Skip to content

Avoid macOS GPG socket overflow on long runner paths - #1266

Merged
brunoborges merged 4 commits into
mainfrom
copilot/macos-self-hosted-runners-fix
Sep 9, 2026
Merged

Avoid macOS GPG socket overflow on long runner paths#1266
brunoborges merged 4 commits into
mainfrom
copilot/macos-self-hosted-runners-fix

Conversation

Copilot AI commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description:
Long self-hosted RUNNER_TEMP paths can push Temurin’s gpg-agent sockets beyond macOS’s 104-byte limit, causing signature verification to fail during key import.

  • Location: Create signature-verification homes under os.tmpdir() instead of RUNNER_TEMP.
  • Isolation: Preserve restrictive permissions, cleanup behavior, and private-key signing home locations.
  • Coverage: Add long-path regressions for successful verification, import failure, and verification failure. Update runtime bundles.

Related issue:
Linked separately.

Check list:

  • Ran npm run check locally (format, lint, build, test) and all checks pass.
  • Mark if documentation changes are required.
  • Mark if tests were added or updated to cover the changes.
Copilot AI linked an issue Sep 9, 2026 that may be closed by this pull request
macOS self-hosted runners: Temurin signature verification fails because the gpg home under RUNNER_TEMP pushes the gpg-agent socket path past 104 bytes #1263
Closed
Copilot AI changed the title [WIP] Fix gpg-agent socket path issue for macOS runners Sep 9, 2026
Copilot AI requested a review from brunoborges September 9, 2026 05:07
@brunoborges
brunoborges requested a balanced review from Copilot September 9, 2026 06:02
@brunoborges
brunoborges marked this pull request as ready for review September 9, 2026 06:02
@brunoborges
brunoborges requested a review from a team as a code owner September 9, 2026 06:02
Copilot AI reviewed Sep 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The reviewed changes have no unresolved approval-blocking issues.

Pull request overview

Moves signature-verification GPG homes to the shorter OS temporary directory, preventing macOS socket-path overflow while preserving cleanup and private-key behavior.

Changes:

  • Uses os.tmpdir() for verification homes.
  • Adds long-path success and failure regression tests.
  • Rebuilds runtime bundles.
File summaries
File Description
src/gpg.ts Uses the OS temp directory for verification homes.
dist/setup/81.index.js Updates the generated setup runtime.
dist/setup/463.index.js Updates the generated setup runtime.
dist/setup/220.index.js Updates the generated setup runtime.
dist/cleanup/index.js Updates the generated cleanup runtime.
__tests__/gpg.test.ts Tests long-path verification and cleanup behavior.
Review details
  • Files reviewed: 2/6 changed files
  • Comments generated: 0
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
@brunoborges
Keep macOS GPG verification homes within socket limits
a5aaf7c 
Use /tmp for signature verification on macOS while preserving runner temp behavior elsewhere. Cover long and canonical OS temp paths and regenerate action bundles.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 32d31c8d-ddbc-4e57-a5c3-f70588fef3f3
@brunoborges
brunoborges merged commit de7274f into main Sep 9, 2026
85 checks passed
@brunoborges
brunoborges deleted the copilot/macos-self-hosted-runners-fix branch September 9, 2026 12:09
mergify Bot added a commit to ArcadeData/arcadedb-usecases that referenced this pull request Sep 14, 2026
@mergify
build(deps): bump actions/setup-java from 5.7.0 to 6.0.1 [skip ci]
49640d3 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.7.0 to 6.0.1.
Release notes

*Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).*

> v6.0.1
> ------
>
> What's Changed
> --------------
>
> * Fix failing GitHub Actions job for temurin 17 by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1259](https://redirect.github.com/actions/setup-java/pull/1259)
> * Fix Temurin EA E2E signature verification by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1260](https://redirect.github.com/actions/setup-java/pull/1260)
> * Fix Alpine GPG verification failures and support multiple keys by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1262](https://redirect.github.com/actions/setup-java/pull/1262)
> * Fix import-safe checks when scripts are run from a path with symlinks by [`@​otaconix`](https://github.com/otaconix) in [actions/setup-java#1265](https://redirect.github.com/actions/setup-java/pull/1265)
> * Avoid macOS GPG socket overflow on long runner paths by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1266](https://redirect.github.com/actions/setup-java/pull/1266)
> * Complete v6 release highlights in README by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1254](https://redirect.github.com/actions/setup-java/pull/1254)
> * Group and slow routine Dependabot updates by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1255](https://redirect.github.com/actions/setup-java/pull/1255)
> * chore(deps-dev): update eslint and globals by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1256](https://redirect.github.com/actions/setup-java/pull/1256)
>
> New Contributors
> ----------------
>
> * [`@​otaconix`](https://github.com/otaconix) made their first contribution in [actions/setup-java#1265](https://redirect.github.com/actions/setup-java/pull/1265)
>
> **Full Changelog**: <actions/setup-java@v6.0.0...v6.0.1>
>
> v6.0.0
> ------
>
> What's Changed
> --------------
>
> * dist: Migrate from Zulu Discovery API to Azul Metadata API by [`@​jameswald`](https://github.com/jameswald) in [actions/setup-java#1010](https://redirect.github.com/actions/setup-java/pull/1010)
> * feat: add .mvn/extensions.xml to Maven cache key pattern by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1041](https://redirect.github.com/actions/setup-java/pull/1041)
> * Migrate to ESM and upgrade dependencies by [`@​priyagupta108`](https://github.com/priyagupta108) in [actions/setup-java#1078](https://redirect.github.com/actions/setup-java/pull/1078)
> * Map Zulu x86 architecture to i686 for Azul Metadata API by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1079](https://redirect.github.com/actions/setup-java/pull/1079)
> * Rename jdkFile input to jdk-file with deprecated alias by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1083](https://redirect.github.com/actions/setup-java/pull/1083)
> * Infer distribution from asdf .tool-versions vendor prefix by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1084](https://redirect.github.com/actions/setup-java/pull/1084)
> * Add Maven compiler problem matcher for javac diagnostics by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1086](https://redirect.github.com/actions/setup-java/pull/1086)
> * feat: expose cache-primary-key output ([#597](https://redirect.github.com/actions/setup-java/issues/597)) by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1088](https://redirect.github.com/actions/setup-java/pull/1088)
> * docs: clarify V6 ESM migration is not a user-facing breaking change by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1090](https://redirect.github.com/actions/setup-java/pull/1090)
> * Support multi-field Java versions like `18.0.1.1` by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1092](https://redirect.github.com/actions/setup-java/pull/1092)
> * docs: document seeding the Maven cache for plugin dependencies by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1094](https://redirect.github.com/actions/setup-java/pull/1094)
> * docs: clarify Maven cache paths and key hash inputs by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1096](https://redirect.github.com/actions/setup-java/pull/1096)
> * Support pinning java-version as "latest" by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1093](https://redirect.github.com/actions/setup-java/pull/1093)
> * chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1101](https://redirect.github.com/actions/setup-java/pull/1101)
> * chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1103](https://redirect.github.com/actions/setup-java/pull/1103)
> * chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1105](https://redirect.github.com/actions/setup-java/pull/1105)
> * chore(deps): bump actions/checkout from 6 to 7 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1106](https://redirect.github.com/actions/setup-java/pull/1106)
> * chore(deps-dev): bump `@​types/node` from 26.1.0 to 26.1.1 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1104](https://redirect.github.com/actions/setup-java/pull/1104)
> * dist: Cover Tencent Kona JDK 25 by [`@​johnshajiang`](https://github.com/johnshajiang) in [actions/setup-java#1108](https://redirect.github.com/actions/setup-java/pull/1108)
> * chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1102](https://redirect.github.com/actions/setup-java/pull/1102)
> * Preserve Maven toolchains across repeated setup-java runs ([#1099](https://redirect.github.com/actions/setup-java/issues/1099)) by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1111](https://redirect.github.com/actions/setup-java/pull/1111)
> * dist: Support Liberica NIK ([#878](https://redirect.github.com/actions/setup-java/issues/878)) by [`@​asm0dey`](https://github.com/asm0dey) in [actions/setup-java#1112](https://redirect.github.com/actions/setup-java/pull/1112)
> * Fix template injection (zizmor alert [#118](https://redirect.github.com/actions/setup-java/issues/118)) in e2e-versions.yml by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1114](https://redirect.github.com/actions/setup-java/pull/1114)
> * Fix template injection in e2e-versions.yml (zizmor alert [#122](https://redirect.github.com/actions/setup-java/issues/122)) by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1120](https://redirect.github.com/actions/setup-java/pull/1120)
> * Disable persisted checkout credentials in e2e workflow by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1115](https://redirect.github.com/actions/setup-java/pull/1115)
> * feat: Update recommended configuration for GPG signing by [`@​wetneb`](https://github.com/wetneb) in [actions/setup-java#608](https://redirect.github.com/actions/setup-java/pull/608)
> * Cache Maven and Gradle wrapper distributions separately from the dependency cache by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1097](https://redirect.github.com/actions/setup-java/pull/1097)
> * Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1124](https://redirect.github.com/actions/setup-java/pull/1124)
> * Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1123](https://redirect.github.com/actions/setup-java/pull/1123)
> * Extract repeated directory-check assertions into check-dir.sh helper by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1127](https://redirect.github.com/actions/setup-java/pull/1127)
> * Consolidate duplicate jobs in e2e-versions workflow by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1125](https://redirect.github.com/actions/setup-java/pull/1125)
> * Use YAML anchors to reduce boilerplate in e2e-versions workflow by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1126](https://redirect.github.com/actions/setup-java/pull/1126)

