Repository navigation
Bandit CI check broken: PyCQA/bandit-action@v1 requires Python 3.8, unavailable on Ubuntu 26.04 #3141
Description
What happened
On PR #3140, the bandit check failed in 7 seconds. The log shows PyCQA/bandit-action@v1 calls actions/setup-python@v5 with python-version: 3.8, which errors: "The version '3.8' with architecture 'x64' was not found for Ubuntu 26.04." This is not specific to this PR — the last 10 bandit runs across all branches (main, release/0.6, feature branches) all fail with the same error. The check has been persistently broken, producing a permanent red CI signal on every PR.
What could go better
A perpetually failing CI check desensitizes developers and agents to CI failures, making it harder to trust CI signals as a quality gate. This also blocks agent autonomy — an agent cannot rely on bandit as a security signal when it always fails regardless of code content. High confidence: the root cause is confirmed from the error log and is a known incompatibility between PyCQA/bandit-action@v1 and Ubuntu 26.04 runners (Python 3.8 EOL and no longer shipped).
Proposed change
Update .github/workflows/bandit.yaml to fix the Python version incompatibility. Recommended approach: replace PyCQA/bandit-action@v1 with a direct uv run bandit -r src/ invocation (the project already has bandit in its dependencies), avoiding the external action's hardcoded Python 3.8 entirely. Alternative: pin the runner to ubuntu-24.04 as a temporary workaround, or pin to a newer bandit-action release that supports current Python versions.
Validation criteria
The bandit check should pass (or fail only on genuine security findings) on the next 3 PRs after the fix. Verify on both main and release/0.6 branches.
Related issues checked
Searched: bandit repo:lightspeed-core/lightspeed-stack is:issue; bandit python 3.8 ubuntu repo:fullsend-ai/fullsend repo:fullsend-ai/agents repo:lightspeed-core/lightspeed-stack is:issue; bandit-action repo:lightspeed-core/lightspeed-stack is:issue; python 3.8 ubuntu repo:lightspeed-core/lightspeed-stack is:issue
No overlapping issues found.
Generated by retro agent from #3140
Activity
fullsend-ai-triage commentedon Nov 3, 2026
🤖 Finished Triage · ✅ Success · Started 4:24 PM UTC · Completed 4:27 PM UTC
Commit:
06b5567· View workflow run →Runtime: pi · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.08
fullsend-ai-triage commentedon Nov 3, 2026
Triage Summary
Severity: High — every PR has a permanently red bandit check, eroding CI trust.
Root cause confirmed:
PyCQA/bandit-action@v1hardcodes Python 3.8 viaactions/setup-python@v5, but Ubuntu 26.04 runners no longer ship Python 3.8.The project already has
bandit>=1.8.6inpyproject.toml, so the recommended fix — replacing the external action with a directuv run bandit -r src/invocation — is straightforward.⚠ Workflow file change required: The fix targets
.github/workflows/bandit.yaml, which is a CI workflow file. The code agent cannot modify workflow files under current permissions. Manual intervention (a human-authored PR) is required to land this fix.Related: Issue #3142 reports a similar runner-compatibility problem in the
build-prworkflow (qemu-user-staticunavailable on Ubuntu 26.04). Both are independent but share the same root cause pattern (Ubuntu 26.04 runner incompatibility).Next steps:
/fs-code— agent creates a PR to implement this issue/fs-code <your instruction>— agent implements with your specific guidance