Skip to content

Unable to use actions/cache with Renovate: EACCESS #646

Closed
#700
Closed
Unable to use actions/cache with Renovate: EACCESS#646
#700
Labels
bugSomething isn't workinghelp wantedExtra attention is needed

Description

@jamietanna
jamietanna
opened on Nov 2, 2022

When using GitHub Actions' caching functionality, Renovate ends up hitting an EACCESS when trying to write to the restored cache keys.

A failing job with workflow definition reports the following error on subsequent runs:

 INFO: Renovate is exiting with a non-zero code due to the following logged errors
       "loggerErrors": [
         {
           "name": "renovate",
           "level": 60,
           "logContext": "BxuFXuCsh1JmPxe_hfhG1",
           "err": {
             "errno": -13,
             "code": "EACCES",
             "syscall": "mkdir",
             "path": "/tmp/renovate-baseDir/repos/github/jamietanna/jamietanna",
             "message": "EACCES: permission denied, mkdir '/tmp/renovate-baseDir/repos/github/jamietanna/jamietanna'",
             "stack": "Error: EACCES: permission denied, mkdir '/tmp/renovate-baseDir/repos/github/jamietanna/jamietanna'"
           },
           "msg": "Fatal error: EACCES: permission denied, mkdir '/tmp/renovate-baseDir/repos/github/jamietanna/jamietanna'"
         }
       ]

It appears that:

/usr/bin/docker run --env RENOVATE_TOKEN=x-access-token:*** --env RENOVATE_CONFIG_FILE=/github-action/config.js --volume /home/runner/work/actions-testing/actions-testing/config.js:/github-action/config.js --volume /var/run/docker.sock:/var/run/docker.sock --volume /tmp:/tmp --user 1000:121 --rm renovate/renovate:34.2.0-slim

May be at fault, as running id -u outside of the Renovate runner shows:

uid=1001(runner) gid=121(docker) groups=121(docker),4(adm),101(systemd-journal)

Whereas we're trying to use the uid 1000, which doesn't match, and is therefore denied from reading the files:

# this is from a different run, so not visible on the above link
/tmp/renovate-baseDir:
total 12
drwxr-xr-x  3 runner docker 4096 Nov  2 16:40 .

Activity

  1. jamietanna commented on Nov 2, 2022

    @jamietanna
    jamietanna
    on Nov 2, 2022
    MemberAuthor

    It looks like

    github-action/src/renovate.ts

    Line 20 in d7c9fe4

    const renovateDockerUser = '1000';
    is the line we'd want to change

  2. jamietanna
    added a commit that references this issue on Nov 2, 2022

    Align UID with GitHub Actions user

    d29f0c9
  3. viceice
    added
    bugSomething isn't working
    help wantedExtra attention is needed
    on Jan 4, 2023

  4. Akaame commented on Jan 31, 2023

    @Akaame
    Akaame
    on Jan 31, 2023

    @jamietanna were you able to work past this?

  5. GSala commented on Feb 1, 2023

    @GSala
    GSala
    on Feb 1, 2023

    @Akaame we are working around that like this:

    - run: sudo chown -R 1000 /tmp/renovate
- // Run renovate
- run: sudo chown -R $(whoami) /tmp/renovate

  6. jamietanna commented on Feb 1, 2023

    @jamietanna
    jamietanna
    on Feb 1, 2023
    MemberAuthor

    Due to the size of our organisation, the recommendation from the Renovate team was to use Mend Renovate On-Prem (which is free!) and much less costly for our usages, and has its own means to do caching

  7. Akaame commented on Feb 11, 2023

    @Akaame
    Akaame
    on Feb 11, 2023

    @GSala thanks this is what we also ended up doing.

  8. viceice commented on Mar 10, 2023

    @viceice
    viceice
    on Mar 10, 2023
    Member

    v35 will use current host user id and use binarySource=install

  9. viceice
    closed this as completedon Mar 10, 2023
  10. viceice
    reopened this on May 12, 2023

  11. viceice commented on May 12, 2023

    @viceice
    viceice
    on May 12, 2023
    Member

    Need to revert the default user change because of

  12. mering commented on Nov 8, 2024

    @mering
    mering
    on Nov 8, 2024

    One can now specify the docker user. When setting this to the runner user, it seems to work fine.

    As I couldn't find a predefined variable/context for the current runner user/group, I added a step to determine this via id command.

    We are using something similar to:

          - uses: actions/checkout@v4.2.2
      - uses: actions/cache@v4.1.2
        if: github.event.inputs.repoCache != 'disabled'
        with:
          path: /tmp/renovate/cache
          key: renovate
      - name: Determine current user
        id: id
        run: |
          echo "user=$(id -u)" >> $GITHUB_OUTPUT
          echo "group=$(id -g)" >> $GITHUB_OUTPUT
      - name: Generate app token
        id: renovate-token
        uses: getsentry/action-github-app-token@v3.0.0
        with:
          app_id: ${{ secrets.RENOVATE_APP_ID }}
          private_key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
      - uses: renovatebot/github-action@v40.3.4
        with:
          configurationFile: renovate.json5
          token: "${{ steps.renovate-token.outputs.token }}"
          docker-user: "${{ steps.id.outputs.user }}:${{ steps.id.outputs.group }}"
          docker-volumes: /tmp/renovate:/tmp/renovate
        env:
          RENOVATE_REPOSITORY_CACHE: ${{ github.event.inputs.repoCache || 'enabled' }}
  13. korosuke613
    added a commit that references this issue on Nov 18, 2024

    ci: fix EACCES on renovatebot/github-action

    4c80d3a

  14. viceice commented on Dec 5, 2024

    @viceice
    viceice
    on Dec 5, 2024
    Member

    One can now specify the docker user. When setting this to the runner user, it seems to work fine.

    As I couldn't find a predefined variable/context for the current runner user/group, I added a step to determine this via id command.

    We are using something similar to:

          - uses: actions/checkout@v4.2.2
      - uses: actions/cache@v4.1.2
        if: github.event.inputs.repoCache != 'disabled'
        with:
          path: /tmp/renovate/cache
          key: renovate
      - name: Determine current user
        id: id
        run: |
          echo "user=$(id -u)" >> $GITHUB_OUTPUT
          echo "group=$(id -g)" >> $GITHUB_OUTPUT
      - name: Generate app token
        id: renovate-token
        uses: getsentry/action-github-app-token@v3.0.0
        with:
          app_id: ${{ secrets.RENOVATE_APP_ID }}
          private_key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
      - uses: renovatebot/github-action@v40.3.4
        with:
          configurationFile: renovate.json5
          token: "${{ steps.renovate-token.outputs.token }}"
          docker-user: "${{ steps.id.outputs.user }}:${{ steps.id.outputs.group }}"
          docker-volumes: /tmp/renovate:/tmp/renovate
        env:
          RENOVATE_REPOSITORY_CACHE: ${{ github.event.inputs.repoCache || 'enabled' }}

    this doesn't work if you need nix manager

  15. JossWhittle commented on Feb 3, 2025

    @JossWhittle
    JossWhittle
    on Feb 3, 2025

    Hello in 2025, is there a working solution to this?

    I've tried everything found across all the linked threads with the latest action and container version and nothing is working.

  16. renovatebot
    locked and limited conversation to collaborators on May 9, 2025
  17. viceice
    converted this issue into a discussion #937 on May 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinghelp wantedExtra attention is needed

    Type

    No type

    Fields

    Priority

    None yet

    Datasource

    None yet

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions