Schema validation errors, but the Extension reports no problems

[igc-jva]

Bug report info

act version:            0.2.84
GOOS:                   windows
GOARCH:                 amd64
NumCPU:                 20
Docker host:            tcp://127.0.0.1:2375
Sockets found:
Config files:
        C:\Users\JVA\AppData\Local\act\actrc:
                -P ubuntu-latest=catthehacker/ubuntu:act-latest
                -P ubuntu-22.04=catthehacker/ubuntu:act-22.04
                -P ubuntu-20.04=catthehacker/ubuntu:act-20.04
                -P ubuntu-18.04=catthehacker/ubuntu:act-18.04
Build info:
        Go version:            go1.24.0
        Module path:           github.com/nektos/act
        Main version:          v0.2.84+dirty
        Main path:             github.com/nektos/act
        Main checksum:
        Build settings:
                -buildmode:           exe
                -compiler:            gc
                -trimpath:            true
                CGO_ENABLED:          0
                GOARCH:               amd64
                GOOS:                 windows
                GOAMD64:              v1
                vcs:                  git
                vcs.revision:         5668308bac0d256c8a4c3aa1467d2ebcb55bc717
                vcs.time:             2025-02-01T14:37:09Z
                vcs.modified:         true
Docker Engine:
        Engine version:        29.3.0
        Engine runtime:        runc
        Cgroup version:        2
        Cgroup driver:         systemd
        Storage driver:        overlayfs
        Registry URI:          https://index.docker.io/v1/
        OS:                    Arch Linux
        OS type:               linux
        OS version:
        OS arch:               x86_64
        OS kernel:             6.6.87.2-microsoft-standard-WSL2
        OS CPU:                20
        OS memory:             31923 MB
        Security options:
                name=seccomp,profile=builtin
                name=cgroupns

Command used with act

act --workflows ".github/workflows/release-published.yml" --secret-file "" --var-file "" --input-file "" --eventpath "" --container-daemon-socket "tcp://127.0.0.1:2375" --artifact-server-path "./artifacts"

Describe issue

When running the above command, I get the following output:

Using docker host 'tcp://127.0.0.1:2375', and daemon socket 'tcp://127.0.0.1:2375'
Error: workflow is not valid. 'release-published.yml': Line: 17 Column 3: Failed to match permissions-mapping: Line: 20 Column 3: Unknown Property artifact-metadata
Line: 17 Column 3: Failed to match permission-level-shorthand-read-all: Line: 17 Column 3: Expected a scalar got mapping
Line: 17 Column 3: Failed to match permission-level-shorthand-write-all: Line: 17 Column 3: Expected a scalar got mapping
Line: 217 Column 5: Failed to match job-factory: Line: 258 Column 9: Failed to match run-step: Line: 259 Column 9: Unknown Property uses
Line: 260 Column 9: Unknown Property with
Line: 258 Column 9: Failed to match regular-step: Line: 261 Column 23: Unknown Function Call case
Line: 217 Column 5: Failed to match workflow-job: Line: 218 Column 5: Unknown Property runs-on
Line: 220 Column 5: Unknown Property environment
Line: 225 Column 5: Unknown Property steps
Actions YAML Schema Validation Error detected:
For more information, see: https://nektosact.com/usage/schema.html

Release Published Delivery #3 exited with exit code 1.

I checked the schema URL and I am using the Local actions extension, but it does not report any problems for the file. I've attached the pipeline in question.

Link to GitHub repository

No response

Workflow content

name: Release Published Delivery

on:
  release:
    types:
      - published

concurrency:
  group: release-published-${{ github.event.release.tag_name }}
  cancel-in-progress: false

env:
  DOTNET_VERSION: '9.0.x'
  SOLUTION_PATH: src/IGC.Transit.slnx

permissions:
  contents: write
  actions: read
  checks: write
  artifact-metadata: read
  packages: write

jobs:
  release-setup:
    name: Validate Release Context
    runs-on: ubuntu-latest
    if: ${{ !github.event.release.prerelease }}
    outputs:
      version: ${{ steps.version.outputs.version }}
      assembly_version: ${{ steps.version.outputs.assembly_version }}
      release_tag: ${{ steps.version.outputs.release_tag }}
      release_commit: ${{ steps.version.outputs.release_commit }}
    steps:
      - name: Checkout released tag commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: refs/tags/${{ github.event.release.tag_name }}