... (truncated)


Commits

* [`de7274f`](actions/setup-java@de7274f) Avoid macOS GPG socket overflow on long runner paths ([#1266](https://redirect.github.com/actions/setup-java/issues/1266))
* [`134912a`](actions/setup-java@134912a) Fix import-safe checks when scripts are run from a path with symlinks ([#1265](https://redirect.github.com/actions/setup-java/issues/1265))
* [`0781fc6`](actions/setup-java@0781fc6) Fix alpine failures by switching default back to only warn on verification fa...
* [`4889c4a`](actions/setup-java@4889c4a) Fix Temurin EA E2E signature verification ([#1260](https://redirect.github.com/actions/setup-java/issues/1260))
* [`8fd3240`](actions/setup-java@8fd3240) [WIP] Fix failing GitHub Actions job for temurin 17 ([#1259](https://redirect.github.com/actions/setup-java/issues/1259))
* [`2732291`](actions/setup-java@2732291) chore(deps-dev): update eslint and globals ([#1256](https://redirect.github.com/actions/setup-java/issues/1256))
* [`1a8f22b`](actions/setup-java@1a8f22b) chore: streamline Dependabot updates ([#1255](https://redirect.github.com/actions/setup-java/issues/1255))
* [`85030b7`](actions/setup-java@85030b7) docs: complete v6 release highlights ([#1254](https://redirect.github.com/actions/setup-java/issues/1254))
* [`dd06d9c`](actions/setup-java@dd06d9c) Prepare documentation for v6 release ([#1253](https://redirect.github.com/actions/setup-java/issues/1253))
* [`59b3450`](actions/setup-java@59b3450) chore(deps): combine open Dependabot npm updates ([#1252](https://redirect.github.com/actions/setup-java/issues/1252))
* Additional commits viewable in [compare view](actions/setup-java@b6effb0...de7274f)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/setup-java&package-manager=github\_actions&previous-version=5.7.0&new-version=6.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@wallentx wallentx mentioned this pull request Sep 16, 2026
Merged
onap-github pushed a commit to onap/sdc that referenced this pull request Oct 13, 2026
@dependabot @rajewluk
Bump actions/setup-java from 5.0.0 to 6.0.1
59aa1b6 
## Release notes

Sourced from actions/setup-java's releases.

v6.0.1
What's Changed

Fix failing GitHub Actions job for temurin 17 by @​brunoborges with @​Copilot in actions/setup-java#1259
Fix Temurin EA E2E signature verification by @​brunoborges with @​Copilot in actions/setup-java#1260
Fix Alpine GPG verification failures and support multiple keys by @​brunoborges in actions/setup-java#1262
Fix import-safe checks when scripts are run from a path with symlinks by @​otaconix in actions/setup-java#1265
Avoid macOS GPG socket overflow on long runner paths by @​brunoborges with @​Copilot in actions/setup-java#1266
Complete v6 release highlights in README by @​brunoborges in actions/setup-java#1254
Group and slow routine Dependabot updates by @​brunoborges in actions/setup-java#1255
chore(deps-dev): update eslint and globals by @​dependabot[bot] in actions/setup-java#1256

New Contributors

@​otaconix made their first contribution in actions/setup-java#1265

Full Changelog: actions/setup-java@v6.0.0...v6.0.1
v6.0.0
What's Changed

dist: Migrate from Zulu Discovery API to Azul Metadata API by @​jameswald in actions/setup-java#1010
feat: add .mvn/extensions.xml to Maven cache key pattern by @​brunoborges with @​Copilot in actions/setup-java#1041
Migrate to ESM and upgrade dependencies by @​priyagupta108 in actions/setup-java#1078
Map Zulu x86 architecture to i686 for Azul Metadata API by @​brunoborges in actions/setup-java#1079
Rename jdkFile input to jdk-file with deprecated alias by @​brunoborges in actions/setup-java#1083
Infer distribution from asdf .tool-versions vendor prefix by @​brunoborges in actions/setup-java#1084
Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in actions/setup-java#1086
feat: expose cache-primary-key output (#597) by @​brunoborges in actions/setup-java#1088
docs: clarify V6 ESM migration is not a user-facing breaking change by @​brunoborges in actions/setup-java#1090
Support multi-field Java versions like 18.0.1.1 by @​brunoborges in actions/setup-java#1092
docs: document seeding the Maven cache for plugin dependencies by @​brunoborges in actions/setup-java#1094
docs: clarify Maven cache paths and key hash inputs by @​brunoborges in actions/setup-java#1096
Support pinning java-version as &quot;latest&quot; by @​brunoborges in actions/setup-java#1093
chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @​dependabot[bot] in actions/setup-java#1101
chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @​dependabot[bot] in actions/setup-java#1103
chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @​dependabot[bot] in actions/setup-java#1105
chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in actions/setup-java#1106
chore(deps-dev): bump @​types/node from 26.1.0 to 26.1.1 by @​dependabot[bot] in actions/setup-java#1104
dist: Cover Tencent Kona JDK 25 by @​johnshajiang in actions/setup-java#1108
chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in actions/setup-java#1102
Preserve Maven toolchains across repeated setup-java runs (#1099) by @​brunoborges in actions/setup-java#1111
dist: Support Liberica NIK (#878) by @​asm0dey in actions/setup-java#1112
Fix template injection (zizmor alert #118) in e2e-versions.yml by @​brunoborges with @​Copilot in actions/setup-java#1114
Fix template injection in e2e-versions.yml (zizmor alert #122) by @​brunoborges with @​Copilot in actions/setup-java#1120
Disable persisted checkout credentials in e2e workflow by @​brunoborges with @​Copilot in actions/setup-java#1115
feat: Update recommended configuration for GPG signing by @​wetneb in actions/setup-java#608
Cache Maven and Gradle wrapper distributions separately from the dependency cache by @​brunoborges in actions/setup-java#1097
Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @​brunoborges in actions/setup-java#1124
Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @​brunoborges in actions/setup-java#1123
Extract repeated directory-check assertions into check-dir.sh helper by @​brunoborges in actions/setup-java#1127
Consolidate duplicate jobs in e2e-versions workflow by @​brunoborges in actions/setup-java#1125
Use YAML anchors to reduce boilerplate in e2e-versions workflow by @​brunoborges in actions/setup-java#1126

... (truncated)

## Commits

de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
134912a Fix import-safe checks when scripts are run from a path with symlinks (#1265)
0781fc6 Fix alpine failures by switching default back to only warn on verification fa
4889c4a Fix Temurin EA E2E signature verification (#1260)
8fd3240 [WIP] Fix failing GitHub Actions job for temurin 17 (#1259)
2732291 chore(deps-dev): update eslint and globals (#1256)
1a8f22b chore: streamline Dependabot updates (#1255)
85030b7 docs: complete v6 release highlights (#1254)
dd06d9c Prepare documentation for v6 release (#1253)

59b3450 chore(deps): combine open Dependabot npm updates (#1252)
Additional commits viewable in compare view

![Dependabot compatibility score](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Issue-ID: CIMAN-33
Signed-off-by: dependabot[bot] <support@github.com>
Change-Id: I2a6a10c0cb9ebd8cb97986a8c0fd3ae2a2be2b51
GitHub-PR: #20
GitHub-Hash: af9771e0ad0fc38a
Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants

@brunoborges