Repository navigation
CI and the Pages deploy fail at startup on every run since 2026-10-18 #73
Description
CI and the Pages deploy fail at startup on every run since 2026-10-18
Every GitHub Actions run since 2026-10-18 ends with conclusion: startup_failure, with no jobs started (/actions/runs/<id>/jobs returns total_count: 0):
| when | workflow | trigger | result |
|---|---|---|---|
| 2026-10-14 18:38 | ci | PR #59 | success (last green run) |
| 2026-10-18 18:43 | ci, Deploy site to GitHub Pages | push to main (#50) |
startup_failure |
| 2026-10-18 18:44 | ci, Deploy site to GitHub Pages | push to main (#59) |
startup_failure |
| 2026-10-19 | ci | PRs #61, #62, #63 (push and pull_request) | startup_failure |
.github/workflows/ci.yml and pages.yml have not changed since 2026-10-13 (#18), so the cause is most likely a repository or organisation setting that changed between 14 and 18 October. Candidates, all under Settings → Actions:
- Actions disabled for the repo;
- an "allowed actions" list that excludes
astral-sh/setup-uvor theactions/*Pages actions; - the org policy that requires actions to be pinned to a full commit SHA. Both workflows pin by tag (
@v4,@v5). See Site 404 page breaks on nested paths; Pages workflow grants deploy permissions to the build job #72; - a billing or spending limit.
The run page names the exact reason; it was not readable from the audit environment.
The impact:
- Repo overrides can only narrow maintainers and policy actions #50 and Mechanical fixes from second audit pass #59 merged to
mainwith no CI run onmain. - PRs since then show no checks: the suite and
scripts/check_licenses.pyare not running. - The site at https://aska-digital.github.io/ion/ has not deployed since 2026-10-13.
The suite passes locally on current main: uv run pytest -q gives 250 passed, with git-filter-repo installed.
Automated posting by agentic team with human oversight.
Implementation draft awaiting independent code review: #109
Verified policy blocker (2026-10-29)
The repository Actions permissions endpoint returns enabled: true, allowed_actions: local_only, and sha_pinning_required: false. Both committed workflows use actions outside aska-digital, including actions/checkout; CI also uses astral-sh/setup-uv. GitHub documents that the organisation-only setting blocks even GitHub-authored actions. This is a verified incompatibility with these workflows, not evidence that every historical failure had only this cause. Organisation policy was not readable with the available scope (HTTP 403).
The concrete recovery choices and read-only diagnostic are in #109. Owner review is needed before relaxing the policy or replacing the workflows. CI and Pages must both run successfully before this issue closes.
Activity
ahrazzle commentedon Oct 21, 2026
Root cause found. This is an organisation policy, not a repo setting and not a workflow bug.
GET /repos/aska-digital/ion/actions/permissionsreturnsallowed_actions: "local_only". Setting it back at repo level fails with a 409: "Only 'local_only' actions and workflows are allowed in this organization." The restriction sits one level up, on the aska-digital org, and it applies to every repo in the org.With
local_only, every action that lives outside this repo is blocked before any job starts:actions/checkout,astral-sh/setup-uv,actions/configure-pages,actions/upload-pages-artifact,actions/deploy-pages. That matches thestartup_failureruns with zero jobs since 2026-10-18.Fix, for an org admin: organisation Settings, then Actions, then General, then Policies. Choose "All actions and reusable workflows". A narrower option also works: allow this org's own actions plus GitHub's actions plus
astral-sh/setup-uv. After the change, re-run the ci workflow onmainand confirm it goes green, then re-run the Pages workflow.Reading or changing the org policy through the API needs the
admin:orgscope. The account used for this audit does not hold it, so the org change itself is still open.Related change made in this pass: branch protection on
mainnow requires one approving review, dismisses stale reviews on new pushes, and requires conversation resolution. Admins are included. Force pushes and branch deletion are blocked. No required status check was set, because CI cannot run until the policy above changes. Add thetestcheck as a required status check as soon as CI is green onmainagain.