ci: fix EACCES on renovatebot/github-action #978
Conversation
ref: renovatebot/github-action#646 (comment) ```log DEBUG: Using platform gitAuthor: kiba-renovate[bot] <154907007+kiba-renovate[bot]@users.noreply.github.com> DEBUG: Adding token authentication for api.github.com (hostType=github) to hostRules DEBUG: Using baseDir: /tmp/renovate DEBUG: Using cacheDir: /tmp/renovate/cache DEBUG: Using containerbaseDir: /tmp/renovate/cache/containerbase FATAL: Fatal error: EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase' "err": { "errno": -13, "code": "EACCES", "syscall": "mkdir", "path": "/tmp/renovate/cache/containerbase", "message": "EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'", "stack": "Error: EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'" } INFO: Renovate is exiting with a non-zero code due to the following logged errors "loggerErrors": [ { "name": "renovate", "level": 60, "logContext": "f9smkP2QF64Uoz2kYhyHI", "err": { "errno": -13, "code": "EACCES", "syscall": "mkdir", "path": "/tmp/renovate/cache/containerbase", "message": "EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'", "stack": "Error: EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'" }, "msg": "Fatal error: EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'" } ] Error: The process '/usr/bin/docker' failed with exit code 1 at ExecState._setResult (/home/runner/work/_actions/renovatebot/github-action/180db1547505e30c02d41959fe65ada1523ee207/dist/index.js:1702:25) at ExecState.CheckComplete (/home/runner/work/_actions/renovatebot/github-action/180db1547505e30c02d41959fe65ada1523ee207/dist/index.js:1685:18) at ChildProcess.<anonymous> (/home/runner/work/_actions/renovatebot/github-action/180db1547505e30c02d41959fe65ada1523ee207/dist/index.js:1579:27) at ChildProcess.emit (node:events:519:28) at maybeClose (node:internal/child_process:1105:16) at ChildProcess._handle.onexit (node:internal/child_process:305:5) ```
WalkthroughThe pull request modifies the GitHub Actions workflow in Changes
Possibly related PRs
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #978 +/- ##
=======================================
Coverage 66.92% 66.92%
=======================================
Files 21 21
Lines 1179 1179
Branches 109 109
=======================================
Hits 789 789
Misses 385 385
Partials 5 5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
✅ No changes to the artifactsbuilding commit:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (1)
.github/workflows/renovate.yaml (1)
Line range hint
39-46: Consider translating comments to EnglishThe caching strategy is well-implemented, but consider translating the Japanese comments to English for better maintainability across international contributors.
- - name: Renovate CLI のキャッシュディレクトリを定義 + - name: Define Renovate CLI cache directory id: renovate-cache run: | echo "date=$(date --iso-8601)" >> $GITHUB_OUTPUT - - name: Renovate CLI の結果をキャッシュ + - name: Cache Renovate CLI results uses: actions/cache@v4 with: path: ${{ env.BASE_DIR }} - # Cache の肥大化を防ぐため、その日初めての実行のみキャッシュする＆前日以前のキャッシュは利用しない + # Only cache the first execution of the day & ignore previous days' caches to prevent cache bloat🧰 Tools
🪛 actionlint
68-68: shellcheck reported issue in this script: SC2086:info:1:25: Double quote to prevent globbing and word splitting
(shellcheck)
68-68: shellcheck reported issue in this script: SC2086:info:2:26: Double quote to prevent globbing and word splitting
(shellcheck)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
.github/workflows/renovate.yaml(1 hunks)
🧰 Additional context used
🪛 actionlint
.github/workflows/renovate.yaml
68-68: shellcheck reported issue in this script: SC2086:info:1:25: Double quote to prevent globbing and word splitting
(shellcheck)
68-68: shellcheck reported issue in this script: SC2086:info:2:26: Double quote to prevent globbing and word splitting
(shellcheck)
🔇 Additional comments (3)
.github/workflows/renovate.yaml (3)
Line range hint 8-14: LGTM! Well-structured cache control input
The new repoCache input parameter provides good flexibility for cache management with clear options.
🧰 Tools
🪛 actionlint
68-68: shellcheck reported issue in this script: SC2086:info:1:25: Double quote to prevent globbing and word splitting
(shellcheck)
68-68: shellcheck reported issue in this script: SC2086:info:2:26: Double quote to prevent globbing and word splitting
(shellcheck)
Line range hint 48-53: LGTM! Effective permission fix
The directory creation and permission setting effectively address the EACCES issue by ensuring proper ownership.
