Github Actions, permission denied when using custom shell

Question

I am trying to use a shell script as a custom shell in Github Actions like this:

- name: Test bash-wrapper
  shell: bash-wrapper {0}
  run: |
    echo Hello world

However, when I try to run it, I get Permission denied.

Background: I have set up a chroot jail, which I use with QEMU user mode emulation in order to build for non-IA64 architectures with toolchains that lack cross-compilation support.

The script is intended to provide a bash shell on the target architecture and looks like this:

#!/bin/bash
sudo chroot --userspec=`whoami`:`whoami` $CROSS_ROOT qemu-arm-static /bin/bash -c "$*"

It resides in /bin/bash-wrapper and it thus on $PATH.

Digging a bit deeper, I found:

• Running bash-wrapper "echo Hello world" in a GHA step with the default shell works as expected.
• Running bash-wrapper 'echo Running as $(whoami)' from the default shell correctly reports we are running as user runner.
• Removing --userspec from the chroot command in bash-wrapper (thus running the command as root) does not make a difference – the custom shell gives the same error.
• GHA converts each step into a script file and passes it to the shell.
• File ownership on these files is runner:docker, runner being the user that runs the job by default.
• Interestingly, the script files generated by GHA are not executable. I suspect that is what is ultimately causing the permission error.
• Indeed, if I modify bash-wrapper to set the executable bit on the script before running it, everything works as expected.

I imagine non-executable script files would cause all sorts of troubles with various shells, thus I would expect GHA would have a way of dealing with that – in fact I am a bit surprised these on-the-fly scripts are not executable by default.

Is there a less hacky way of fixing this, such as telling GHA to set the executable bit on temporary scripts? (How does Github expect this to be solved?)

Answer 1

When calling your script try running it like this:

- name: Test bash-wrapper
  shell: bash-wrapper {0}
  run: |
     bash <your_script>.sh

Alternatively, try running this command locally and the commit and push the repository:

git update-index --chmod=+x <your_script>.sh