nektos/act · error

GoGitActionCache failed to generate random tmp branch %s wit

Error message

GoGitActionCache failed to generate random tmp branch %s with ref %s at %s: %w

What it means

Immediately after opening/creating the bare cache repo, Fetch generates a random 12-byte temporary branch name via crypto/rand.Read to hold the fetched ref. This error means the system CSPRNG failed — an extremely rare condition where reading from the OS entropy source returns an error.

Source

Thrown at pkg/runner/action_cache.go:51

func (c GoGitActionCache) Fetch(ctx context.Context, cacheDir, url, ref, token string) (string, error) {
	logger := common.Logger(ctx)

	gitPath := path.Join(c.Path, safeFilename(cacheDir)+".git")

	logger.Infof("GoGitActionCache fetch %s with ref %s at %s", url, ref, gitPath)

	gogitrepo, err := git.PlainInit(gitPath, true)
	if errors.Is(err, git.ErrRepositoryAlreadyExists) {
		logger.Debugf("GoGitActionCache cache hit %s with ref %s at %s", url, ref, gitPath)
		gogitrepo, err = git.PlainOpen(gitPath)
	}
	if err != nil {
		return "", fmt.Errorf("GoGitActionCache failed to open bare git %s with ref %s at %s: %w", url, ref, gitPath, err)
	}
	tmpBranch := make([]byte, 12)
	if _, err := rand.Read(tmpBranch); err != nil {
		return "", fmt.Errorf("GoGitActionCache failed to generate random tmp branch %s with ref %s at %s: %w", url, ref, gitPath, err)
	}
	branchName := hex.EncodeToString(tmpBranch)

	var auth transport.AuthMethod
	if token != "" {
		auth = &http.BasicAuth{
			Username: "token",
			Password: token,
		}
	}
	remote, err := gogitrepo.CreateRemoteAnonymous(&config.RemoteConfig{
		Name: "anonymous",
		URLs: []string{
			url,
		},
	})
	if err != nil {
		return "", fmt.Errorf("GoGitActionCache failed to create remote %s with ref %s at %s: %w", url, ref, gitPath, err)

View on GitHub (pinned to 4f41128141)

Solutions

1. Verify the environment provides a working CSPRNG: check /dev/urandom is readable inside the container (docker run --rm alpine head -c 16 /dev/urandom).
2. Loosen the container security profile (seccomp/apparmor) or run act on the host.
3. If in a VM with a stale image, reboot/update it so getrandom works.
4. Not a workflow bug — retry on a healthy host.

# verify CSPRNG availability in the environment before running act
docker run --rm alpine sh -c 'head -c 16 /dev/urandom >/dev/null && echo urandom-ok'

When it happens

Trigger: crypto/rand.Read failing: broken getrandom(2)//dev/urandom in a sandboxed container, an over-restrictive seccomp profile, or an OS/driver fault. Not triggerable by any workflow input.

Common situations: Running act inside a minimal container where /dev/urandom is not mounted or the seccomp profile blocks getrandom; extremely early boot on entropy-starved systems (modern kernels do not block, so almost never seen).

Related errors

• generate auth token: %w
• error occurring when resetting io pointer in '%s': %w

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/ff038e1119bb7d69. Report an issue: GitHub.