      - name: Parse and validate release version
        id: version
        run: |
          RELEASE_TAG="${{ github.event.release.tag_name }}"
          VERSION_FROM_TAG="${RELEASE_TAG#v}"

          if [[ ! "$VERSION_FROM_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Release tag must be semantic version format vX.Y.Z or X.Y.Z. Got: ${RELEASE_TAG}" >&2
            exit 1
          fi

          MAJOR=$(grep 'major:' version.yaml | awk '{print $2}')
          MINOR=$(grep 'minor:' version.yaml | awk '{print $2}')
          PATCH=$(grep 'patch:' version.yaml | awk '{print $2}')
          VERSION_FROM_FILE="${MAJOR}.${MINOR}.${PATCH}"

          if [[ "$VERSION_FROM_TAG" != "$VERSION_FROM_FILE" ]]; then
            echo "Release tag version (${VERSION_FROM_TAG}) does not match version.yaml (${VERSION_FROM_FILE})." >&2
            exit 1
          fi

          ASSEMBLY_VERSION="${VERSION_FROM_FILE}.0"
          RELEASE_COMMIT=$(git rev-parse HEAD)

          echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
          echo "release_commit=${RELEASE_COMMIT}" >> $GITHUB_OUTPUT
          echo "version=${VERSION_FROM_FILE}" >> $GITHUB_OUTPUT
          echo "assembly_version=${ASSEMBLY_VERSION}" >> $GITHUB_OUTPUT

          {
            echo "## Release Context"
            echo "- Release tag: ${RELEASE_TAG}"
            echo "- Checked out commit: ${RELEASE_COMMIT}"
            echo "- Version: ${VERSION_FROM_FILE}"
            echo "- Assembly Version: ${ASSEMBLY_VERSION}"
          } >> $GITHUB_STEP_SUMMARY

  build:
    name: Restore, Build, Test, and Pack
    runs-on: ubuntu-latest
    needs: release-setup
    steps:
      - name: Checkout released tag commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: refs/tags/${{ needs.release-setup.outputs.release_tag }}

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json', '**/Directory.Packages.props') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore ${{ env.SOLUTION_PATH }}

      - name: Build solution
        run: |
          dotnet build ${{ env.SOLUTION_PATH }} \
            --configuration Release \
            --no-restore \
            -p:Version=${{ needs.release-setup.outputs.version }} \
            -p:AssemblyVersion=${{ needs.release-setup.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.release-setup.outputs.assembly_version }}

      - name: Run tests
        run: |
          dotnet test ${{ env.SOLUTION_PATH }} \
            --configuration Release \
            --no-build \
            --verbosity normal \
            --logger "trx" \
            || true

      - name: Publish Test Results
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: (!cancelled())
        with:
          files: src/IGC.*.Tests/**/*.trx

      - name: Pack IGC.Transit.BLL NuGet package
        run: |
          dotnet pack src/IGC.Transit.BLL/IGC.Transit.BLL.csproj \
            --configuration Release \
            --no-build \
            --output ./packages \
            -p:PackageVersion=${{ needs.release-setup.outputs.version }} \
            -p:Version=${{ needs.release-setup.outputs.version }} \
            -p:AssemblyVersion=${{ needs.release-setup.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.release-setup.outputs.assembly_version }}

