GitHub Actions' required properties aren't always required
Earlier today on Renovate we noticed that our documentation site had not been deploying for a couple of days.
The root cause was down to a quirk of GitHub Actions, where a required property isn't actually always enforced to be required 😅
To explain this, let's look at the following composite action:
# .github/actions/setup-node/action.yml
name: 'Setup Node and install dependencies'
description: 'Setup Node and install dependencies using cache'
inputs:
node-version:
description: 'Node version'
required: true
os:
description: 'Composite actions do not support `runner.os`, so it must be passed in as an input'
required: true
save-cache:
description: 'Save cache when needed'
required: false
default: 'false'
runs:
using: 'composite'
steps:
- name: Calculate `CACHE_KEY`
shell: bash
run: |
echo 'CACHE_KEY=node_modules-${{
inputs.os
}}-${{
inputs.node-version
}}-${{
hashFiles('pnpm-lock.yaml', 'package.json')
}}' >> "$GITHUB_ENV"
# ...
This is then used as part of our build:
# .github/workflows/build.yml
build-deploy-docs-site:
needs: release
permissions: # ...
environment: # ...
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
show-progress: false
- name: Setup Node.js
uses: ./.github/actions/setup-node
with:
node-version: ${{ needs.setup-build.outputs.node-version }}
os: ${{ runner.os }}
Can you spot what's wrong here?
You may notice this line:
node-version: ${{ needs.setup-build.outputs.node-version }}
We're referencing a job, but that wasn't found in our needs definition.
In this case, GitHub Actions is therefore evaluating this statement as the empty string, resolving as node-version: "".
Because there is technically something passed to the node-version argument, required: true isn't flagging any issues.
In my opinion, required: true should error if it's receiving empty input, but maybe this is instead a slightly painful gotcha, but one I'm now going to going to remember going forwards.
We've since added a check in our composite action to fail the build if either required: true options are unset.
It looks like actionlint would have caught this too - so that's on my TODO list to add to our CI pipelines now, too!
