With jruby SecureRandom.random_number is always 0

[duritong]

Ensure the following before filing this issue

• I verified it reproduces with the latest version with - uses: ruby/setup-ruby@v1 (see Versioning policy)

• I tried to reproduce the issue locally by following the workflow steps (including all commands done by ruby/setup-ruby, except for Downloading Ruby & Extracting Ruby),
  and it did not reproduce locally (if it does reproduce locally, it's not a ruby/setup-ruby issue)

Are you running on a GitHub-hosted runner or a self-hosted runner?

GitHub-hosted runner

The workflow code or a link to the workflow file

https://github.com/duritong/ruby-actions-test/blob/main/.github/workflows/ruby.yml

Link to the log of a failed workflow job, or to a gist with the output

https://github.com/duritong/ruby-actions-test/actions/runs/3859056296/jobs/6578227554#step:4:106

The command and output of the failing step

The following script returns always 0 as a random number:

https://github.com/duritong/ruby-actions-test/blob/main/test.rb

So essentially I am showing that for many invocations SecureRandom.random_number on jRuby always returns 0.

If you run that script locally with jRuby this is not the case.

Any other notes?

This also affects tests in other projects: https://github.com/duritong/trocla/actions/runs/3859059179/jobs/6578233962

[duritong]

CC @headius

[eregon]

This cannot be a bug of setup-ruby.
So it's most likely a bug of JRuby in combination with running in GitHub-hosted runners.
Therefore, could you open an issue at https://github.com/jruby/jruby/issues instead?

[eregon]

FWIW I can actually reproduce the problem locally on linux-amd64 on JRuby 9.4.0.0 (jruby 9.4.0.0 (3.1.0) 2022-11-23 95c0ec159f OpenJDK 64-Bit Server VM 17.0.5+8 on 17.0.5+8 +jit [x86_64-linux]).

[eregon]

And it seems to happen on all 3 OS: https://github.com/eregon/actions-shell/actions/runs/3948629197/jobs/6758850494
Not sure why you couldn't repro locally, maybe you were not using the same JRuby version?

[headius]

This should be filed with JRuby. It appears to be a bug in some very old code used to generate a random int or long by calling bytes on the self object, but it does not handle the bit math properly to produce the final value. This logic was not in use for SecureRandom until we moved to the securerandom gem, which depends on these callbacks to work properly.

[duritong]

Thank you for looking into it. I filed: jruby/jruby#7586

Yeah, looks like my local jRuby wasn't recent enough - and therefor I leaned towards an issue with actions.