Email or username:

Password:

Forgot your password?
e(Ag)le's posts Post Back to profile
e(Ag)le ๐Ÿฆ…

PSA: If your GitHub Actions just started breaking today, check that you aren't affected by this breaking change in the "upload-artifact" action. It took a lot of digging for me to realize that was the culprit; they decided to ship a change that excluded "hidden" files/dirs (anything starting with a dot, including our .vite asset manifest) as a security measure to avoid leaked credentials. People are pretty pissed about this, because it 100% should've been a 5.x semver release with a change that huge, and it broke a few hundred repos at least.

Anyway, the fix is to include, in your YML for that action, include-hidden-files: true

4 September at 21:45 | Open on tech.lgbt
12 comments
Sinjo โœŒ๐Ÿป๐Ÿ’–

@SilverEagle They even wrote the words "Notice: Breaking Changes" and didn't bump the major version! :nkoFacepalm:

4 September at 21:48 | Open on tech.lgbt
Pelle Wessman

@Sinjo @SilverEagle Security issues can sometimes necessitate some breaking changes in non-major releases

6 September at 1:10 | Open on mastodon.social
Pelle Wessman

@Sinjo @SilverEagle One issue is that when eg actions/checkout persists credentials by default it has been discovered to be included in quite a few artifacts: bleepingcomputer.com/news/secu

6 September at 1:18 | Open on mastodon.social
Latte macchiato :blobcoffee: :ablobcat_longlong:

@SilverEagle@tech.lgbt LMAOOOOOOOOOOOOOOOOOOOOOOOOOO

its like nobody even knows what semver is

4 September at 21:54 | Open on plasmatrap.com
Nax

@SilverEagle@tech.lgbt isn't there literally a way to exclude files? a la dockerignore but for gha

4 September at 22:03 | Open on lethallava.land
Ryan Finnie

@SilverEagle Even more hilarious is I don't think I've ever encountered a core GitHub action (excluding this one) where a major semver update didn't Just Work if I bumped it.

"Oh, I'm using setup-flooble@v6 and v9 is the latest? Let's try bumping it. Okay, it seems to work."

5 September at 2:44 | Open on fosstodon.org
James Henstridge

@SilverEagle It seems most of the Github-mananged actions reserve major version bumps for changing the Node runtime version: a change that has no observable effect to users of the action.

5 September at 4:57 | Open on aus.social
Ellipsis...

@SilverEagle Adding a deprecation warning message to v3 and v4, along with a v5 release with the change is how I would have approached this. This change bit us yesterday and I was lucky to discover the cause quickly. Could have been hours of debugging. Semver exists for a reason.

5 September at 15:57 | Open on cosocial.ca
Joachim Jablon

@SilverEagle I maintain a github action that provides things about coverage for Python project. They broke every single user's workflow.

The idea was that if you target a folder, the hidden files inside shouldn't be uploaded. Fair (but worth a proper deprecation). What they implemented is that if you REQUEST to upload a dotfile, it just silently does nothing. That's just {expletive}.

5 September at 22:51 | Open on fosstodon.org
Philip GilliรŸen

@SilverEagle last time they broke it for good and it was the v4 upgrade. That was painful, but a non major semver upgrade? Evil especially as they always recommend to only use the major version tag

6 September at 0:03 | Open on ruhr.social
Brian Muenzenmeyer

@SilverEagle I'll never understand why people are so worried about incrementing semver. It's a number. It communicates caution. Big miss on this.

6 September at 2:19 | Open on front-end.social
Juliet Pulliam, PhD
Go Up