Seeing occasional `Forbidden (403)` errors when running `wsl.exe --update`

[devversion]

Hi there, thanks for this nice action! Great work!

I wanted to report an issue, and also see if others/you potentially saw a similar issue with GitHub's Windows runners. Note that I only saw this once now of many runs. Looks like a flake somehow:

  ]C:\Windows\system32\wsl.exe --update
  Forbidden (403).
  
  
  ::debug::Error: The process 'C:\Windows\system32\wsl.exe' failed with exit code 4294967295%0A    at ExecState._setResult (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:592:1)%0A    at ExecState.CheckComplete (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:575:1)%0A    at ChildProcess.<anonymous> (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:469:1)%0A    at ChildProcess.emit (node:events:519:28)%0A    at maybeClose (node:internal/child_process:1105:16)%0A    at Process.ChildProcess._handle.onexit (node:internal/child_process:305:5)%0A
  Failure happened, retrying (The process 'C:\Windows\system32\wsl.exe' failed with exit code 4294967295)
  C:\Windows\system32\wsl.exe --update
  Forbidden (403).
  
  
  ::debug::Error: The process 'C:\Windows\system32\wsl.exe' failed with exit code 4294967295%0A    at ExecState._setResult (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:592:1)%0A    at ExecState.CheckComplete (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:575:1)%0A    at ChildProcess.<anonymous> (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:469:1)%0A    at ChildProcess.emit (node:events:519:28)%0A    at maybeClose (node:internal/child_process:1105:16)%0A    at Process.ChildProcess._handle.onexit (node:internal/child_process:305:5)%0A
  Failure happened, retrying (The process 'C:\Windows\system32\wsl.exe' failed with exit code 4294967295)
  C:\Windows\system32\wsl.exe --update
  Forbidden (403).
  
  
  ::debug::Error: The process 'C:\Windows\system32\wsl.exe' failed with exit code 4294967295%0A    at ExecState._setResult (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:592:1)%0A    at ExecState.CheckComplete (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:575:1)%0A    at ChildProcess.<anonymous> (file:///D:/a/_actions/Vampire/setup-wsl/node_modules/@actions/exec/lib/toolrunner.js:469:1)%0A    at ChildProcess.emit (node:events:519:28)%0A    at maybeClose (node:internal/child_process:1105:16)%0A    at Process.ChildProcess._handle.onexit (node:internal/child_process:305:5)%0A
  Failure happened, retrying (The process 'C:\Windows\system32\wsl.exe' failed with exit code 4294967295)
  C:\Windows\system32\wsl.exe --update
  Forbidden (403).

I'm setting up via

- uses: Vampire/setup-wsl@v4
  with:
    wsl-conf: 
      [interop]
        appendWindowsPath=false
      [wsl2]
        firewall=false
      localhostForwarding=false
    wsl-shell-command: bash --login -euo pipefail
    additional-packages: curl
      ca-certificates
      g++
      unzip
      zip
      git
      python3
      tar

(See example run: https://github.com/angular/angular-cli/actions/runs/13431119282/job/37523040562?pr=29637).

I'll try the Windows 2025 beta runners, but not sure if those suffer the same problems

[Vampire]

They do not.
I'm aware of these errors and get them almost daily in the daily running tests.
Unfortunately there is not much I can do about it.
I already have a 10-times retry around that call, but once it fails it stays stubborn until you manually restart the workflow.
The problem is, that the Microsoft servers serving this update sometimes decide that they don't like the request and just say "no".

On the 2025 runners, the update is already installed, so no update is necessary, so this problem does not happen.
Another alternative would be to specify WSLv1 as then also no update is necessary.

Another important option is, to complain to the GHA action runners either in separate issues, or by raising your voice in actions/runner-images#10563.
Unfortunately they closed the issue as "WSLv2 is not available on 2022 only on 2025" which is bullshit unfortunately.
If they would simply run the wsl --update call at image building time this problem would be gone as no update is necessary anymore.

[devversion]

Thanks @Vampire, that makes sense. It almost makes it sound like there is some rate limiting going on, if a certain machine/worker from GH happens to perform WSL requests

[Vampire]

If it does not handle that situation properly, return HTTP response 429 which is meant for that, yes.

In my tests that could maybe be true as I do many such requests, but actually it should only be one per job, so even there I'd doubt it is that.

I have no idea what causes it, just that it would be mitigated and also save time if the update would already be installed on the runner image. :-(

[devversion]

@Vampire I can confirm that I didn't see any of these forbidden errors with 2025; on the other hand I'm a bit surprised to see that wsl --update is still taking some time. I was under impression that WSL2 would already be pre-installed in 2025 (thx to your voicing in the runner issues; thanks!)

[Vampire]

Well, seems there still was an update.
I don't do a check but just if WSL version is 2, then I do the update call.
And if you look at the output of https://github.com/Vampire/setup-wsl/actions/runs/13534646466/job/37825992044 you see

Checking for updates.
Updating Windows Subsystem for Linux to version: 2.4.11.

So there probably was some update.
Now that 2025 images have the necessary update already, I could probably just explicitly do it on the 2022 runner only, otherwise the 403s might also come back on 2025 I guess.

[devversion]

That would be pretty great, or at least have it configurable. Happy to work on a PR if you don't have the time/want to do it

[Vampire]

Too late, already released as 5.0.0 :-D
But thanks for the offer

[devversion]

Thank you!!

[vedantmgoyal9]

Created actions/runner-images#11804. Please add your 👍🏻 to it.

[Vampire]

Are you sure that is the right change to do?
All that is missing is an wsl --update call on building the windows-2022 image.