SSH connection to GHA runner with `tmate` not working

[tsbinns]

Trying to SSH into a GHA runner in #13490 with tmate, requested with the [actions ssh] commit tag.

However, when I try to connect via terminal, I just see a screen of all dots:

Also, the link to the web shell returns a 503 error.

Tried to look at the tmate documentation to see if I was doing something wrong, but the website is down https://tmate.io/, and according to this comment from the dev (July 2025), the servers have been closed.

However, looking at the action we're using to set up tmate, it seems things may still be working (mxschmitt/action-tmate#222 (comment); Sept 2025). Not sure what to make of that.

@larsoner added this functionality in #13321 in July 2025, 2 days before that comment about the servers being closed. Has anyone tried to use it since it was first added?

[larsoner]

I think I did but am not 100% sure.

Probably worth switching to https://github.com/marketplace/actions/actiondebugger-by-warpbuild since it supports all OSes and works the same way. Feel free to do that in #13490 if you want

[tsbinns]

Tried adding this. The actions seems to start the connection, but then immediately errors out HttpError: Resource not accessible by integration (https://github.com/mne-tools/mne-python/actions/runs/22073408229/job/63783228068?pr=13490).

From what I can see, sounds like the action/workflow needs write permission (currently only read). If so, is that something that needs to be discussed, or are the implications minimal? CC @larsoner

[larsoner]

Hmm I think requiring write would make it only work for PRs with branches originating from mne-tools (which are very rare and usually only bot-generated), not from forks. I don't think write permissions work with pull_request event (and we don't want to switch to pull_request_target for tests), see for example actions/labeler#121 (comment) .

https://github.com/owenthereal/action-upterm won't work on windows, but if it doesn't require write maybe it's good enough?

[drammock]

@bsipocz you recently got the warpbuild SSH action working right? Can you point us at the config that worked for you?

[bsipocz]

@drammock - Currently I just uncomment it when it's needed rather than adding any debug env variables or labels, but it works. The connection is a bit more chunky though that for circleCI, I'm not sure it's the fault of the action or GHA (but if connection lost I can re-ssh and can keep going)

https://github.com/nasa-fornax/fornax-demo-notebooks/blob/main/.github/workflows/ci_tests_run_notebooks.yml#L31

[tsbinns]

Nothing jumps out as me for why it works in that config but not ours, unless the default permissions there include write, although that might not matter as per #13659 (comment). That was the only explanation I could find online as to why it might not be working.

I'll have another look. Can try the https://github.com/owenthereal/action-upterm suggestion otherwise.