Unable to use `actions/cache` with Renovate: `EACCESS`

[jamietanna]

When using GitHub Actions' caching functionality, Renovate ends up hitting an EACCESS when trying to write to the restored cache keys.

A failing job with workflow definition reports the following error on subsequent runs:

 INFO: Renovate is exiting with a non-zero code due to the following logged errors
       "loggerErrors": [
         {
           "name": "renovate",
           "level": 60,
           "logContext": "BxuFXuCsh1JmPxe_hfhG1",
           "err": {
             "errno": -13,
             "code": "EACCES",
             "syscall": "mkdir",
             "path": "/tmp/renovate-baseDir/repos/github/jamietanna/jamietanna",
             "message": "EACCES: permission denied, mkdir '/tmp/renovate-baseDir/repos/github/jamietanna/jamietanna'",
             "stack": "Error: EACCES: permission denied, mkdir '/tmp/renovate-baseDir/repos/github/jamietanna/jamietanna'"
           },
           "msg": "Fatal error: EACCES: permission denied, mkdir '/tmp/renovate-baseDir/repos/github/jamietanna/jamietanna'"
         }
       ]

It appears that:

/usr/bin/docker run --env RENOVATE_TOKEN=x-access-token:*** --env RENOVATE_CONFIG_FILE=/github-action/config.js --volume /home/runner/work/actions-testing/actions-testing/config.js:/github-action/config.js --volume /var/run/docker.sock:/var/run/docker.sock --volume /tmp:/tmp --user 1000:121 --rm renovate/renovate:34.2.0-slim

May be at fault, as running id -u outside of the Renovate runner shows:

uid=1001(runner) gid=121(docker) groups=121(docker),4(adm),101(systemd-journal)

Whereas we're trying to use the uid 1000, which doesn't match, and is therefore denied from reading the files:

# this is from a different run, so not visible on the above link
/tmp/renovate-baseDir:
total 12
drwxr-xr-x  3 runner docker 4096 Nov  2 16:40 .

[jamietanna]

It looks like

github-action/src/renovate.ts

Line 20 in d7c9fe4

const renovateDockerUser = '1000';

is the line we'd want to change

[Akaame]

@jamietanna were you able to work past this?

[GSala]

@Akaame we are working around that like this:

- run: sudo chown -R 1000 /tmp/renovate
- // Run renovate
- run: sudo chown -R $(whoami) /tmp/renovate

[jamietanna]

Due to the size of our organisation, the recommendation from the Renovate team was to use Mend Renovate On-Prem (which is free!) and much less costly for our usages, and has its own means to do caching

[Akaame]

@GSala thanks this is what we also ended up doing.

[viceice]

v35 will use current host user id and use binarySource=install