Lesstep
GitHub Actions · Ubuntu 26.04 · Checked November 4, 2026

PyCQA/bandit-action on Ubuntu 26.04: "The version '3.8' with architecture 'x64' was not found"

ubuntu-latest is moving from Ubuntu 24.04 to 26.04 between October 19 and November 19, 2026 (what else changes). actions/setup-python has builds for 26.04 only from Python 3.10 (versions-manifest.json). The Bandit action from PyCQA sets up a Python of its own: the v1 tag, which its README tells you to use, still points to v1.0.0 (June 2024) and asks for 3.8, and v1.0.1 asks for 3.9. Neither has an input to change it, so the job fails before Bandit is installed.

What it looks like

Version 3.8 was not found in the local cache
##[error]The version '3.8' with architecture 'x64' was not found for Ubuntu 26.04.
The list of all available versions can be found here: https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json

It appears under the action's step, from the actions/setup-python@v5 step inside it, even if your workflow has no setup-python step. With @v1.0.1 the version in the message is 3.9.

Where the reports came from

Fix: run Bandit in your own steps

These are the action's own steps, with a Python that 26.04 has:

jobs:
  bandit:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: '3.13'
      - run: pip install 'bandit[sarif,toml]'
      - run: bandit -r . -f sarif -o results.sarif || true
      - uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: results.sarif

Like the action, this ignores Bandit's exit code and sends the findings to code scanning, so they do not fail the job. Add the options you gave the action as inputs to the bandit line, such as -c, -s, -x or --severity-level. Bandit 1.9.4, the current release, needs Python 3.10 or later, so an old Python also gets an old Bandit.

Or keep the action, at a commit that has the input

      - uses: PyCQA/bandit-action@7925d472505a4ec09ef471b22fe99c26fee47443 # main, October 27, 2026
        with:
          python-version: '3.13'

The python-version input was added on main in September 2025, after v1.0.1, and is not in a release yet. Its default there is still 3.9, so set it. On @v1 or @v1.0.1 the same input only gives a warning ("Unexpected input(s)"), and the action still asks for 3.8 or 3.9.

Or pin the runner

runs-on: ubuntu-24.04 for the Bandit job: setup-python has 3.8 and 3.9 builds for 24.04, so the action works there unchanged, until GitHub retires that image.

Telling it apart

Other 26.04 failures

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Ubuntu is a trademark of Canonical Ltd.; Python is a registered trademark of the Python Software Foundation; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., Canonical, the Python Software Foundation, PyCQA or JetBrains.

More: "The ubuntu-latest label will migrate to Ubuntu 26" · setup-python's "was not found" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語