      - name: Upload NuGet package artifact
        uses: actions/upload-artifact@v4
        with:
          name: IGC.Transit.BLL-${{ needs.release-setup.outputs.version }}-nupkg
          path: ./packages/*.nupkg
          retention-days: 90

  publish-dotnet:
    name: Publish and Package .NET Artifacts
    runs-on: ubuntu-latest
    needs: [release-setup, build]
    strategy:
      matrix:
        include:
          - project_name: IGC.Transit.Api
            project_path: src/IGC.Transit.Api/IGC.Transit.Api.csproj
            runtime: linux-x64
          - project_name: IGC.Transit.Api
            project_path: src/IGC.Transit.Api/IGC.Transit.Api.csproj
            runtime: win-x64
          - project_name: IGC.Transit.Workers
            project_path: src/IGC.Transit.Workers/IGC.Transit.Workers.csproj
            runtime: linux-x64
          - project_name: IGC.Transit.Workers
            project_path: src/IGC.Transit.Workers/IGC.Transit.Workers.csproj
            runtime: win-x64
    steps:
      - name: Checkout released tag commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: refs/tags/${{ needs.release-setup.outputs.release_tag }}

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json', '**/Directory.Packages.props') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore ${{ env.SOLUTION_PATH }}

      - name: Publish ${{ matrix.project_name }} (${{ matrix.runtime }})
        run: |
          OUTPUT_DIR="./publish/${{ matrix.project_name }}-${{ matrix.runtime }}"
          dotnet publish ${{ matrix.project_path }} \
            --configuration Release \
            --runtime ${{ matrix.runtime }} \
            --self-contained false \
            --output "$OUTPUT_DIR" \
            -p:Version=${{ needs.release-setup.outputs.version }} \
            -p:AssemblyVersion=${{ needs.release-setup.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.release-setup.outputs.assembly_version }}

          rm -f "$OUTPUT_DIR/appsettings.Development.json"

      - name: Zip ${{ matrix.project_name }} (${{ matrix.runtime }})
        run: |
          mkdir -p ./release-assets
          ASSET_NAME="${{ matrix.project_name }}-${{ needs.release-setup.outputs.version }}-${{ matrix.runtime }}.zip"
          cd ./publish
          zip -r "../release-assets/${ASSET_NAME}" "${{ matrix.project_name }}-${{ matrix.runtime }}"

      - name: Upload packaged .NET artifact (${{ matrix.project_name }} ${{ matrix.runtime }})
        uses: actions/upload-artifact@v4
        with:
          name: release-asset-${{ matrix.project_name }}-${{ matrix.runtime }}
          path: ./release-assets/*.zip
          retention-days: 90

  publish-docker:
    name: Publish Docker Images
    runs-on: ubuntu-latest
    needs: release-setup
    environment:
      name: Production
    strategy:
      matrix:
        container: [api, worker]
    steps:
      - name: Checkout released tag commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: refs/tags/${{ needs.release-setup.outputs.release_tag }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/transit-${{ matrix.container }}
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}},value=${{ needs.release-setup.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.release-setup.outputs.version }}
            type=semver,pattern={{major}},value=${{ needs.release-setup.outputs.version }}
            type=sha
            type=raw,value=latest

      - name: Build and publish ${{ matrix.container }} docker
        uses: docker/build-push-action@v6
        with:
          build-args: |
            VERSION=${{ needs.release-setup.outputs.version }}
            ASSEMBLY_VERSION=${{ needs.release-setup.outputs.assembly_version }}
            APP_NAME=${{ format('IGC.Transit.{0}', case(matrix.container == 'api', 'Api', matrix.container == 'worker', 'Workers', 'Api')) }}
            ENVIRONMENT=Production
          context: .
          file: ./docker/Dockerfile
          target: ${{ matrix.container }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  publish-nuget:
    name: Publish NuGet Package
    runs-on: ubuntu-latest
    needs: [release-setup, build]
    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Download NuGet package artifact
        uses: actions/download-artifact@v4
        with:
          name: IGC.Transit.BLL-${{ needs.release-setup.outputs.version }}-nupkg
          path: ./nuget

      - name: NuGet setup
        run: |
          dotnet nuget add source --name github "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json" --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} --store-password-in-clear-text

      - name: Publish NuGet Package
        run: |
          for nupkg in ./nuget/*.nupkg; do
            echo "Publishing $nupkg to GitHub Packages"
            dotnet nuget push "$nupkg" --source github --skip-duplicate
          done

  upload-release-assets:
    name: Upload Assets to Published Release
    runs-on: ubuntu-latest
    needs: [release-setup, publish-dotnet, publish-nuget, publish-docker]
    steps:
      - name: Download NuGet package artifact
        uses: actions/download-artifact@v4
        with:
          name: IGC.Transit.BLL-${{ needs.release-setup.outputs.version }}-nupkg
          path: ./release-assets

