Skip to content

Conversation

NirajC-Microsoft
Copy link
Contributor

@NirajC-Microsoft NirajC-Microsoft commented Sep 17, 2025

Purpose

This pull request updates the way required tools are installed in the .github/workflows/group_dependabot_security_updates.yml workflow. Instead of using the cache-apt-pkgs-action, the workflow now directly installs the necessary packages using apt-get.

CI/CD workflow update:

  • Replaced the use of awalsh128/cache-apt-pkgs-action for installing jq and gh with direct installation via apt-get in the workflow job setup.

**Root cause **

  • The downloaded action just before the error is awalsh128/[email protected] — that action is the most likely component that references upload-artifact@v3 internally. The runner fails while resolving actions recursively, so a third‑party action’s internal workflow/composite is the blocker.

What I changed so it stops failing immediately

  • I removed the call to that third‑party action in your group_dependabot_security_updates.yml and replaced it with an inline apt install step (install jq + gh) to avoid invoking the external action that (apparently) depends on upload-artifact v3.
    - File edited: group_dependabot_security_updates.yml
    - Replaced: uses: awalsh128/[email protected] with: packages: "jq gh"
    - With an inline step: run: | sudo apt-get update sudo apt-get install -y jq gh
    Why this fix works
    The runner failure was because the third-party action (cache-apt-pkgs-action) pulls in an action that uses actions/upload-artifact@v3. By removing that action from your workflow we avoid triggering the deprecated chain while still getting the tool installs we need.
  • ...

Does this introduce a breaking change?

  • Yes
  • No

How to Test

  • Get the code
git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install
  • Test the code

What to Check

Verify that the following are valid

  • ...

Other Information

@NirajC-Microsoft NirajC-Microsoft changed the title fix: fix: Fix for Group Dependabot PRs Pipeline failure Sep 17, 2025
@Roopan-Microsoft Roopan-Microsoft merged commit dad4e6e into Azure-Samples:dev Sep 17, 2025
7 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants