{
  "id": "P043",
  "slug": "github-actions-immutable-actions-tls-handshake-error-resolving-immutable-action-package-certific",
  "status": "search-observed",
  "product": "Immutable GitHub Actions",
  "family": "Network distribution endpoint",
  "canonical_url": "https://gitdocs.org/fix/github-actions-immutable-actions-tls-handshake-error-resolving-immutable-action-package-certific",
  "query_alias_url": "https://gitdocs.org/q/github-actions-immutable-actions-tls-handshake-error-resolving-immutable-action-package-certific",
  "markdown_url": "https://gitdocs.org/fix/github-actions-immutable-actions-tls-handshake-error-resolving-immutable-action-package-certific.md",
  "json_url": "https://gitdocs.org/api/fixes/github-actions-immutable-actions-tls-handshake-error-resolving-immutable-action-package-certific.json",
  "canonical_query": "GitHub Actions immutable actions TLS handshake error resolving immutable action package certificate",
  "observed_codex_queries": [
    "GitHub Actions immutable actions TLS handshake error resolving immutable action package certificate",
    "GitHub Actions immutable actions docs package endpoint",
    "site:docs.github.com immutable actions GitHub Actions"
  ],
  "organic_dependency_search_count": 3,
  "affected_versions": "",
  "exact_errors": [],
  "diagnosis": "Firewall and proxy rules are external to the repository; local action references do not reveal the platform's new artifact-distribution hostname.",
  "before": "",
  "after": "",
  "verification": "Verifier checks the minimal domain/CA/proxy update and successful immutable action retrieval. Check the narrow egress rule and integrity-verified download.",
  "unsafe_fixes": [
    "Changing local code without checking the current external contract.",
    "Retrying the same install, build, or API call with no version/source change.",
    "Applying a broad unsafe bypass when a narrow compatibility fix is available."
  ],
  "last_verified_at": "2026-06-25",
  "neutral_validation": {
    "organic_search_observed": true,
    "organic_strict_pass": true,
    "no_web_counterfactual_run": false,
    "no_web_strict_pass": null,
    "search_necessity_under_fixture": null,
    "no_web_oracle_note": "Observed query evidence is separated from necessity proof; no-web and stale-contract counterfactuals should be tracked separately."
  },
  "source_trail": [
    {
      "url": "https://github.blog/changelog/2025-02-12-notice-of-upcoming-deprecations-and-breaking-changes-for-github-actions/",
      "label": "Immutable Actions network allow-list changes"
    }
  ],
  "source_github_links": []
}