issues with CICD (github actions) and repair-file-permissions

[straa007]

Our CICD pipelines use
oci setup repair-file-permissions --file ~/.oci/config
oci setup repair-file-permissions --file ~/.oci/key.pem

to make sure our permissions on our ephemeral runners can log into OCI.

this morning (2/4) after the release of cli version (3.51.6) the repair-file-permissions started throwing

Traceback (most recent call last):
File "/home/runner/bin/oci", line 8, in
sys.exit(cli())
^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1128, in call
return self.main(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1053, in main
rv = self.invoke(ctx)
^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1656, in invoke
super().invoke(ctx)
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1395, in invoke
return ctx.invoke(self.callback, **ctx.params)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 754, in invoke
return __callback(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/decorators.py", line 26, in new_func
return f(get_current_context(), *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 521, in cli
check_key_for_security(auth, config_file, profile)
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 569, in check_key_for_security
if key_file and not validate_label_private_key(key_file):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 581, in validate_label_private_key
with open(file_path, "r") as file:
^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '~/.oci/key.pem'

Changing our runner to use 3.51.5 resolves the error.

[tadscottsmith]

We are seeing the same thing. This ran fine yesterday.

Run oci setup repair-file-permissions --file ~/.oci/config
Traceback (most recent call last):
  File "/home/runner/bin/oci", line 8, in <module>
    sys.exit(cli())
             ^^^^^
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1128, in __call__
    return self.main(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 10[5](https://github.com/redacted/oci-deployment/actions/runs/13143468636/job/36675909202#step:6:6)3, in main
    rv = self.invoke(ctx)
         ^^^^^^^^^^^^^^^^
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1[6](https://github.com/redacted/oci-deployment/actions/runs/13143468636/job/36675909202#step:6:7)56, in invoke
    super().invoke(ctx)
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1395, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line [7](https://github.com/redacted/oci-deployment/actions/runs/13143468636/job/36675909202#step:6:8)54, in invoke
    return __callback(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/decorators.py", line 26, in new_func
    return f(get_current_context(), *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 521, in cli
    check_key_for_security(auth, config_file, profile)
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 569, in check_key_for_security
    if key_file and not validate_label_private_key(key_file):
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 5[8](https://github.com/redacted/oci-deployment/actions/runs/13143468636/job/36675909202#step:6:9)1, in validate_label_private_key
    with open(file_path, "r") as file:
         ^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '~/.oci/key.pem'
Error: Process completed with exit code 1.

As mentioned above, reverting to 3.51.5 in our runners completes successfully.

./install.sh --oci-cli-version 3.51.5 --accept-all-defaults

[GanziDaeyong]

same here. I worked around the issue by setting 'SUPPRESS_LABEL_WARNING' to True.
cc. @designDefined

[anup-21]

The error you're encountering, FileNotFoundError: [Errno 2] No such file or directory: '~/.oci/key.pem', indicates that the oci setup repair-file-permissions command is looking for the private key file (key.pem) in the ~/.oci/ directory but is unable to find it. I tried the same command on the same cli-version 3.51.6 and it was working for me , from the upgrade in 3.51.6 you will only get the warning messages but in your case the key-file which is mentioned in ~/.oci/config is missing.

[straa007]

So I took the same pipeline (snippet below) pinned to 3.51.5 and it runs just fine, notice the compartment list in test cli.

  - name: 'Install OCI CLI'
    run: |
     curl -L -O https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh 
     chmod +x install.sh
     ./install.sh --accept-all-defaults --oci-cli-version 3.51.5
     echo "/home/runner/bin" >> $GITHUB_PATH
     exec -l $SHELL
  - name: 'test oci cli'
    run: oci iam compartment list
  - name: 'Fix OCI Config File Permissions'
    run: |
      oci setup repair-file-permissions --file /home/runner/.oci/config
      oci setup repair-file-permissions --file /home/runner/.oci/key.pem

Revised it to:
- name: 'Install OCI CLI'
run: |
curl -L -O https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh
chmod +x install.sh
./install.sh --accept-all-defaults --oci-cli-version 3.51.6
echo "/home/runner/bin" >> $GITHUB_PATH
exec -l $SHELL
- name: 'test oci cli'
run: oci iam compartment list
- name: 'Fix OCI Config File Permissions'
run: |
oci setup repair-file-permissions --file /home/runner/.oci/config
oci setup repair-file-permissions --file /home/runner/.oci/key.pem

and now the test of the oci cli
Run oci iam compartment list
Traceback (most recent call last):
File "/home/runner/bin/oci", line 8, in
sys.exit(cli())
^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1128, in call
return self.main(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1053, in main
rv = self.invoke(ctx)
^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1656, in invoke
super().invoke(ctx)
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 1395, in invoke
return ctx.invoke(self.callback, **ctx.params)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/core.py", line 754, in invoke
return __callback(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/click/decorators.py", line 26, in new_func
return f(get_current_context(), *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 521, in cli
check_key_for_security(auth, config_file, profile)
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 569, in check_key_for_security
if key_file and not validate_label_private_key(key_file):
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/runner/lib/oracle-cli/lib/python3.12/site-packages/oci_cli/cli_root.py", line 581, in validate_label_private_key
with open(file_path, "r") as file:
^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '~/.oci/key.pem'

So same pipeline with one character change in version from .5 to .6 givs different results points to it being an issue with the version and not with the pem file being missing.

[straa007]

same here. I worked around the issue by setting 'SUPPRESS_LABEL_WARNING' to True. cc. @designDefined

yes reviewing the code that looks like a reasonable approach to the undocumented change in cli_root.py

[anup-21]

This issue is fixed in version 3.51.7