nov 12, 2024
@br3ndonland
Support nested composite actions
bffe630 
To reference metadata about composite actions, GitHub Actions provides
the `github.action_` context, including `github.action_path`,
`github.action_ref`, and `github.action_repository`.

GitHub Actions supports nested composite actions with a recursion limit
of 9 (9 nested composite actions). Unfortunately `github.action_` values
are not propagated correctly when running nested composite actions.
This is a bug in the GitHub Actions runner.

The suggested workaround is to use inputs to set the correct values.
This commit will implement the suggested workaround.

https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#github-context
actions/runner#2473 (comment)
pypa#299
br3ndonland added a commit to br3ndonland/gh-action-pypi-publish that referenced this issue Nov 12, 2024
@br3ndonland
Support nested composite actions
e76ce70 
To reference metadata about composite actions, GitHub Actions provides
the `github.action_` context, including `github.action_path`,
`github.action_ref`, and `github.action_repository`.

GitHub Actions supports nested composite actions with a recursion limit
of 9 (9 nested composite actions). Unfortunately `github.action_` values
are not propagated correctly when running nested composite actions.
This is a bug in the GitHub Actions runner.

The suggested workaround is to use inputs to set the correct values.
This commit will implement the suggested workaround.

https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#github-context
actions/runner#2473 (comment)
pypa#299
br3ndonland added a commit to br3ndonland/gh-action-pypi-publish that referenced this issue Nov 12, 2024
@br3ndonland
Support nested composite actions
8a35517 
To reference metadata about composite actions, GitHub Actions provides
the `github.action_` context, including `github.action_path`,
`github.action_ref`, and `github.action_repository`.

GitHub Actions supports nested composite actions with a recursion limit
of 9 (9 nested composite actions). Unfortunately `github.action_` values
are not propagated correctly when running nested composite actions.
This is a bug in the GitHub Actions runner.

The suggested workaround is to use inputs to set the correct values.
This commit will implement the suggested workaround.

https://docs.github.com/en/actions/creating-actions/creating-a-composite-action
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#github-context
actions/runner#2473 (comment)
pypa#299
@br3ndonland br3ndonland mentioned this issue Nov 12, 2024
Merged
keelerm84 added a commit to launchdarkly/python-server-sdk-ai that referenced this issue Nov 19, 2024
@keelerm84
chore: Fix broken pypi publish action
066c41d 
According to [this GitHub issue][1], the `pypa/gh-action-pypi-publish`
action cannot be used in nested actions. This commit inlines the usage
of this action into the top-level workflows instead.

[1]: pypa/gh-action-pypi-publish#299
@keelerm84 keelerm84 mentioned this issue Nov 19, 2024
Merged
keelerm84 added a commit to launchdarkly/python-server-sdk-ai that referenced this issue Nov 19, 2024
@keelerm84
chore: Fix broken pypi publish action (#18)
264f99e 
According to [this GitHub issue][1], the `pypa/gh-action-pypi-publish`
action cannot be used in nested actions. This commit inlines the usage
of this action into the top-level workflows instead.

[1]: pypa/gh-action-pypi-publish#299
keelerm84 added a commit to launchdarkly/python-eventsource that referenced this issue Nov 21, 2024
@keelerm84
chore: Fix broken pypi publish action
1ad3790 
According to [this GitHub issue][1], the `pypa/gh-action-pypi-publish`
action cannot be used in nested actions. This commit inlines the usage
of this action into the top-level workflows instead.

[1]: pypa/gh-action-pypi-publish#299
@keelerm84 keelerm84 mentioned this issue Nov 21, 2024
Merged
keelerm84 added a commit to launchdarkly/python-server-sdk that referenced this issue Nov 21, 2024
@keelerm84
chore: Fix broken pypi publish action
08816a8 
According to [this GitHub issue][1], the `pypa/gh-action-pypi-publish`
action cannot be used in nested actions. This commit inlines the usage
of this action into the top-level workflows instead.

[1]: pypa/gh-action-pypi-publish#299
@keelerm84 keelerm84 mentioned this issue Nov 21, 2024
Merged
keelerm84 added a commit to launchdarkly/python-server-sdk-otel that referenced this issue Nov 21, 2024
@keelerm84
chore: Fix broken pypi publish action
ba6d278 
According to [this GitHub issue][1], the `pypa/gh-action-pypi-publish`
action cannot be used in nested actions. This commit inlines the usage
of this action into the top-level workflows instead.

[1]: pypa/gh-action-pypi-publish#299
@keelerm84 keelerm84 mentioned this issue Nov 21, 2024
Merged
keelerm84 added a commit to launchdarkly/python-eventsource that referenced this issue Nov 22, 2024
@keelerm84
chore: Fix broken pypi publish action (#34)
dbc4d23 
According to [this GitHub issue][1], the `pypa/gh-action-pypi-publish`
action cannot be used in nested actions. This commit inlines the usage
of this action into the top-level workflows instead.

[1]: pypa/gh-action-pypi-publish#299
keelerm84 added a commit to launchdarkly/python-server-sdk-otel that referenced this issue Nov 22, 2024
@keelerm84
chore: Fix broken pypi publish action (#22)
1c61fbc 
According to [this GitHub issue][1], the `pypa/gh-action-pypi-publish`
action cannot be used in nested actions. This commit inlines the usage
of this action into the top-level workflows instead.

[1]: pypa/gh-action-pypi-publish#299
keelerm84 added a commit to launchdarkly/python-server-sdk that referenced this issue Nov 22, 2024
@keelerm84
chore: Fix broken pypi publish action (#319)
d3a0488 
According to [this GitHub issue][1], the `pypa/gh-action-pypi-publish`
action cannot be used in nested actions. This commit inlines the usage
of this action into the top-level workflows instead.

[1]: pypa/gh-action-pypi-publish#299
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@webknjaz @vprivat-ads