Schema validation errors, but the Extension reports no problems

[igc-jva]

Bug report info

act version:            0.2.84
GOOS:                   windows
GOARCH:                 amd64
NumCPU:                 20
Docker host:            tcp://127.0.0.1:2375
Sockets found:
Config files:
        C:\Users\JVA\AppData\Local\act\actrc:
                -P ubuntu-latest=catthehacker/ubuntu:act-latest
                -P ubuntu-22.04=catthehacker/ubuntu:act-22.04
                -P ubuntu-20.04=catthehacker/ubuntu:act-20.04
                -P ubuntu-18.04=catthehacker/ubuntu:act-18.04
Build info:
        Go version:            go1.24.0
        Module path:           github.com/nektos/act
        Main version:          v0.2.84+dirty
        Main path:             github.com/nektos/act
        Main checksum:
        Build settings:
                -buildmode:           exe
                -compiler:            gc
                -trimpath:            true
                CGO_ENABLED:          0
                GOARCH:               amd64
                GOOS:                 windows
                GOAMD64:              v1
                vcs:                  git
                vcs.revision:         5668308bac0d256c8a4c3aa1467d2ebcb55bc717
                vcs.time:             2025-02-01T14:37:09Z
                vcs.modified:         true
Docker Engine:
        Engine version:        29.3.0
        Engine runtime:        runc
        Cgroup version:        2
        Cgroup driver:         systemd
        Storage driver:        overlayfs
        Registry URI:          https://index.docker.io/v1/
        OS:                    Arch Linux
        OS type:               linux
        OS version:
        OS arch:               x86_64
        OS kernel:             6.6.87.2-microsoft-standard-WSL2
        OS CPU:                20
        OS memory:             31923 MB
        Security options:
                name=seccomp,profile=builtin
                name=cgroupns

Command used with act

act --workflows ".github/workflows/release-published.yml" --secret-file "" --var-file "" --input-file "" --eventpath "" --container-daemon-socket "tcp://127.0.0.1:2375" --artifact-server-path "./artifacts"

Describe issue

When running the above command, I get the following output:

Using docker host 'tcp://127.0.0.1:2375', and daemon socket 'tcp://127.0.0.1:2375'
Error: workflow is not valid. 'release-published.yml': Line: 17 Column 3: Failed to match permissions-mapping: Line: 20 Column 3: Unknown Property artifact-metadata
Line: 17 Column 3: Failed to match permission-level-shorthand-read-all: Line: 17 Column 3: Expected a scalar got mapping
Line: 17 Column 3: Failed to match permission-level-shorthand-write-all: Line: 17 Column 3: Expected a scalar got mapping
Line: 217 Column 5: Failed to match job-factory: Line: 258 Column 9: Failed to match run-step: Line: 259 Column 9: Unknown Property uses
Line: 260 Column 9: Unknown Property with
Line: 258 Column 9: Failed to match regular-step: Line: 261 Column 23: Unknown Function Call case
Line: 217 Column 5: Failed to match workflow-job: Line: 218 Column 5: Unknown Property runs-on
Line: 220 Column 5: Unknown Property environment
Line: 225 Column 5: Unknown Property steps
Actions YAML Schema Validation Error detected:
For more information, see: https://nektosact.com/usage/schema.html

Release Published Delivery #3 exited with exit code 1.

I checked the schema URL and I am using the Local actions extension, but it does not report any problems for the file. I've attached the pipeline in question.

