Repository navigation
[Reliability] Eliminate harden-runner systemd obsolete-syslog warning #2103
Description
Verified runtime warning
Protected .github/main@cb0872c9a20d5584703dffacca65c096fc034c6c CodeQL dispatch run 34672376954 for ContextualWisdomLab/accounting-information-platform#59@633acf3d5259ede2f5b987ce34163a021a9ad649 emits systemd warnings stating Standard output type syslog is obsolete from the Step Security runner-agent service.
This is infrastructure/runtime output from the harden-runner agent path, not an accounting-information-platform product-source finding. It must not be suppressed, ignored, or copied into consumer repositories as a workaround.
Ownership and constraints
Central .github owns the reusable workflow/action integration. The underlying service-unit content may be emitted by the pinned step-security/harden-runner action/runtime rather than by repository-authored systemd source; verify that boundary before changing code.
Do not:
- filter the warning text from logs;
- redirect or discard stderr to make the run appear clean;
- add consumer-repository workarounds;
- replace immutable action pins with floating tags;
- weaken harden-runner/network/security policy; or
- treat an upstream/runtime-origin warning as permission for unrelated source churn.
Acceptance
- Reproduce the warning on an exact protected-central or exact candidate head and capture the workflow/job/action identity that creates the service unit.
- Identify the actual service-unit source and the deprecated systemd directive. Distinguish repository-authored configuration from Step Security/upstream-generated runtime configuration.
- If a reviewed upstream harden-runner release fixes the unit, update the central immutable action pin through the existing dependency/workflow owner stack and retain all security semantics. If no fixed release exists, file/link an upstream owner issue and keep this issue open with exact evidence rather than suppressing the warning locally.
- Add a bounded regression/acceptance check where central ownership permits one, so the obsolete
StandardOutput=syslog/equivalent service configuration cannot silently return. - Prove an exact-head workflow generation completes without this warning while existing harden-runner/security behavior remains GREEN.
- Keep documentation/ADR/CHANGELOG current if the selected action/runtime contract changes.
This issue is independent of the current CodeQL status-publication / Actions-rerun / receiver-before-dispatch defect on #2040; both can occur in the same run, but neither should be used to mask the other.
Refs #2040 and protected dispatch run 34672376954.
Activity
seonghobae commentedon Sep 12, 2026
Fresh owner inventory found an existing dependency writer: #2021 (
build(deps): bump step-security/harden-runner from 2.20.0 to 2.21.1) is open, Ready, mechanically mergeable, and exact0fbe77f33368067bbfc8936b238b0d54e180ab5bon current protectedmain@cb0872c9a20d5584703dffacca65c096fc034c6c. Do not open a competing harden-runner pin branch.Protected-central workflows are not uniform today: several current-main workflows already pin harden-runner
b09bb98e06d4d774595224525879c09bc6e98c40(v2.20.1), while at leastrepository-metadata-reconcile.ymlstill carriesbf7454d06d71f1098171f2acdf0cd4708d7b5920(v2.20.0). Upstream's latest immutable GitHub release isv2.21.1(published 2026-08-30). Its release notes mention agent/runtime and self-hosted fixes but do not identify this obsolete-syslog warning specifically, so #2021 is a candidate remediation path, not evidence that the warning is fixed.Acceptance for this issue should therefore use #2021/current successor as the existing version-owner lane where applicable: verify an exact #2021/current-successor workflow run that actually instantiates the Step Security agent, check whether the obsolete-syslog warning disappears under
v2.21.1, and preserve current hardening semantics. If the warning remains, keep #2103 open and escalate to the upstream runtime owner instead of adding another central dependency branch.seonghobae commentedon Sep 12, 2026
Fresh consumer reproduction from
ContextualWisdomLab/naruon#1486@17545a18f3a899eb81852b498bd349e44544f33b: Application CI backend job103626907511emits the same Step Security/systemd diagnostic,Standard output type syslog is obsolete, automatically updating to journal, while the product backend itself completes GREEN (full Alembic chain, Ruff, 2,016 passed / 2 skipped; root governance 2 passed).This confirms #2103 remains a reusable central/upstream harden-runner runtime issue rather than a Naruon product-source defect. Naruon is not suppressing or locally patching the warning.
seonghobae commentedon Sep 15, 2026
Fresh reproduction on the product-performance attestation owner stack: #2166 predecessor exact
759c51f7544fc8176f53ed947370210d0f596815, Product Performance Attestation Quality CI run34967146861, job104374204483on GitHub-hostedubuntu-24.04, emitted systemd twice:Standard output type syslog is obsolete, automatically updating to journalfor/etc/systemd/system/agent.servicelines 9 and 10 during Step Security harden-runner initialization. The same job identifiesstep-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920; repository-owned product-performance code does not create that service unit. No local suppression/workaround was added. This remains an upstream/central action-runtime warning under #2103 and must stay open until the existing acceptance criteria prove a warning-free immutable-pinned owner path.