setup: curl without --fail lets a failed download reach tar ("not in gzip format")
- Dominant language
- JavaScript
- Stars
- 163
- Forks
- 50
- PR merge metrics
- No merged PRs in 30d
Description
asdf-vm/actions/setup@v4.0.1 fails intermittently on ubuntu-24.04 with asdf_version: 0.20.0. Re-running the job usually clears it.
```
/usr/bin/curl -sSL -o /tmp/asdf-v0.20.0-linux-amd64.tar.gz https://github.com/asdf-vm/asdf/releases/download/v0.20.0/asdf-v0.20.0-linux-amd64.tar.gz
/usr/bin/tar -C /home/runner/.asdf/bin -xzf /tmp/asdf-v0.20.0-linux-amd64.tar.gz
gzip: stdin: not in gzip format
/usr/bin/tar: Child returned status 1
/usr/bin/tar: Error is not recoverable: exiting now
Error: Action failed with error Error: The process '/usr/bin/tar' failed with exit code 2
```
https://github.com/asdf-vm/actions/blob/b7bcd026f18772e44fe1026d729e1611cc435d47/src/setup/index.ts#L112-L119
curl runs without `--fail`, so an HTTP error still exits 0 and the response body gets written to `-o`. `tar` then chokes on whatever landed there.
GNU tar reports unexpected end of file for a zero-byte file, so not in gzip format means curl wrote content that wasn't a tarball. Probably an error page.
The log doesn't show the status code, since `-sS` without `--fail` drops it. So, the download step passes and you only find out later from a tar error that says nothing about the HTTP response.
#608 proposes `--retry 5`. That helps, but I don't think it closes the hole:
- `--retry` only covers 408, 429, 5xx, and timeouts. A 403 from the object store wouldn't be retried.
- Once the retries run out, curl still exits 0 and still writes the body.
- A truncated transfer isn't retried at all without `--retry-all-errors`.
`--fail --retry 5 --retry-all-errors` would cover all three.
Contributor guide
Research direction
Start in src/setup/index.ts at lines 112-119, where the asdf archive is downloaded and passed to tar. Reproduce or inspect a failed HTTP download and verify that the setup step reports the download failure directly instead of reaching tar with an invalid archive. Confirm that normal archive downloads still extract successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, typescript
- Domain
- ci-cd, devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100