Unable to setup pip cache-dependency-path in a downstream action due to setup-python only considering the current GITHUB_WORKSPACE

[PrinsonF77]

Description:
When setup-python is used in a downstream composite action, we would want it to pick up the requirements.txt from the composite action files instead of the current GITHUB_WORKSPACE.

This is currently not possible and setup-python ends up giving an error: Error: No file in /home/ubuntu/actions-runner/_work/ matched to [**/requirements.txt or **/pyproject.toml], make sure you have checked out the target repository.

Ideally, as the composite action requires the python set up, we should also have the ability to look for the requirements.txt file in /home/ubuntu/actions-runner/_action.

The glob.hashFiles function that is called by setup-python does provide an option for current workspace: https://github.com/actions/toolkit/blob/f58042f9cc16bcaa87afaa86c2974a8c771ce1ea/packages/glob/src/internal-hash-files.ts#L9.
This issue can potentially be fixed by taking in an input for the workspace to look for the requirements.txt file. It can then be provided from the composite action as ${{ github.action_path }}.

Action version:
v6

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:
Using Python 3.13

Repro steps:

1. Have a workflow in a repository that does not deal with python and therefore does not have requirements.txt or pyproject.toml
2. Use a composite github action from another repository that requires python to perform its operations and has a requirements.txt
3. Provide the complete path to this requirements.txt or **/requirements.txt in the cache-dependency-path input

Expected behavior:
The setup-python should pickup the requirements.txt from the _action directory and complete successfully

Actual behavior:
Setup python errors with Error: No file in /home/ubuntu/actions-runner/_work/<redacted> matched to [**/requirements.txt or **/pyproject.toml], make sure you have checked out the target repository.

[priya-kinthali]

Hello @PrinsonF77👋,
Thank you for reporting this issue. We will investigate it and get back to you as soon as we have some feedback.

[mahabaleshwars]

Thank you for reporting this issue, @PrinsonF77. You've accurately identified the limitation with composite actions and setup-python's cache dependency path resolution.

We previously explored a solution for this in PR #1128, where we implemented a workaround by copying files from the composite action directory into the main workspace. While this approach provided valuable insights into supporting composite actions with setup-python, we recognized that a more robust solution was needed.

We're now addressing this capability at the toolkit level through actions/toolkit#1035. This enhancement will:

• Enable consistent support for composite actions across all GitHub Actions that use file hashing
• Provide a secure and scalable implementation
• Resolve the hashFiles path handling at its root, benefiting not just setup-python but all actions that rely on this functionality

The current limitation when using the setup-python action with composite actions arises from the fact that it supports relative paths, while absolute paths are not yet allowed. This could be considered a feature request rather than a bug.

In the meantime, here are two workarounds you can use:

Workaround 1: Copy the requirements file

Copy the requirements.txt from your composite action to the workspace before calling setup-python:

- run: cp ${{ github.action_path }}/requirements.txt ./composite-requirements.txt
  shell: bash
  
- uses: actions/setup-python@v6
  with:
    python-version: '3.10'
    cache: pip
    cache-dependency-path: ./composite-requirements.txt

Workaround 2: Create a symbolic link

Create a symbolic link to requirements.txt from the composite action's directory. This allows the setup-python action to access it, even though the path would otherwise be relative to the repository's root:

- name: Create symbolic link for requirements.txt
  run: ln -s ${{ github.action_path }}/requirements.txt ./requirements.txt
  shell: bash
  
- uses: actions/setup-python@v6
  with:
    python-version: '3.10'
    cache: pip
    cache-dependency-path: ./requirements.txt

Both workarounds achieve the same goal of making the dependency file accessible to setup-python within the expected path context.

We appreciate your patience as we work on the proper toolkit-level solution that will make this work seamlessly without workarounds.