René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`setup-python` silently exits 0 when GitHub returns a truncated `versions-manifest.json`","articleBody":"**Description:**\nWhen `actions/setup-python` fetches `versions-manifest.json` from `actions/python-versions` and GitHub's API returns a truncated body, the action parses it as an empty release list and **exits 0 without installing Python**. The step is reported successful, and subsequent job steps run against whatever `python` happens to be on `PATH` (if any) - which makes the real cause harder to find.\n\n**Action version:**\nv6.2.0 (also affects earlier versions - the manifest-fetch logic is unchanged regarding such edge cases).\n\n**Platform:**\n- [x] Ubuntu\n- [x] macOS\n- [x] Windows\n\n**Runner type:**\n- [x] Hosted\n- [x] Self-hosted\n\n**Tools version:**\nAll Python versions - the failure is in the manifest fetch, before any version-specific logic runs.\n\n**Repro steps:**\nHard to reproduce on demand now that the upstream GitHub-side issue appears to be resolved, but here is what I saw last week:\n\n1. The action fetches the manifest in two calls:\n    - `GET https://api.github.com/repos/actions/python-versions/git/trees/main` to find the blob URL for `versions-manifest.json`.\n    - `GET \u003cthat blob URL\u003e` with `Accept: application/vnd.github.VERSION.raw` to get the manifest body.\n2. Sporadically, the second call returned a **truncated body** - HTTP 200, but the JSON was cut off mid-object and unparseable. **I captured 3 separate examples (attached - please see them at the bottom).**\n3. Two odd characteristics of the bad responses:\n    - A **~30 second server-side delay** before any bytes came back.\n    - Only reproduced on **authenticated** requests. Anonymous requests always returned the full manifest - but the 60 req/hour anon limit is too low for real CI use (authenticated is 5000/hour).\n\n**Expected behavior:**\nIf the manifest body is empty, truncated, or not a valid releases array, the action should **fail loudly** (**ideally after a few retries with backoff**), not exit 0 without installing Python. Suggested fix:\n\n1. After fetching, validate that the body parses as JSON **and** is a non-empty array of releases.\n2. Retry with backoff on failure - these truncations were intermittent and a retry would almost certainly succeed.\n3. If retries are exhausted, `core.setFailed()` with a clear \"manifest fetch/parse failed\" message.\n\n**Actual behavior:**\nA truncated manifest response is silently swallowed: it does not install Python, and exits 0. The job continues against the system `python` (or fails much later in a confusing way), and there is no signal in the `setup-python` step that anything went wrong.\n```\n* Installed versions\n  ##[debug]Semantic version spec of 3.11 - 3.13 is 3.11 - 3.13\n  ##[debug]isExplicit: \n  ##[debug]explicit? false\n  ##[debug]evaluating 0 versions\n  ##[debug]match not found\n  Version 3.11 - 3.13 was not found in the local cache\n  ##[debug]Getting manifest from actions/python-versions@main\n  ##[debug]set auth\n  ##[debug]Node Action run completed with exit code 0\n  ##[debug]Finishing: Setup python\n```\n\n**Captured truncated `versions-manifest.json` from last week:**\n[20260522T135554Z-manifest.json](https://github.com/user-attachments/files/28303804/20260522T135554Z-manifest.json)\n[20260522T134810Z-manifest.json](https://github.com/user-attachments/files/28303802/20260522T134810Z-manifest.json)\n[20260522T125459Z-manifest.json](https://github.com/user-attachments/files/28303803/20260522T125459Z-manifest.json)","author":{"url":"https://github.com/zdravko-axelera","@type":"Person","name":"zdravko-axelera"},"datePublished":"2026-05-27T10:24:34.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/1318/setup-python/issues/1318"}