Network distribution endpoint
GitHub Actions immutable actions TLS handshake error resolving immutable action package certificate
The runner reports a TLS handshake error only when resolving an immutable action.
Agent Quick Fix
Repair against the current Immutable GitHub Actions contract, then keep the change narrow and source-backed.
Product: Immutable GitHub Actions
Current-contract area: TLS inspection proxy rejects immutable action package certificate
Likely root cause: The runner reports a TLS handshake error only when resolving an immutable action.
Repair direction: Verifier checks the minimal domain/CA/proxy update and successful immutable action retrieval. Check the narrow egress rule and integrity-verified download.Symptom
The runner reports a TLS handshake error only when resolving an immutable action.
Why This Happens
Firewall and proxy rules are external to the repository; local action references do not reveal the platform's new artifact-distribution hostname.
Common Wrong Fixes
- Changing local code without checking the current external contract.
- Retrying the same install, build, or API call with no version/source change.
- Applying a broad unsafe bypass when a narrow compatibility fix is available.
Codex Search Keywords
These are the search terms observed in a neutral Codex validation run for this failure shape.
GitHub Actions immutable actions TLS handshake error resolving immutable action package certificate
GitHub Actions immutable actions docs package endpoint
site:docs.github.com immutable actions GitHub Actions