🧰 Tools
🪛 actionlint
68-68: shellcheck reported issue in this script: SC2086:info:1:25: Double quote to prevent globbing and word splitting
(shellcheck)
68-68: shellcheck reported issue in this script: SC2086:info:2:26: Double quote to prevent globbing and word splitting
(shellcheck)
73-77: LGTM! Complete solution for permission issues
The configuration effectively addresses the permission issues by:
- Using the correct user/group IDs via
docker-user - Properly mounting the cache directory via
docker-volumes
| - name: Determine current user | ||
| id: id | ||
| run: | | ||
| echo "user=$(id -u)" >> $GITHUB_OUTPUT | ||
| echo "group=$(id -g)" >> $GITHUB_OUTPUT | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add quotes to prevent word splitting in shell script
The shell script should use quotes around command substitutions to prevent potential word splitting issues.
id: id
run: |
- echo "user=$(id -u)" >> $GITHUB_OUTPUT
- echo "group=$(id -g)" >> $GITHUB_OUTPUT
+ echo "user=$(id -u)" >> "$GITHUB_OUTPUT"
+ echo "group=$(id -g)" >> "$GITHUB_OUTPUT"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Determine current user | |
| id: id | |
| run: | | |
| echo "user=$(id -u)" >> $GITHUB_OUTPUT | |
| echo "group=$(id -g)" >> $GITHUB_OUTPUT | |
| - name: Determine current user | |
| id: id | |
| run: | | |
| echo "user=$(id -u)" >> "$GITHUB_OUTPUT" | |
| echo "group=$(id -g)" >> "$GITHUB_OUTPUT" | |
🧰 Tools
🪛 actionlint
68-68: shellcheck reported issue in this script: SC2086:info:1:25: Double quote to prevent globbing and word splitting
(shellcheck)
68-68: shellcheck reported issue in this script: SC2086:info:2:26: Double quote to prevent globbing and word splitting
(shellcheck)
| docker-user: "${{ steps.id.outputs.user }}:${{ steps.id.outputs.group }}" | ||
| docker-volumes: /tmp/renovate:/tmp/renovate |
There was a problem hiding this comment.
💡 Codebase verification
Permission issues still persist in the cache directory
The current solution is not fully resolving the EACCES permission issues. The logs show that while we're setting permissions for /tmp/renovate, the containerbase cache directory (/tmp/renovate/cache/containerbase) is still experiencing permission denied errors. The workflow needs to ensure permissions are set for all subdirectories that Renovate might create.
Key points to fix:
- Update the
Change permissionsstep to recursively create and set permissions for all required cache subdirectories:- name: Change permissions run: | mkdir -p $BASE_DIR/cache/containerbase mkdir -p $CACHE_DIR sudo chown -R runneradmin:root /tmp/renovate/ ls -R $BASE_DIR
🔗 Analysis chain
Verify the permission fix in action
The solution looks correct, but let's verify it resolves the EACCES issue completely.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify the workflow runs successfully without permission errors
# Check recent workflow runs for this file
gh run list --workflow=renovate.yaml --limit 5 --json conclusion,databaseId,createdAt \
| jq '.[] | select(.conclusion=="success" or .conclusion=="failure") | {conclusion, databaseId, createdAt}'
# Check logs for EACCES errors in recent runs
for run in $(gh run list --workflow=renovate.yaml --limit 5 --json databaseId --jq '.[].databaseId'); do
echo "Checking run $run for EACCES errors..."
gh run view $run --log | grep -i "EACCES"
done
Length of output: 9565
Script:
#!/bin/bash
# Let's check the workflow file to understand the full context of permissions setup
cat .github/workflows/renovate.yaml
# Also check if there are any other related configuration files
fd -t f -e json renovate
fd -t f -e json5 renovate
Length of output: 2389
|
actions/cache 使うなって書いてたわ。 |
ref: renovatebot/github-action#646 (comment)
Summary by CodeRabbit
New Features
repoCacheinput option for enhanced cache management during workflow execution.renovatebot/github-actionto improve Docker integration and volume mapping.Improvements