Skip to content

Avoid macOS GPG socket overflow on long runner paths - #1266

Merged
brunoborges merged 4 commits into
mainfrom
copilot/macos-self-hosted-runners-fix
Sep 9, 2026
Merged

Avoid macOS GPG socket overflow on long runner paths#1266
brunoborges merged 4 commits into
mainfrom
copilot/macos-self-hosted-runners-fix

Conversation

Copilot AI commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description:
Long self-hosted RUNNER_TEMP paths can push Temurin’s gpg-agent sockets beyond macOS’s 104-byte limit, causing signature verification to fail during key import.

  • Location: Create signature-verification homes under os.tmpdir() instead of RUNNER_TEMP.
  • Isolation: Preserve restrictive permissions, cleanup behavior, and private-key signing home locations.
  • Coverage: Add long-path regressions for successful verification, import failure, and verification failure. Update runtime bundles.

Related issue:
Linked separately.

Check list:

  • Ran npm run check locally (format, lint, build, test) and all checks pass.
  • Mark if documentation changes are required.
  • Mark if tests were added or updated to cover the changes.

Copilot AI linked an issue Sep 9, 2026 that may be closed by this pull request
macOS self-hosted runners: Temurin signature verification fails because the gpg home under RUNNER_TEMP pushes the gpg-agent socket path past 104 bytes #1263
Closed
Copilot AI changed the title [WIP] Fix gpg-agent socket path issue for macOS runners Avoid macOS GPG socket overflow on long runner paths Sep 9, 2026
Copilot AI requested a review from brunoborges September 9, 2026 05:07
@brunoborges
brunoborges requested a balanced review from Copilot September 9, 2026 06:02
@brunoborges
brunoborges marked this pull request as ready for review September 9, 2026 06:02
@brunoborges
brunoborges requested a review from a team as a code owner September 9, 2026 06:02
Copilot AI reviewed Sep 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The reviewed changes have no unresolved approval-blocking issues.

Pull request overview

Moves signature-verification GPG homes to the shorter OS temporary directory, preventing macOS socket-path overflow while preserving cleanup and private-key behavior.

Changes:

  • Uses os.tmpdir() for verification homes.
  • Adds long-path success and failure regression tests.
  • Rebuilds runtime bundles.
File summaries
File Description
src/gpg.ts Uses the OS temp directory for verification homes.
dist/setup/81.index.js Updates the generated setup runtime.
dist/setup/463.index.js Updates the generated setup runtime.
dist/setup/220.index.js Updates the generated setup runtime.
dist/cleanup/index.js Updates the generated cleanup runtime.
__tests__/gpg.test.ts Tests long-path verification and cleanup behavior.
Review details
  • Files reviewed: 2/6 changed files
  • Comments generated: 0
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@brunoborges
Keep macOS GPG verification homes within socket limits
a5aaf7c 
Use /tmp for signature verification on macOS while preserving runner temp behavior elsewhere. Cover long and canonical OS temp paths and regenerate action bundles.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 32d31c8d-ddbc-4e57-a5c3-f70588fef3f3
@brunoborges
brunoborges merged commit de7274f into main Sep 9, 2026
85 checks passed
@brunoborges
brunoborges deleted the copilot/macos-self-hosted-runners-fix branch September 9, 2026 12:09
mergify Bot added a commit to ArcadeData/arcadedb-usecases that referenced this pull request Sep 14, 2026
@mergify
build(deps): bump actions/setup-java from 5.7.0 to 6.0.1 [skip ci]
49640d3 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.7.0 to 6.0.1.
Release notes

*Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).*

> v6.0.1
> ------
>
> What's Changed
> --------------
>
> * Fix failing GitHub Actions job for temurin 17 by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1259](https://redirect.github.com/actions/setup-java/pull/1259)
> * Fix Temurin EA E2E signature verification by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1260](https://redirect.github.com/actions/setup-java/pull/1260)
> * Fix Alpine GPG verification failures and support multiple keys by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1262](https://redirect.github.com/actions/setup-java/pull/1262)
> * Fix import-safe checks when scripts are run from a path with symlinks by [`@​otaconix`](https://github.com/otaconix) in [actions/setup-java#1265](https://redirect.github.com/actions/setup-java/pull/1265)
> * Avoid macOS GPG socket overflow on long runner paths by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1266](https://redirect.github.com/actions/setup-java/pull/1266)
> * Complete v6 release highlights in README by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1254](https://redirect.github.com/actions/setup-java/pull/1254)
> * Group and slow routine Dependabot updates by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1255](https://redirect.github.com/actions/setup-java/pull/1255)
> * chore(deps-dev): update eslint and globals by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1256](https://redirect.github.com/actions/setup-java/pull/1256)
>
> New Contributors
> ----------------
>
> * [`@​otaconix`](https://github.com/otaconix) made their first contribution in [actions/setup-java#1265](https://redirect.github.com/actions/setup-java/pull/1265)
>
> **Full Changelog**: <actions/setup-java@v6.0.0...v6.0.1>
>
> v6.0.0
> ------
>
> What's Changed
> --------------
>
> * dist: Migrate from Zulu Discovery API to Azul Metadata API by [`@​jameswald`](https://github.com/jameswald) in [actions/setup-java#1010](https://redirect.github.com/actions/setup-java/pull/1010)
> * feat: add .mvn/extensions.xml to Maven cache key pattern by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1041](https://redirect.github.com/actions/setup-java/pull/1041)
> * Migrate to ESM and upgrade dependencies by [`@​priyagupta108`](https://github.com/priyagupta108) in [actions/setup-java#1078](https://redirect.github.com/actions/setup-java/pull/1078)
> * Map Zulu x86 architecture to i686 for Azul Metadata API by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1079](https://redirect.github.com/actions/setup-java/pull/1079)
> * Rename jdkFile input to jdk-file with deprecated alias by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1083](https://redirect.github.com/actions/setup-java/pull/1083)
> * Infer distribution from asdf .tool-versions vendor prefix by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1084](https://redirect.github.com/actions/setup-java/pull/1084)
> * Add Maven compiler problem matcher for javac diagnostics by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1086](https://redirect.github.com/actions/setup-java/pull/1086)
> * feat: expose cache-primary-key output ([#597](https://redirect.github.com/actions/setup-java/issues/597)) by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1088](https://redirect.github.com/actions/setup-java/pull/1088)
> * docs: clarify V6 ESM migration is not a user-facing breaking change by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1090](https://redirect.github.com/actions/setup-java/pull/1090)
> * Support multi-field Java versions like `18.0.1.1` by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1092](https://redirect.github.com/actions/setup-java/pull/1092)
> * docs: document seeding the Maven cache for plugin dependencies by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1094](https://redirect.github.com/actions/setup-java/pull/1094)
> * docs: clarify Maven cache paths and key hash inputs by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1096](https://redirect.github.com/actions/setup-java/pull/1096)
> * Support pinning java-version as "latest" by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1093](https://redirect.github.com/actions/setup-java/pull/1093)
> * chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1101](https://redirect.github.com/actions/setup-java/pull/1101)
> * chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1103](https://redirect.github.com/actions/setup-java/pull/1103)
> * chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1105](https://redirect.github.com/actions/setup-java/pull/1105)
> * chore(deps): bump actions/checkout from 6 to 7 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1106](https://redirect.github.com/actions/setup-java/pull/1106)
> * chore(deps-dev): bump `@​types/node` from 26.1.0 to 26.1.1 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1104](https://redirect.github.com/actions/setup-java/pull/1104)
> * dist: Cover Tencent Kona JDK 25 by [`@​johnshajiang`](https://github.com/johnshajiang) in [actions/setup-java#1108](https://redirect.github.com/actions/setup-java/pull/1108)
> * chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1102](https://redirect.github.com/actions/setup-java/pull/1102)
> * Preserve Maven toolchains across repeated setup-java runs ([#1099](https://redirect.github.com/actions/setup-java/issues/1099)) by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1111](https://redirect.github.com/actions/setup-java/pull/1111)
> * dist: Support Liberica NIK ([#878](https://redirect.github.com/actions/setup-java/issues/878)) by [`@​asm0dey`](https://github.com/asm0dey) in [actions/setup-java#1112](https://redirect.github.com/actions/setup-java/pull/1112)
> * Fix template injection (zizmor alert [#118](https://redirect.github.com/actions/setup-java/issues/118)) in e2e-versions.yml by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1114](https://redirect.github.com/actions/setup-java/pull/1114)
> * Fix template injection in e2e-versions.yml (zizmor alert [#122](https://redirect.github.com/actions/setup-java/issues/122)) by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1120](https://redirect.github.com/actions/setup-java/pull/1120)
> * Disable persisted checkout credentials in e2e workflow by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1115](https://redirect.github.com/actions/setup-java/pull/1115)
> * feat: Update recommended configuration for GPG signing by [`@​wetneb`](https://github.com/wetneb) in [actions/setup-java#608](https://redirect.github.com/actions/setup-java/pull/608)
> * Cache Maven and Gradle wrapper distributions separately from the dependency cache by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1097](https://redirect.github.com/actions/setup-java/pull/1097)
> * Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1124](https://redirect.github.com/actions/setup-java/pull/1124)
> * Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1123](https://redirect.github.com/actions/setup-java/pull/1123)
> * Extract repeated directory-check assertions into check-dir.sh helper by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1127](https://redirect.github.com/actions/setup-java/pull/1127)
> * Consolidate duplicate jobs in e2e-versions workflow by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1125](https://redirect.github.com/actions/setup-java/pull/1125)
> * Use YAML anchors to reduce boilerplate in e2e-versions workflow by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1126](https://redirect.github.com/actions/setup-java/pull/1126)

