Repository navigation
setup-python pip upgrade triggers root user warning on self-hosted runners #1295
Description
Problem
On root-user self-hosted runners (e.g. Hetzner Cloud), setup-python internally upgrades pip against the system Python outside any venv:
// src/find-python.ts — installPip()
`${pythonLocation}/python -m pip install --upgrade pip --disable-pip-version-check`This produces on every run:
WARNING: Running pip as the 'root' user can result in broken permissions...
Use the --root-user-action option if you know what you are doing.
The warning cannot be suppressed from the workflow side because setup-python spawns the pip subprocess via a Node.js child process with a controlled environment that does not reliably inherit the job-level PIP_ROOT_USER_ACTION env var or /etc/pip.conf.
Proposed Fix
Add --root-user-action=ignore to the pip upgrade call in src/find-python.ts:
await exec.exec(`${pythonLocation}/python`, [
'-m', 'pip', 'install', '--upgrade', 'pip',
'--root-user-action=ignore',
'--disable-pip-version-check',
'--no-warn-script-location'
]);This is a non-breaking, no-op change on non-root runners.
Reproduction
jobs:
test:
runs-on: self-hosted # root user (e.g. Hetzner Cloud ephemeral runner)
steps:
- uses: actions/setup-python@v6
with:
python-version: '3.12'Log output:
Upgrading pip...
WARNING: Running pip as the 'root' user...
Successfully installed pip-26.0.1
Environment
setup-python |
v6 |
| Runner OS | Ubuntu 24.04 |
| Runner user | root |
| Python version | 3.12 |
Activity
v-mahabaleshwars commentedon Mar 23, 2026
Hi @xgboosted,
Thank you for creating this issue. We will investigate it and provide feedback as soon as we have some updates.
v-priyagupta108 commentedon Apr 8, 2026
Hi @xgboosted, thank you for the detailed report.
The warning does not originate from
src/find-python.ts. TheinstallPip()function infind-python.tsonly runs when the pip-version: input is explicitly set. The"Upgrading pip..."line in your log is printed by thesetup.shscript bundled inside the pre-built Python tarball fromactions/python-versions, which runs during Python installation.The warning comes from
ensurepip’s internal pip subprocess. Suppression attempts likePIP_ROOT_USER_ACTION,--root-user-action=ignore, or/etc/pip.confdo not help here becauseensurepipstripsPIP_*environment variables and ignorespip.confbefore spawning pip by design. You can see this in CPython’sensurepip/__init__.py#L98-L107.Hope this clarifies the situation.
leofang commentedon Apr 8, 2026
@priyagupta108 yes, you're right about
ensurepipbeing the real cause. It took us quite a while to figure this out (NVIDIA/cuda-python#1879 (comment)).I think actions/python-versions#369 would be the correct fix (to avoid calling
ensurepipwhen possible). Could you help get it cross the finish line? 🙂xgboosted commentedon Apr 12, 2026
@priyagupta108 Can the suggestion made by @leofang be prioritized?
actions/python-versions#369
v-priyagupta108 commentedon May 13, 2026
Hello @xgboosted @leofang,
Thank you for your response. We’ve opened another PR actions/python-versions#392 with an alternative approach to address the warning from the
setup-pythonside by avoidingensurepipwhen possible.Please take a look when you have a chance, and let us know if there’s anything we should adjust.
xgboosted commentedon May 14, 2026
@priyagupta108, I left a review comment in the PR, please check it out and apply the fix to merge the PR.
v-priyagupta108 commentedon May 20, 2026
@xgboosted,
Thanks for the thorough review! You're absolutely right, this is a valid concern. I've addressed it in the latest commit by adding an explicit
$LASTEXITCODEcheck afterensurepip, so its failure surfaces with a dedicated error message rather than being misattributed to the pip install step. Please take another look when you get a chance.xgboosted commentedon May 21, 2026
@priyagupta108, please go ahead with releasing this!
v-priyagupta108 commentedon May 28, 2026
Hi! 👋
This has been addressed! The fix is merged into actions/python-versions as part of PR #392. New Python version binaries going forward will include this fix, resolving the root user warning on self-hosted runners.
Closing this issue now. Please feel free to reach out if you have any questions or need further assistance.
Thanks again for the detailed report and repro steps!