ACTIONS_RUNTIME_TOKEN issues in docker/build-push-action@v5 #459

New Issue

barzog · 2024-01-08T13:08:28Z

barzog commented

2024-01-08 13:08:28 +00:00

It seems that issue mentioned in #396 is still not resolved:

- name: Push local image
        uses: docker/build-push-action@v5
        with:
          context: .
          tags: |
            <some tag>
          cache-from: type=gha
          cache-to: type=gha,mode=max
          load: true

It fails with:

::group::GitHub Actions runtime token ACs
::warning::Cannot parse GitHub Actions Runtime Token: Invalid token specified: missing part #2
::endgroup::
...
[command]/usr/bin/docker buildx build --cache-from type=gha --cache-to type=gha,mode=max --iidfile /tmp/docker-actions-toolkit-LOwump/iidfile --tag <some tag> --load --metadata-file /tmp/docker-actions-toolkit-LOwump/metadata-file .
ERROR: failed to solve: failed to configure gha cache exporter: token contains an invalid number of segments
::error::buildx failed with: ERROR: failed to solve: failed to configure gha cache exporter: token contains an invalid number of segments

When using empty ACTION_RUNTIME_TOKEN in environment vars - cache is not used:

::group::GitHub Actions runtime token ACs
::warning::ACTIONS_RUNTIME_TOKEN not set
::endgroup::
...
[command]/usr/bin/docker buildx build --cache-from type=gha --cache-to type=gha,mode=max --iidfile /tmp/docker-actions-toolkit-2BEOrN/iidfile --tag <some tag> --load --metadata-file /tmp/docker-actions-toolkit-2BEOrN/metadata-file .

As stated here: #119 (comment) - this token is not a JWT, but a simple string.
Is it possible to convert it to JWT?

It seems that issue mentioned in https://gitea.com/gitea/act_runner/pulls/396 is still not resolved: ``` - name: Push local image uses: docker/build-push-action@v5 with: context: . tags: | <some tag> cache-from: type=gha cache-to: type=gha,mode=max load: true ``` It fails with: ``` ::group::GitHub Actions runtime token ACs ::warning::Cannot parse GitHub Actions Runtime Token: Invalid token specified: missing part #2 ::endgroup:: ... [command]/usr/bin/docker buildx build --cache-from type=gha --cache-to type=gha,mode=max --iidfile /tmp/docker-actions-toolkit-LOwump/iidfile --tag <some tag> --load --metadata-file /tmp/docker-actions-toolkit-LOwump/metadata-file . ERROR: failed to solve: failed to configure gha cache exporter: token contains an invalid number of segments ::error::buildx failed with: ERROR: failed to solve: failed to configure gha cache exporter: token contains an invalid number of segments ``` When using empty ACTION_RUNTIME_TOKEN in environment vars - cache is not used: ``` ::group::GitHub Actions runtime token ACs ::warning::ACTIONS_RUNTIME_TOKEN not set ::endgroup:: ... [command]/usr/bin/docker buildx build --cache-from type=gha --cache-to type=gha,mode=max --iidfile /tmp/docker-actions-toolkit-2BEOrN/iidfile --tag <some tag> --load --metadata-file /tmp/docker-actions-toolkit-2BEOrN/metadata-file . ``` As stated here: https://gitea.com/gitea/act_runner/issues/119#issuecomment-738294 - this token is not a JWT, but a simple string. Is it possible to convert it to JWT?

ChristopherHX commented

2024-01-08 16:45:39 +00:00

I also hope Gitea migrates to use JWT tokens here, because actions/upload-artifact@v4 and actions/download-artifact@v4 will require them once the GHES / Gitea is no longer blocked behind a github.com flag.

See here: https://github.com/nektos/act/issues/2135

I believe this would require changes to the artifacts backend on the Gitea Server side

this token is not a JWT, but a simple string.

I think it currently has the same format as a PAT token, with a restricted livetime.

I also hope Gitea migrates to use JWT tokens here, because `actions/upload-artifact@v4` and `actions/download-artifact@v4` will require them once the GHES / Gitea is no longer blocked behind a github.com flag. See here: <https://github.com/nektos/act/issues/2135> _I believe this would require changes to the artifacts backend on the Gitea Server side_ > this token is not a JWT, but a simple string. I think it currently has the same format as a PAT token, with a restricted livetime.

lng2020 commented

2024-01-12 16:47:09 +00:00

It's not resolved completely. But the PR you referenced is doing right.
Before that fix, the build-push-action will exit as an error, thus the action will exit incompletely. After that, it will show a warning and continue to work. It will lose some functionality(like the cache you mentioned). However the workflow file of this repo only needs to upload the image to the docker hub, so the workaround can be removed. That fix is about turning an error into a warning and your issue is about a warning affecting some functionality.

I also hope Gitea migrates to use JWT tokens here

Agreed. Otherwise, some of the actions cannot be reused in Gitea Actions.

It's not resolved completely. But the PR you referenced is doing right. Before that fix, the `build-push-action` will exit as an error, thus the action will exit incompletely. After that, it will show a warning and continue to work. It will lose some functionality(like the `cache` you mentioned). However the workflow file of this repo only needs to upload the image to the docker hub, so the workaround can be removed. That fix is about turning an error into a warning and your issue is about a warning affecting some functionality. > I also hope Gitea migrates to use JWT tokens here Agreed. Otherwise, some of the actions cannot be reused in Gitea Actions.

ChristopherHX referenced a pull request that will close this issue

2024-01-21 20:25:11 +00:00

Use artifacts v4 jwt if available #471

lunny referenced this issue from a commit

2024-02-08 02:43:40 +00:00

Use artifacts v4 jwt if available (#471)

lunny closed this issue

2024-02-08 02:43:40 +00:00

ChristopherHX commented

2024-03-04 15:11:54 +00:00

I'm still working on this issue...

Current work is done here https://github.com/go-gitea/gitea/pull/29584