GitHub Actions Workflows
52 incident problems about GitHub Actions Workflows. Start with the reviewed ones.
Read first
When the CI cache restores the wrong dependency graphAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when package.json, the lockfile, and artifacts no longer agree even after a cache hit.CI/CD3 min readWhen GitHub Actions succeeds but only the rollout failsAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the build logs look fine but the failure surfaces only on the target deploy cluster or runtime.CI/CD3 min readThe checking order when GitHub Actions succeeds but only the deploy failsAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the workflow is green but the failure happens only in the rollout, promotion, or health check stage.CI/CD3 min read
Recommended problems
Reviewed problems first, then problems with detailed scenarios.
CICD-001Finding the real failure point in GitHub Actions build logsA training scenario for isolating the true cause from logs where npm dependency conflicts and cache traces are mixed together.ReviewedCI/CDIntermediate20 minFreeCICD-007Builds failingA scenario that narrows down the root cause, centered on realigning the cache key strategy and lockfile consistency, in the situation of builds failing because the cache key gets tangled after a Node version upgrade.ReviewedCI/CDBeginner16 minFreeCICD-009Deployment failingA scenario that narrows down the root cause, centered on checking the permission-policy difference by event type, in the situation of a deployment failing because the secret is empty only on tag releases.ReviewedCI/CDIntermediate21 minFreeCICD-021Build cache key mismatch after lockfile updateA pipeline stays green on one branch and fails on another because the dependency cache key no longer matches the lockfile layout.ReviewedCI/CDBeginner17 minFreeCICD-031GITHUB_TOKEN read-only default blocks release provenance uploadThe workflow can build and test successfully, but the release job fails when it tries to publish attestations or update release metadata with a narrower token scope.ReviewedCI/CDIntermediate21 minProCICD-038Publish workflow never startsA formatting or version-bump workflow commits successfully, but the downstream publish workflow never runs because the triggering push used the repository token.ReviewedCI/CDBeginner16 minFree
All problems (52)
docker build invalid reference format: the image tag is empty in GitHub Actionsdocker build invalid reference format: the image tag is empty in GitHub... is a hands-on troubleshooting drill. Learn how values pass between GitHub Actions steps. GitHub GitHub Actions Workflows needs to be checked by narrowing scope, recent change, and the current live signa...ReviewedCI/CDBeginner3 minFreeCICD-009Deployment failingA scenario that narrows down the root cause, centered on checking the permission-policy difference by event type, in the situation of a deployment failing because the secret is empty only on tag releases.ReviewedCI/CDIntermediate21 minFreeCICD-001Finding the real failure point in GitHub Actions build logsA training scenario for isolating the true cause from logs where npm dependency conflicts and cache traces are mixed together.ReviewedCI/CDIntermediate20 minFreeCICD-007Builds failingA scenario that narrows down the root cause, centered on realigning the cache key strategy and lockfile consistency, in the situation of builds failing because the cache key gets tangled after a Node version upgrade.ReviewedCI/CDBeginner16 minFreeCICD-021Build cache key mismatch after lockfile updateA pipeline stays green on one branch and fails on another because the dependency cache key no longer matches the lockfile layout.ReviewedCI/CDBeginner17 minFreeCICD-038Publish workflow never startsA formatting or version-bump workflow commits successfully, but the downstream publish workflow never runs because the triggering push used the repository token.ReviewedCI/CDBeginner16 minFreeCICD-030Release note generation fails on shallow clone runnersRelease note generation fails on shallow clone runners is a hands-on troubleshooting drill. A changelog step depends on full git history, but shallow checkout settings hide the required tags and commits. GitHub GitHub Actions Workflows needs to be checked by narrowing scope, r...CI/CDIntermediate18 minFreeCICD-034Private GHCR package install fails although workflow repository is trustedA build can authenticate to GitHub, but dependency restore still fails because the package lives in another private repository with separate access control.CI/CDIntermediate19 minFreeCICD-027Environment variable masking hides the real failing commandEnvironment variable masking hides the real failing command is a hands-on troubleshooting drill. A secret redaction rule removes the useful part of the error message, making the build logs look empty. GitHub GitHub Actions Workflows needs to be checked by narrowing scope, rece...CI/CDBeginner15 minFreeCICD-014The test report is generated, but the upload path differs so the quality gate is emptyThe test report is generated, but the upload path differs so the quality gate... is a hands-on troubleshooting drill. Covers a situation where a single artifact path typo drops the quality metric yet the pipeline still passes. GitHub GitHub Actions Workflows needs to be checke...CI/CDBeginner15 minFreeCICD-057Dependabot lockfile update bypasses integration suiteThe dependency PR looks harmless, but the full integration pipeline never runs because the workflow filter ignores shared manifests and lockfiles.CI/CDIntermediate17 minFreeCICD-004A deployment pipeline that only piles up cost with endless retries on a transient errorA problem about judging which errors should actually be retried in a pipeline where retry settings have grown indiscriminately.CI/CDIntermediate18 minFreeCICD-051Fork-based pull request cannot post review commentsThe checks run and tests pass, but the workflow step that comments on the pull request fails because the event context exposes a narrower token than the main-branch path.CI/CDIntermediate19 minFreeCICD-031GITHUB_TOKEN read-only default blocks release provenance uploadThe workflow can build and test successfully, but the release job fails when it tries to publish attestations or update release metadata with a narrower token scope.ReviewedCI/CDIntermediate21 minProCICD-016Missing feature-flag verification exposes inactive code directly in productionMissing feature-flag verification exposes inactive code directly in production is a hands-on troubleshooting drill. Tracks a feature-flag operations gap that was in the release plan but missing from the actual verification flow. GitHub Actions Workflows needs to be checked by...CI/CDAdvanced23 minProCICD-015During parallel deploys, the staging cache bleeds into production tooDuring parallel deploys, the staging cache bleeds into production too is a hands-on troubleshooting drill. Covers an incident where a shared cache key with no environment separation lets staging results affect production. GitHub GitHub Actions Workflows needs to be checked by...CI/CDIntermediate20 minProCICD-012Tests pass but the migration order is wrong, causing an incident right after deployTests pass but the migration order is wrong, causing an incident right is a hands-on troubleshooting drill. Covers an incident caused by the application deploy and database schema change happening in the wrong order. GitHub GitHub Actions Workflows needs to be checked by narro...CI/CDIntermediate24 minProCICD-013Cache hits in a multi-stage Docker build but a vulnerable layer remainsCache hits in a multi-stage Docker build but a vulnerable layer remains is a hands-on troubleshooting drill. A situation where an old base layer remains during build-speed optimization, causing a security patch to be missed. GitHub Actions Workflows needs to be checked by narr...CI/CDAdvanced26 minProCICD-010GitOps sync repeatedly failing due to a Helm values merge mistakeGitOps sync repeatedly failing (Rollout Stuck) is a hands-on troubleshooting drill. Covers a problem where per-environment values overlays get tangled and the GitOps tool keeps detecting drift. GitHub GitHub Actions Workflows needs to be checked by narrowing scope, recent chan...CI/CDAdvanced27 minProCICD-005Jobs waiting forever due to a self-hosted runner label mismatchJobs waiting forever (Auth and Session Failure) is a hands-on troubleshooting drill. A scenario for tracking labels, groups, and permission scope when the runner is alive but jobs are not picked up. GitHub GitHub Actions Workflows needs to be checked by narrowing scope, recent...CI/CDIntermediate19 minPro