Link to GitHub repository

No response

Workflow content

name: Release Published Delivery

on:
  release:
    types:
      - published

concurrency:
  group: release-published-${{ github.event.release.tag_name }}
  cancel-in-progress: false

env:
  DOTNET_VERSION: '9.0.x'
  SOLUTION_PATH: src/IGC.Transit.slnx

permissions:
  contents: write
  actions: read
  checks: write
  artifact-metadata: read
  packages: write

jobs:
  release-setup:
    name: Validate Release Context
    runs-on: ubuntu-latest
    if: ${{ !github.event.release.prerelease }}
    outputs:
      version: ${{ steps.version.outputs.version }}
      assembly_version: ${{ steps.version.outputs.assembly_version }}
      release_tag: ${{ steps.version.outputs.release_tag }}
      release_commit: ${{ steps.version.outputs.release_commit }}
    steps:
      - name: Checkout released tag commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: refs/tags/${{ github.event.release.tag_name }}

      - name: Parse and validate release version
        id: version
        run: |
          RELEASE_TAG="${{ github.event.release.tag_name }}"
          VERSION_FROM_TAG="${RELEASE_TAG#v}"

          if [[ ! "$VERSION_FROM_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Release tag must be semantic version format vX.Y.Z or X.Y.Z. Got: ${RELEASE_TAG}" >&2
            exit 1
          fi

          MAJOR=$(grep 'major:' version.yaml | awk '{print $2}')
          MINOR=$(grep 'minor:' version.yaml | awk '{print $2}')
          PATCH=$(grep 'patch:' version.yaml | awk '{print $2}')
          VERSION_FROM_FILE="${MAJOR}.${MINOR}.${PATCH}"

          if [[ "$VERSION_FROM_TAG" != "$VERSION_FROM_FILE" ]]; then
            echo "Release tag version (${VERSION_FROM_TAG}) does not match version.yaml (${VERSION_FROM_FILE})." >&2
            exit 1
          fi

          ASSEMBLY_VERSION="${VERSION_FROM_FILE}.0"
          RELEASE_COMMIT=$(git rev-parse HEAD)

          echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
          echo "release_commit=${RELEASE_COMMIT}" >> $GITHUB_OUTPUT
          echo "version=${VERSION_FROM_FILE}" >> $GITHUB_OUTPUT
          echo "assembly_version=${ASSEMBLY_VERSION}" >> $GITHUB_OUTPUT

          {
            echo "## Release Context"
            echo "- Release tag: ${RELEASE_TAG}"
            echo "- Checked out commit: ${RELEASE_COMMIT}"
            echo "- Version: ${VERSION_FROM_FILE}"
            echo "- Assembly Version: ${ASSEMBLY_VERSION}"
          } >> $GITHUB_STEP_SUMMARY

  build:
    name: Restore, Build, Test, and Pack
    runs-on: ubuntu-latest
    needs: release-setup
    steps:
      - name: Checkout released tag commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: refs/tags/${{ needs.release-setup.outputs.release_tag }}

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json', '**/Directory.Packages.props') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore ${{ env.SOLUTION_PATH }}

      - name: Build solution
        run: |
          dotnet build ${{ env.SOLUTION_PATH }} \
            --configuration Release \
            --no-restore \
            -p:Version=${{ needs.release-setup.outputs.version }} \
            -p:AssemblyVersion=${{ needs.release-setup.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.release-setup.outputs.assembly_version }}

      - name: Run tests
        run: |
          dotnet test ${{ env.SOLUTION_PATH }} \
            --configuration Release \
            --no-build \
            --verbosity normal \
            --logger "trx" \
            || true

      - name: Publish Test Results
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: (!cancelled())
        with:
          files: src/IGC.*.Tests/**/*.trx

      - name: Pack IGC.Transit.BLL NuGet package
        run: |
          dotnet pack src/IGC.Transit.BLL/IGC.Transit.BLL.csproj \
            --configuration Release \
            --no-build \
            --output ./packages \
            -p:PackageVersion=${{ needs.release-setup.outputs.version }} \
            -p:Version=${{ needs.release-setup.outputs.version }} \
            -p:AssemblyVersion=${{ needs.release-setup.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.release-setup.outputs.assembly_version }}

      - name: Upload NuGet package artifact
        uses: actions/upload-artifact@v4
        with:
          name: IGC.Transit.BLL-${{ needs.release-setup.outputs.version }}-nupkg
          path: ./packages/*.nupkg
          retention-days: 90

  publish-dotnet:
    name: Publish and Package .NET Artifacts
    runs-on: ubuntu-latest
    needs: [release-setup, build]
    strategy:
      matrix:
        include:
          - project_name: IGC.Transit.Api
            project_path: src/IGC.Transit.Api/IGC.Transit.Api.csproj
            runtime: linux-x64
          - project_name: IGC.Transit.Api
            project_path: src/IGC.Transit.Api/IGC.Transit.Api.csproj
            runtime: win-x64
          - project_name: IGC.Transit.Workers
            project_path: src/IGC.Transit.Workers/IGC.Transit.Workers.csproj
            runtime: linux-x64
          - project_name: IGC.Transit.Workers
            project_path: src/IGC.Transit.Workers/IGC.Transit.Workers.csproj
            runtime: win-x64
    steps:
      - name: Checkout released tag commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: refs/tags/${{ needs.release-setup.outputs.release_tag }}

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json', '**/Directory.Packages.props') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore ${{ env.SOLUTION_PATH }}

      - name: Publish ${{ matrix.project_name }} (${{ matrix.runtime }})
        run: |
          OUTPUT_DIR="./publish/${{ matrix.project_name }}-${{ matrix.runtime }}"
          dotnet publish ${{ matrix.project_path }} \
            --configuration Release \
            --runtime ${{ matrix.runtime }} \
            --self-contained false \
            --output "$OUTPUT_DIR" \
            -p:Version=${{ needs.release-setup.outputs.version }} \
            -p:AssemblyVersion=${{ needs.release-setup.outputs.assembly_version }} \
            -p:FileVersion=${{ needs.release-setup.outputs.assembly_version }}

          rm -f "$OUTPUT_DIR/appsettings.Development.json"

      - name: Zip ${{ matrix.project_name }} (${{ matrix.runtime }})
        run: |
          mkdir -p ./release-assets
          ASSET_NAME="${{ matrix.project_name }}-${{ needs.release-setup.outputs.version }}-${{ matrix.runtime }}.zip"
          cd ./publish
          zip -r "../release-assets/${ASSET_NAME}" "${{ matrix.project_name }}-${{ matrix.runtime }}"

      - name: Upload packaged .NET artifact (${{ matrix.project_name }} ${{ matrix.runtime }})
        uses: actions/upload-artifact@v4
        with:
          name: release-asset-${{ matrix.project_name }}-${{ matrix.runtime }}
          path: ./release-assets/*.zip
          retention-days: 90

  publish-docker:
    name: Publish Docker Images
    runs-on: ubuntu-latest
    needs: release-setup
    environment:
      name: Production
    strategy:
      matrix:
        container: [api, worker]
    steps:
      - name: Checkout released tag commit
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          ref: refs/tags/${{ needs.release-setup.outputs.release_tag }}

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/transit-${{ matrix.container }}
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}},value=${{ needs.release-setup.outputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ needs.release-setup.outputs.version }}
            type=semver,pattern={{major}},value=${{ needs.release-setup.outputs.version }}
            type=sha
            type=raw,value=latest

      - name: Build and publish ${{ matrix.container }} docker
        uses: docker/build-push-action@v6
        with:
          build-args: |
            VERSION=${{ needs.release-setup.outputs.version }}
            ASSEMBLY_VERSION=${{ needs.release-setup.outputs.assembly_version }}
            APP_NAME=${{ format('IGC.Transit.{0}', case(matrix.container == 'api', 'Api', matrix.container == 'worker', 'Workers', 'Api')) }}
            ENVIRONMENT=Production
          context: .
          file: ./docker/Dockerfile
          target: ${{ matrix.container }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  publish-nuget:
    name: Publish NuGet Package
    runs-on: ubuntu-latest
    needs: [release-setup, build]
    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Download NuGet package artifact
        uses: actions/download-artifact@v4
        with:
          name: IGC.Transit.BLL-${{ needs.release-setup.outputs.version }}-nupkg
          path: ./nuget

      - name: NuGet setup
        run: |
          dotnet nuget add source --name github "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json" --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} --store-password-in-clear-text

