Github Actions在macos-latest-xlarge上遇Python SSL模块不可用错误

问题背景 #

你在GitHub Actions中配置了多OS多Python版本的矩阵任务，其中macos-latest-xlarge环境下执行actions/setup-python@v4时，出现SSL模块缺失的错误，导致pip无法通过HTTPS连接下载包。相关配置和错误信息如下：

任务配置片段 #

strategy:
    matrix:
        os: [ubuntu-latest, ubuntu-20.04, windows-latest, macos-latest, macos-latest-xlarge]
        python: ["3.8", "3.9", "3.10", "3.11"]
runs-on: ${{ matrix.os }}
steps:
    - name: Checkout Repo
      uses: actions/checkout@v3

    - name: Setup Python
      uses: actions/setup-python@v4
      with:
          python-version: ${{ matrix.python }}
          architecture: x64

错误信息 #

Error: WARNING: pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.
Error: WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError("Can't connect to HTTPS URL because the SSL module is not available.")': /simple/pip/
...

已执行的操作 #

为解决之前的gettext错误，你在Python配置步骤前添加了Rosetta安装和x86_64架构的Homebrew部署命令，尝试安装openssl但未解决问题：

/usr/sbin/softwareupdate --install-rosetta --agree-to-license
arch -x86_64 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
echo 'eval "$(/usr/local/bin/brew shellenv)"' >> /Users/runner/.bash_profile
eval "$(/usr/local/bin/brew shellenv)"
arch -x86_64 brew update
arch -x86_64 brew reinstall gettext

问题根源 #

1. 架构不匹配：你通过arch -x86_64强制安装了x86_64版本的Homebrew和组件，但actions/setup-python安装的x64 Python可能无法识别x86架构的OpenSSL库路径，macOS的ARM与x86架构依赖库是隔离的。
2. 环境变量未全局传递：当前步骤中执行的brew shellenv仅作用于当前shell，后续的setup-python步骤无法继承这些环境变量，导致Python找不到OpenSSL。
3. 手动部署的Homebrew干扰了默认环境：actions/setup-python依赖的预构建Python环境原本自带SSL支持，但手动安装的Homebrew可能破坏了系统或Python的依赖路径。

解决方案 #

方案1：统一架构并传递全局环境变量 #

修改Homebrew部署步骤，将OpenSSL的环境变量写入GitHub Actions的全局环境，确保后续Python步骤能读取到：

/usr/sbin/softwareupdate --install-rosetta --agree-to-license
arch -x86_64 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
# 将OpenSSL路径写入全局环境变量，供后续步骤使用
echo "LDFLAGS=-L/usr/local/opt/openssl/lib" >> $GITHUB_ENV
echo "CPPFLAGS=-I/usr/local/opt/openssl/include" >> $GITHUB_ENV
echo "PKG_CONFIG_PATH=/usr/local/opt/openssl/lib/pkgconfig" >> $GITHUB_ENV
echo 'eval "$(/usr/local/bin/brew shellenv)"' >> /Users/runner/.bash_profile
eval "$(/usr/local/bin/brew shellenv)"
arch -x86_64 brew update
arch -x86_64 brew reinstall gettext openssl

同时，在Python安装步骤中明确使用这些环境变量：

- name: Setup Python
  uses: actions/setup-python@v4
  with:
      python-version: ${{ matrix.python }}
      architecture: x64
  env:
      LDFLAGS: ${{ env.LDFLAGS }}
      CPPFLAGS: ${{ env.CPPFLAGS }}
      PKG_CONFIG_PATH: ${{ env.PKG_CONFIG_PATH }}

方案2：使用ARM原生Homebrew（适用于Apple Silicon runner） #

如果macos-latest-xlarge是Apple Silicon架构的runner，直接安装ARM版本的Homebrew，避免架构冲突：

# 安装ARM版Homebrew（默认路径/opt/homebrew）
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
echo "eval \"\$(/opt/homebrew/bin/brew shellenv)\"" >> /Users/runner/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
brew update
brew reinstall gettext openssl
# 导出ARM版OpenSSL的全局环境变量
echo "LDFLAGS=-L/opt/homebrew/opt/openssl/lib" >> $GITHUB_ENV
echo "CPPFLAGS=-I/opt/homebrew/opt/openssl/include" >> $GITHUB_ENV
echo "PKG_CONFIG_PATH=/opt/homebrew/opt/openssl/lib/pkgconfig" >> $GITHUB_ENV

方案3：移除手动Homebrew部署，使用预构建环境 #

actions/setup-python提供的Python版本已经包含完整的SSL支持，你可以移除手动安装Homebrew的步骤，改用pip安装gettext相关依赖来解决之前的gettext问题：

- name: Install gettext dependency (macOS)
  if: startsWith(matrix.os, 'macos')
  run: python -m pip install gettext

内容的提问来源于stack exchange，提问作者Flobbinhood