Pipelines fail with `SyntaxError: Unexpected token`

[gaggle]

Hi, we see occasional failed pipelines because, well, something goes wrong in pnpm/action-setup:

Running self-installer...
  [stdin]:1
  <HTML>
  ^
  SyntaxError: Unexpected token '<'
      at new Script (vm.js:84:7)
      at createScript (vm.js:258:10)
      at Object.runInThisContext (vm.js:306:10)
      at Object.<anonymous> ([stdin]-wrapper:9:26)
      at Module._compile (internal/modules/cjs/loader.js:959:30)
      at evalScript (internal/process/execution.js:80:25)
      at internal/main/eval_stdin.js:29:5
      at Socket.<anonymous> (internal/process/execution.js:192:5)
      at Socket.emit (events.js:215:7)
      at endReadableNT (_stream_readable.js:1184:12)
Error: Something does wrong, self-installer exits with code 1
Installation Completed!
Running pnpm recursive install --frozen-lockfile
Error: Command pnpm recursive install --frozen-lockfile (cwd: undefined) exits with status 127

I'm not sure if it's this line const response = await fetch('https://pnpm.js.org/pnpm.js') that might fail? If it somehow gets an HTML response? So if pnpm.js.org fails to return the pnpm.js script for a splitsecond, instead returning an HTML error page, then that could happen?

Will maintainers consider a retry mechanism to increase resilience? If the request is the cause of this error then an exponential backoff could work well, to try a couple times before giving up. WDYT?

[gaggle]

Mm.. just got more failing pipelines, same as the error reported here. Maybe it's not random request/response errors if they occur so close together… could the endpoint be rate-limited? If response headers indicate when another request is allowed this action could delay until that time?

I assume the file itself cannot be cached locally to this action? It's not like it needs to re-download it every time if it was last fetched by another CI run a few minutes ago… but I'm not really sure what's possible in the GitHub Actions infrastructure.

[gaggle]

We run multiple jobs in parallel so now I suspect we're being ratelimited by the jobs starting in parallel that all download pnpm.js. Do you foresee a way to share the downloaded artifact for the whole CI job? I'm considering ways to download it once when the pipeline starts and somehow sharing the file-location with pnpm/action-setup.

I can help work on a PR, but looking to align w. maintainers before I go too crazy.

[KSXGitHub]

Are you using the latest version of pnpm/action-setup?

[gaggle]

Sorry I should have included that information, yes here's the pipeline snippet:

      - uses: pnpm/action-setup@v2
        with:
          version: ${{ env.pnpm-version }}
          run_install: |
            - recursive: true
              args: [--frozen-lockfile, --filter "${{ matrix.package }}..."]

That snippet sits inside a matrix that currently ramps up to 27 parallel jobs.

[KSXGitHub]

v2 is actually outdated. Use tag v2.0.1 instead. If you want to be up-to-date, just use dependabot.

[gaggle]

Yikes okay, thanks change.

[KSXGitHub]

We run multiple jobs in parallel so now I suspect we're being ratelimited by the jobs starting in parallel that all download pnpm.js

I tried downloading multiple pnpm.js concurrently (30 requests) but all of them were valid JavaScript files.

Anyway, I will leave this issue open for a month or two. If there is a problem, let me know.

[gaggle]

Thanks. If we see it again with the latest version we're discussing a fork to introduce additional debug information, and if the smoking gun points to the downlading of pnpm.js then we could introduce caching of it. But we'll wait and see too 👍

[bkniffler]

Just got the same issue with

- uses: pnpm/action-setup@v2.0.1
        with:
          version: 6.0.2
          run_install: true

[hikariNTU]

Same issue in Github matrix actions:

Run pnpm/action-setup@v2.1.0
  with:
    version: latest
    dest: ~/setup-pnpm
    run_install: null
  env:
    NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc
    NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX
Running self-installer...
  [stdin]:1
  <HTML>
  ^
  
  SyntaxError: Unexpected token '<'
      at new Script (vm.js:84:7)
      at createScript (vm.js:258:10)
      at Object.runInThisContext (vm.js:306:10)
      at Object.<anonymous> ([stdin]-wrapper:9:26)
      at Module._compile (internal/modules/cjs/loader.js:959:30)
      at evalScript (internal/process/execution.js:80:25)
      at internal/main/eval_stdin.js:29:5
      at Socket.<anonymous> (internal/process/execution.js:192:5)
      at Socket.emit (events.js:215:7)
      at endReadableNT (_stream_readable.js:1184:12)
Error: Something went wrong, self-installer exits with code 1
Installation Completed!

We also set npmrc before installing pnpm:

Run actions/setup-node@v2
  with:
    node-version: 16.x
    registry-url: https://npm.pkg.github.com
    scope: ***
    always-auth: false
    check-latest: false
    token: ***
Found in cache @ /opt/hostedtoolcache/node/16.13.2/x64

But these setting should not be a problem.

And these actions only fail in an action

We will try to combine these actions together to make sure this is not rate limit problem later on.

[razbensimon]

Still happens to us on version 2.1.0. Any suggestions?
this is our usage:

- name: setup pnpm
        uses: pnpm/action-setup@v2.1.0
        with:
          version: 6.16.0

[zkochan]

maybe we should add some retries.

[hikariNTU]

@zkochan Can you elaborate more about this PR?
I don't know how does changing fetch's url and checking response's body can help to prevent server responding false js file?