GitHub Actions breaking changes, updated weekly
Every verified GitHub Actions trap in Footgun: changes and behaviors that break code or give wrong results, newest first. Each one has the error you see, the fix, and the date it was last checked. The list updates when the weekly check adds or retires a trap. For the full cause and sources, open the trap, or see all GitHub Actions traps.
fg-0223· added 2026-10-15· last checked 2026-10-15
actions/cache never updates: 'Cache hit occurred on the primary key, not saving cache'
Symptom
Cache hit occurred on the primary key node-cache, not saving cache.
Fix
Put a content hash in the key and use restore-keys for partial matches.
fg-0227· added 2026-10-15· last checked 2026-10-15
JavaScript actions that declare node20 now run on Node 24 and the Node 20 opt-out stops working
Symptom
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: ...
Fix
Upgrade actions to releases that declare node24, test early with FORCE_JAVASCRIPT_ACTIONS_TO_NODE24, and update self hosted runner hosts.
fg-0228· added 2026-10-15· last checked 2026-10-15
Job fails at setup with 'automatically failed because it uses a deprecated version of actions/upload-artifact: v3'
Symptom
Error: This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`.
Fix
Move every artifact action, and actions that wrap them, to current majors.
fg-0230· added 2026-10-15· last checked 2026-10-15
Passing env values to a reusable workflow fails with "Unrecognized named-value: 'env'"
Symptom
Unrecognized named-value: 'env'. Located at position 1 within expression: env.IMAGE_TAG
Fix
Compute the value in an earlier job and pass it through needs outputs, or store constants in repository variables and use vars.
fg-0231· added 2026-10-15· last checked 2026-10-15
Scheduled GitHub Actions workflow stops running with no error after 60 days in a public repo
Symptom
Cron workflow has no runs for weeks
Fix
Re-enable the workflow and keep some activity in the repo, or trigger it from an outside scheduler with workflow_dispatch. Merge schedule changes to the default branch.
fg-0232· added 2026-10-15· last checked 2026-10-15
Secrets are empty and GITHUB_TOKEN is read only in workflows run for pull requests from forks
Symptom
Input required and not supplied: token
Fix
Run untrusted build steps without secrets, then do privileged work in a separate workflow_run workflow that never checks out fork code.
fg-0233· added 2026-10-15· last checked 2026-10-15
upload-artifact v4 fails with 409 Conflict when matrix jobs upload to the same artifact name
Symptom
Failed to CreateArtifact: Received non-retryable error: Failed request: (409) Conflict: an artifact with this name already exists on the workflow run
Fix
Give each job a unique artifact name and merge them with download-artifact using a pattern.
fg-0235· added 2026-10-15· last checked 2026-10-15
Using secrets in an if condition fails with "Unrecognized named-value: 'secrets'"
Symptom
Unrecognized named-value: 'secrets'. Located at position 1 within expression
Fix
Map the secret into env at job level and test env in the step condition.
fg-0237· added 2026-10-15· last checked 2026-10-15
Workflows using actions/cache v1, v2, or an old pinned SHA fail since February 1, 2025
Symptom
Error: This request has been automatically failed because it uses a deprecated version of `actions/cache: v4.0.2`.
Fix
Use actions/cache v4 (or a SHA at v4.2.0 or later) and update self hosted runners.
fg-0236· added 2026-10-15· last checked 2026-10-15
Workflow step fails with 403 'Resource not accessible by integration' when commenting, labeling, or releasing
Symptom
HttpError: Resource not accessible by integration
Fix
Grant the exact write scopes in a permissions block on the job.
fg-0224· added 2026-10-15· last checked 2026-10-15
Adding one permission such as id-token: write makes actions/checkout fail with 'Repository not found'
Symptom
remote: Repository not found.
Fix
List every scope the job uses alongside the new one.
fg-0225· added 2026-10-15· last checked 2026-10-15
Cache saved on one branch or pull request is a miss on sibling branches
Symptom
Cache not found for input keys on a new branch although the same key exists
Fix
Populate the cache from a workflow on the default branch, for example on push to main or a schedule, so every branch can restore it.
fg-0226· added 2026-10-15· last checked 2026-10-15
Commit or tag pushed by a workflow with GITHUB_TOKEN does not trigger the next workflow
Symptom
A release or deploy workflow on push or tags never starts after a bot commit
Fix
Push with a GitHub App installation token or a fine grained PAT, or chain the next workflow with workflow_dispatch or workflow_run.
fg-0229· added 2026-10-15· last checked 2026-10-15
Job output is empty in the next job with the warning 'Skip output since it may contain secret'
Symptom
Warning: Skip output 'url' since it may contain secret.
Fix
Pass non secret identifiers between jobs and fetch the sensitive value again in the job that needs it, or use an artifact for data.
fg-0234· added 2026-10-15· last checked 2026-10-15
Uploaded artifact is missing dotfiles and folders such as .next or .output
Symptom
Artifact zip lacks files whose names start with a dot
Fix
Set include-hidden-files: true and exclude sensitive files explicitly in path.
fg-0015· added 2026-09-11· last checked 2026-09-11
Scheduled workflow runs late and an hour guard skips every run while reporting success
Symptom
Runs show success but the job did nothing
Fix
Deduplicate on the date rather than the hour, and record when real work happened.
fg-0014· added 2026-08-26· last checked 2026-08-26
Committing a workflow file through the API returns 403 'Resource not accessible by personal access token'
Symptom
403 Resource not accessible by personal access token
Fix
Use a token with the workflow scope, or commit the workflow by hand.
Have your agent check GitHub Actions changes before it codes