... (truncated)


Commits

* [`de7274f`](actions/setup-java@de7274f) Avoid macOS GPG socket overflow on long runner paths ([#1266](https://redirect.github.com/actions/setup-java/issues/1266))
* [`134912a`](actions/setup-java@134912a) Fix import-safe checks when scripts are run from a path with symlinks ([#1265](https://redirect.github.com/actions/setup-java/issues/1265))
* [`0781fc6`](actions/setup-java@0781fc6) Fix alpine failures by switching default back to only warn on verification fa...
* [`4889c4a`](actions/setup-java@4889c4a) Fix Temurin EA E2E signature verification ([#1260](https://redirect.github.com/actions/setup-java/issues/1260))
* [`8fd3240`](actions/setup-java@8fd3240) [WIP] Fix failing GitHub Actions job for temurin 17 ([#1259](https://redirect.github.com/actions/setup-java/issues/1259))
* [`2732291`](actions/setup-java@2732291) chore(deps-dev): update eslint and globals ([#1256](https://redirect.github.com/actions/setup-java/issues/1256))
* [`1a8f22b`](actions/setup-java@1a8f22b) chore: streamline Dependabot updates ([#1255](https://redirect.github.com/actions/setup-java/issues/1255))
* [`85030b7`](actions/setup-java@85030b7) docs: complete v6 release highlights ([#1254](https://redirect.github.com/actions/setup-java/issues/1254))
* [`dd06d9c`](actions/setup-java@dd06d9c) Prepare documentation for v6 release ([#1253](https://redirect.github.com/actions/setup-java/issues/1253))
* [`59b3450`](actions/setup-java@59b3450) chore(deps): combine open Dependabot npm updates ([#1252](https://redirect.github.com/actions/setup-java/issues/1252))
* Additional commits viewable in [compare view](actions/setup-java@b6effb0...de7274f)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/setup-java&package-manager=github\_actions&previous-version=5.7.0&new-version=6.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
+1 more reviewer
@brunoborges brunoborges brunoborges approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@brunoborges brunoborges

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

macOS self-hosted runners: Temurin signature verification fails because the gpg home under RUNNER_TEMP pushes the gpg-agent socket path past 104 bytes

3 participants

@brunoborges