Github Actions Gotchas

Summary

List of hard to debug issues and unexpected behavior when using Github Actions

When you click rerun failed jobs vs rerun all jobs, if you've changed the workflow files being called from another repo, rerun failed jobs will not pick up those changes. To pick up the changes you must use rerun all jobs.

When saving and restoring cache, the path and key must match. What is poorly documented is that the compression method must also match. As of v4 you cannot specity the compression method, and it appears to try zstd first, then fallback to gzip. As a result, if using different containers in your workflow, both environments must have the same compression methods available. The quick fix is going to be to run apt install ztsd on the container that's missing it or apt remove zstd on the one that has it.

upload-artifact allows specifying a path to a single file, but download-artifact treats all paths as directories. If you provide a single file path to upload-artifact, pass only the parent directory to download-artifact or else you'll end up with path/file.ext/file.ext
upload-artifact will not preserve file permissions. If you have files that are mode 755, they'll end up 644 when using download-artifact. Switch to using actions/cache/save and actions/cache/restore if necessary or run a step to fix the permissions after download-artifact.

By default, terraform_wrapper: true is set. This causes issues when redirecting bash stdout into a file as extra data ends up in the file. eg: run: terraform show -json tfplan.out > tfplan.json will cause tfplan.json to contain the command being run and sometimes extra env variables. To avoid this, set terraform_wrapper: false