René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`setup-python` pip upgrade triggers root user warning on self-hosted runners","articleBody":"## Problem\n\nOn root-user self-hosted runners (e.g. Hetzner Cloud), `setup-python` internally upgrades pip against the **system Python** outside any venv:\n\n```typescript\n// src/find-python.ts — installPip()\n`${pythonLocation}/python -m pip install --upgrade pip --disable-pip-version-check`\n```\n\nThis produces on every run:\n\n```\nWARNING: Running pip as the 'root' user can result in broken permissions...\nUse the --root-user-action option if you know what you are doing.\n```\n\nThe warning **cannot be suppressed** from the workflow side because `setup-python` spawns the pip subprocess via a Node.js child process with a controlled environment that does not reliably inherit the job-level `PIP_ROOT_USER_ACTION` env var or `/etc/pip.conf`.\n\n## Proposed Fix\n\nAdd `--root-user-action=ignore` to the pip upgrade call in `src/find-python.ts`:\n\n```typescript\nawait exec.exec(`${pythonLocation}/python`, [\n  '-m', 'pip', 'install', '--upgrade', 'pip',\n  '--root-user-action=ignore',\n  '--disable-pip-version-check',\n  '--no-warn-script-location'\n]);\n```\n\nThis is a **non-breaking, no-op change** on non-root runners.\n\n## Reproduction\n\n```yaml\njobs:\n  test:\n    runs-on: self-hosted  # root user (e.g. Hetzner Cloud ephemeral runner)\n    steps:\n      - uses: actions/setup-python@v6\n        with:\n          python-version: '3.12'\n```\n\n**Log output:**\n```\nUpgrading pip...\nWARNING: Running pip as the 'root' user...\nSuccessfully installed pip-26.0.1\n```\n\n## Environment\n\n| | |\n|---|---|\n| `setup-python` | `v6` |\n| Runner OS | Ubuntu 24.04 |\n| Runner user | `root` |\n| Python version | `3.12` |\n\n","author":{"url":"https://github.com/xgboosted","@type":"Person","name":"xgboosted"},"datePublished":"2026-03-21T13:19:14Z","url":"https://github.com/actions/setup-python/issues/1295"}