From eb7c3347b9e6066050537262b98290f2baa7c3f5 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Sat, 1 Aug 2026 18:25:28 +0500 Subject: [PATCH 1/2] fix: install pinned tools into a runner-writable path actionlint.yml and osv-scan.yml installed their checksum-verified binaries into /usr/local/bin. That works on GitHub-hosted runners, where the job user can write there, and fails on a self-hosted runner whose account is unprivileged: install: cannot create regular file '/usr/local/bin/actionlint': Permission denied Observed on a real private-repo job after routing it to a self-hosted runner. The privilege is not incidental - a self-hosted runner that CAN write to system paths is a worse runner, because every job then shares a mutable system state. So the fix belongs here, not in the runner's permissions. Both now install into "${RUNNER_TEMP}/bin" and prepend it to GITHUB_PATH, which is writable on hosted and self-hosted alike and is torn down with the job. Checksum verification is unchanged; only the destination moves. validate_all.py: 18/18 OK. --- .github/workflows/actionlint.yml | 9 +++++++-- .github/workflows/osv-scan.yml | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index 1bc6cb5..6d1cf54 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -80,8 +80,13 @@ jobs: "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" echo "${ACTIONLINT_SHA256} /tmp/actionlint.tar.gz" | sha256sum -c - tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint - install -m 0755 /tmp/actionlint /usr/local/bin/actionlint - actionlint --version + # Install into a runner-writable directory rather than /usr/local/bin: + # GitHub-hosted runners let the job user write there, self-hosted ones + # normally do not, and a correctly isolated self-hosted runner must not. + mkdir -p "${RUNNER_TEMP}/bin" + install -m 0755 /tmp/actionlint "${RUNNER_TEMP}/bin/actionlint" + echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH" + "${RUNNER_TEMP}/bin/actionlint" --version - name: Run actionlint run: actionlint -color diff --git a/.github/workflows/osv-scan.yml b/.github/workflows/osv-scan.yml index 01e15d0..ed82264 100644 --- a/.github/workflows/osv-scan.yml +++ b/.github/workflows/osv-scan.yml @@ -59,8 +59,13 @@ jobs: curl -fsSL -o /tmp/osv-scanner \ "https://github.com/google/osv-scanner/releases/download/v${OSV_VERSION}/osv-scanner_linux_amd64" echo "${OSV_SHA256} /tmp/osv-scanner" | sha256sum -c - - install -m 0755 /tmp/osv-scanner /usr/local/bin/osv-scanner - osv-scanner --version + # Install into a runner-writable directory rather than /usr/local/bin: + # GitHub-hosted runners let the job user write there, self-hosted ones + # normally do not, and a correctly isolated self-hosted runner must not. + mkdir -p "${RUNNER_TEMP}/bin" + install -m 0755 /tmp/osv-scanner "${RUNNER_TEMP}/bin/osv-scanner" + echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH" + "${RUNNER_TEMP}/bin/osv-scanner" --version - name: OSV scan env: From cacca98e41f547a55154753705eb5fe87d8c844e Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Sat, 1 Aug 2026 18:27:26 +0500 Subject: [PATCH 2/2] chore(catalog): re-prove actionlint runtime coverage after the install fix The proven_digest deliberately invalidates on any edit to the workflow, so the runtime-proven status had to be re-earned rather than carried over. Re-proved by the actionlint job on this pull request, which exercises the new RUNNER_TEMP/bin install path on a GitHub-hosted runner. osv-scan.yml needs no update: it is recorded as unverified and carries no proven_digest. --- catalog/runtime-coverage.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/catalog/runtime-coverage.yml b/catalog/runtime-coverage.yml index cca00cd..c0d1989 100644 --- a/catalog/runtime-coverage.yml +++ b/catalog/runtime-coverage.yml @@ -15,8 +15,8 @@ entries: - workflow: .github/workflows/actionlint.yml status: runtime-proven evidence: "Called by this repo's ci.yml on every run; Linux X64 default-input lane executed live." - last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/30243258297 - proven_digest: 116c4af8c18861a7c94000e277c3a4e9f1d158bcfbda02a7e6510dfc9d9cf8ff + last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/30701697106 + proven_digest: f946862cfe522cb62920aa104716b331b9f35210a9181ce5954879ccb48ce1df waiver: null - workflow: .github/workflows/benchmark-compare.yml status: static-only