{"record":{"id":"ff038e1119bb7d69","repo":"nektos/act","slug":"gogitactioncache-failed-to-generate-random-tmp-bra","errorCode":null,"errorMessage":"GoGitActionCache failed to generate random tmp branch %s with ref %s at %s: %w","messagePattern":"GoGitActionCache failed to generate random tmp branch (.+?) with ref (.+?) at (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/runner/action_cache.go","lineNumber":51,"sourceCode":"\nfunc (c GoGitActionCache) Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error) {\n\tlogger := common.Logger(ctx)\n\n\tgitPath := path.Join(c.Path, safeFilename(cacheDir)+\".git\")\n\n\tlogger.Infof(\"GoGitActionCache fetch %s with ref %s at %s\", url, ref, gitPath)\n\n\tgogitrepo, err := git.PlainInit(gitPath, true)\n\tif errors.Is(err, git.ErrRepositoryAlreadyExists) {\n\t\tlogger.Debugf(\"GoGitActionCache cache hit %s with ref %s at %s\", url, ref, gitPath)\n\t\tgogitrepo, err = git.PlainOpen(gitPath)\n\t}\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"GoGitActionCache failed to open bare git %s with ref %s at %s: %w\", url, ref, gitPath, err)\n\t}\n\ttmpBranch := make([]byte, 12)\n\tif _, err := rand.Read(tmpBranch); err != nil {\n\t\treturn \"\", fmt.Errorf(\"GoGitActionCache failed to generate random tmp branch %s with ref %s at %s: %w\", url, ref, gitPath, err)\n\t}\n\tbranchName := hex.EncodeToString(tmpBranch)\n\n\tvar auth transport.AuthMethod\n\tif token != \"\" {\n\t\tauth = &http.BasicAuth{\n\t\t\tUsername: \"token\",\n\t\t\tPassword: token,\n\t\t}\n\t}\n\tremote, err := gogitrepo.CreateRemoteAnonymous(&config.RemoteConfig{\n\t\tName: \"anonymous\",\n\t\tURLs: []string{\n\t\t\turl,\n\t\t},\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"GoGitActionCache failed to create remote %s with ref %s at %s: %w\", url, ref, gitPath, err)","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/runner/action_cache.go#L33-L69","documentation":"Immediately after opening/creating the bare cache repo, Fetch generates a random 12-byte temporary branch name via crypto/rand.Read to hold the fetched ref. This error means the system CSPRNG failed — an extremely rare condition where reading from the OS entropy source returns an error.","triggerScenarios":"crypto/rand.Read failing: broken getrandom(2)//dev/urandom in a sandboxed container, an over-restrictive seccomp profile, or an OS/driver fault. Not triggerable by any workflow input.","commonSituations":"Running act inside a minimal container where /dev/urandom is not mounted or the seccomp profile blocks getrandom; extremely early boot on entropy-starved systems (modern kernels do not block, so almost never seen).","solutions":["Verify the environment provides a working CSPRNG: check /dev/urandom is readable inside the container (docker run --rm alpine head -c 16 /dev/urandom).","Loosen the container security profile (seccomp/apparmor) or run act on the host.","If in a VM with a stale image, reboot/update it so getrandom works.","Not a workflow bug — retry on a healthy host."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"# verify CSPRNG availability in the environment before running act\ndocker run --rm alpine sh -c 'head -c 16 /dev/urandom >/dev/null && echo urandom-ok'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run act in environments with standard /dev/urandom and unmodified seccomp profiles.","Avoid hand-rolled sandboxes that block getrandom(2)."],"tags":["crypto","entropy","sandbox","rare"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}