      - name: Download packaged .NET artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: release-asset-*
          merge-multiple: true
          path: ./release-assets

      - name: List release assets
        run: ls -la ./release-assets

      - name: Upload assets to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ needs.release-setup.outputs.release_tag }}" \
            ./release-assets/*.nupkg \
            ./release-assets/*.zip \
            --clobber

Relevant log output

Handling container host and socket
Using docker host 'tcp://127.0.0.1:2375', and daemon socket 'tcp://127.0.0.1:2375'
Loading environment from d:\repos\IGC.Transit\.env
Conditional GET for notices etag=6bd2730d-d9d9-4c84-8568-57551142e957
Loading action inputs from
Loading secrets from
Loading vars from
Evaluated matrix inclusions: map[]
Loading workflow 'd:\repos\IGC.Transit\.github\workflows\release-published.yml'
Reading workflow 'd:\repos\IGC.Transit\.github\workflows\release-published.yml'
Error: workflow is not valid. 'release-published.yml': Line: 17 Column 3: Failed to match permissions-mapping: Line: 20 Column 3: Unknown Property artifact-metadata
Line: 17 Column 3: Failed to match permission-level-shorthand-read-all: Line: 17 Column 3: Expected a scalar got mapping
Line: 17 Column 3: Failed to match permission-level-shorthand-write-all: Line: 17 Column 3: Expected a scalar got mapping
Line: 217 Column 5: Failed to match job-factory: Line: 258 Column 9: Failed to match run-step: Line: 259 Column 9: Unknown Property uses
Line: 260 Column 9: Unknown Property with
Line: 258 Column 9: Failed to match regular-step: Line: 261 Column 23: Unknown Function Call case
Line: 217 Column 5: Failed to match workflow-job: Line: 218 Column 5: Unknown Property runs-on
Line: 220 Column 5: Unknown Property environment
Line: 225 Column 5: Unknown Property steps
Actions YAML Schema Validation Error detected:
For more information, see: https://nektosact.com/usage/schema.html

Release Published Delivery #4 exited with exit code 1.

Additional information

No response

[ChristopherHX]

Unknown Function Call case

case function is not supported in nektos/act see #6006

[ChristopherHX]

artifact-metadata: read

This is not supported by act as well, schema is out of date

[igc-jva]

Any idea when the schema will be updated? I was really looking forward to being able to test locally, but all the workflows use these, so from what I gather, it means I cannot use act for now?

[ChristopherHX]

all the workflows use these

I never used artifact-metadata anywhere, it's 1-2 Months old. For actions/artifacts it is not needed, for release uploads also not.

Does your workflow really depends on artifact-metadata: read?

Any idea when the schema will be updated?

Out of my control, I / you could propose an update: The upstream file of the vscode extension is this one https://github.com/actions/languageservices/blob/main/workflow-parser/src/workflow-v1.0.json, replace the workflow-v1.0.json from the act code and done.

[igc-jva]

I have a workflow that downloads artifacts from another workflow using the github CLI. It needs that permission for the CLI, since the contents permission is now depricated.

[ChristopherHX]

I have a workflow that downloads artifacts from another workflow using the github CLI

I expected that this would need actions: read, if this is a normal actions artifact. Hmm.

[jonahbeckford]

https://github.com/actions/attest?tab=readme-ov-file#usage requires artifact-metadata: write. Basically anyone who follows GitHub's SLSA attestation documentation.

[vincent067]

Hi there! 👋

I ran into the same issue while working with some newer GitHub Actions workflows that use the artifact-metadata permission. It was causing validation failures in act, which was blocking our CI pipelines.

I decided to dig in and help out! I've created a PR (#6069) that adds the missing artifact-metadata permission to the workflow schema. The change is minimal and follows the existing pattern for other permissions.

Hope this helps get things moving! Let me know if there's anything else needed. 😊