This is an automated email from the ASF dual-hosted git repository.
SteNicholas pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/celeborn.git
The following commit(s) were added to refs/heads/main by this push:
new 7340428ba [CELEBORN-2322] Upgrade version of docker/login-action for
Login to Docker Hub
7340428ba is described below
commit 7340428ba0849fed00e0575efd5fc3c69e79badf
Author: SteNicholas <[email protected]>
AuthorDate: Mon May 11 09:41:50 2026 +0800
[CELEBORN-2322] Upgrade version of docker/login-action for Login to Docker
Hub
### What changes were proposed in this pull request?
Upgrade version of docker/login-action for Login to Docker Hub to
`docker/login-action4907a6ddec9925e35a0a9e82d7399ccc52663121`.
### Why are the changes needed?
There is error of dockerhub login in
https://github.com/apache/celeborn/actions/runs/24821432736, which is as
follows:
```
The action docker/login-actionv3 is not allowed in apache/celeborn because
all actions must be from a repository owned by your enterprise, created by
GitHub, or match one of the patterns:
1Password/load-secrets-action13f58eec611f8e5db52ec16247f58c508398f3e6,
1Password/load-secrets-action8d0d610af187e78a2772c2d18d627f4c52d3fbfb,
1Password/load-secrets-action92467eb28f72e8255933372f1e0707c567ce2259,
1Password/load-secrets-actiondafbe7cb03502b260e2b2893c753c352eee545bf,
AdoptOpenJDK/inst [...]
```
[INFRA-27901](https://issues.apache.org/jira/projects/INFRA/issues/INFRA-27901)
gives the following suggestion:
> Following the Trivy compromise, more controls have been put in place
regarding use of third party actions.
>
> The only allowed versions of this action are those in the repo:
>
> https://github.com/apache/infrastructure-actions
>
> In:
https://raw.githubusercontent.com/apache/infrastructure-actions/refs/heads/main/actions.yml
at the moment you can use :
>
> - docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
> - docker/login-actionb45d80f862d83dbcd57f89517bcf500b2ab88fb2
> - docker/login-action4907a6ddec9925e35a0a9e82d7399ccc52663121
>
> which correspond to these tagged versions:
>
> docker/login-action:
> c94ce9fb468520275223c153574b00df6fe4bcc9:
> tag: v3.7.0
> expires_at: 2026-06-14
> b45d80f862d83dbcd57f89517bcf500b2ab88fb2:
> tag: v4.0.0
> expires_at: 2026-07-05
> 4907a6ddec9925e35a0a9e82d7399ccc52663121:
> tag: v4.1.0
### Does this PR resolve a correctness bug?
No.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
No.
Closes #3681 from SteNicholas/CELEBORN-2322.
Authored-by: SteNicholas <[email protected]>
Signed-off-by: SteNicholas <[email protected]>
---
.github/workflows/docker-build.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/docker-build.yml
b/.github/workflows/docker-build.yml
index a62dbc5dc..0ef758cdc 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -33,7 +33,7 @@ jobs:
tar -xzf apache-celeborn-${VERSION}-bin.tgz
- name: Login to Docker Hub
- uses: docker/login-action@v3
+ uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
with:
username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