      - name: Publish NuGet Package
        run: |
          for nupkg in ./nuget/*.nupkg; do
            echo "Publishing $nupkg to GitHub Packages"
            dotnet nuget push "$nupkg" --source github --skip-duplicate
          done

  upload-release-assets:
    name: Upload Assets to Published Release
    runs-on: ubuntu-latest
    needs: [release-setup, publish-dotnet, publish-nuget, publish-docker]
    steps:
      - name: Download NuGet package artifact
        uses: actions/download-artifact@v4
        with:
          name: IGC.Transit.BLL-${{ needs.release-setup.outputs.version }}-nupkg
          path: ./release-assets

      - name: Download packaged .NET artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: release-asset-*
          merge-multiple: true
          path: ./release-assets

      - name: List release assets
        run: ls -la ./release-assets

      - name: Upload assets to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ needs.release-setup.outputs.release_tag }}" \
            ./release-assets/*.nupkg \
            ./release-assets/*.zip \
            --clobber

Relevant log output

Handling container host and socket
Using docker host 'tcp://127.0.0.1:2375', and daemon socket 'tcp://127.0.0.1:2375'
Loading environment from d:\repos\IGC.Transit\.env
Conditional GET for notices etag=6bd2730d-d9d9-4c84-8568-57551142e957
Loading action inputs from
Loading secrets from
Loading vars from
Evaluated matrix inclusions: map[]
Loading workflow 'd:\repos\IGC.Transit\.github\workflows\release-published.yml'
Reading workflow 'd:\repos\IGC.Transit\.github\workflows\release-published.yml'
Error: workflow is not valid. 'release-published.yml': Line: 17 Column 3: Failed to match permissions-mapping: Line: 20 Column 3: Unknown Property artifact-metadata
Line: 17 Column 3: Failed to match permission-level-shorthand-read-all: Line: 17 Column 3: Expected a scalar got mapping
Line: 17 Column 3: Failed to match permission-level-shorthand-write-all: Line: 17 Column 3: Expected a scalar got mapping
Line: 217 Column 5: Failed to match job-factory: Line: 258 Column 9: Failed to match run-step: Line: 259 Column 9: Unknown Property uses
Line: 260 Column 9: Unknown Property with
Line: 258 Column 9: Failed to match regular-step: Line: 261 Column 23: Unknown Function Call case
Line: 217 Column 5: Failed to match workflow-job: Line: 218 Column 5: Unknown Property runs-on
Line: 220 Column 5: Unknown Property environment
Line: 225 Column 5: Unknown Property steps
Actions YAML Schema Validation Error detected:
For more information, see: https://nektosact.com/usage/schema.html

Release Published Delivery #4 exited with exit code 1.

Additional information

No response

[ChristopherHX]

Unknown Function Call case

case function is not supported in nektos/act see #6006

[ChristopherHX]

artifact-metadata: read

This is not supported by act as well, schema is out of date

[igc-jva]

Any idea when the schema will be updated? I was really looking forward to being able to test locally, but all the workflows use these, so from what I gather, it means I cannot use act for now?

[ChristopherHX]

all the workflows use these

I never used artifact-metadata anywhere, it's 1-2 Months old. For actions/artifacts it is not needed, for release uploads also not.

Does your workflow really depends on artifact-metadata: read?

Any idea when the schema will be updated?

Out of my control, I / you could propose an update: The upstream file of the vscode extension is this one https://github.com/actions/languageservices/blob/main/workflow-parser/src/workflow-v1.0.json, replace the workflow-v1.0.json from the act code and done.

[igc-jva]

I have a workflow that downloads artifacts from another workflow using the github CLI. It needs that permission for the CLI, since the contents permission is now depricated.

[ChristopherHX]

I have a workflow that downloads artifacts from another workflow using the github CLI

I expected that this would need actions: read, if this is a normal actions artifact. Hmm.

[jonahbeckford]

https://github.com/actions/attest?tab=readme-ov-file#usage requires artifact-metadata: write. Basically anyone who follows GitHub's SLSA attestation documentation.