mfrancisc opened a new pull request, #9095: URL: https://github.com/apache/devlake/pull/9095
### Summary `Build-Images-Push-Docker` fails at workflow startup because the `docker/*` action SHAs pinned were removed from the ASF GitHub Actions allowlist. GitHub never starts the jobs, so release tags such as `v1.0.3-beta16` publish compose files but no Docker Hub images. Re-pin the four actions in `.github/workflows/build.yml` to the newest SHAs currently listed in apache/infrastructure-actions `approved_patterns.yml`: - `docker/setup-qemu-action` v4.0.0 → v4.2.0 (`96fe6ef7`) - `docker/setup-buildx-action` v4.0.0 → v4.3.0 (`37fe6310`) - `docker/login-action` v4.1.0 → v4.6.0 (`dbcb8138`) - `docker/build-push-action` v7.1.0 → v7.3.0 (`53b7df96`) `setup-qemu-action` v4.3.0 exists but is not on the allowlist, so qemu stays on v4.2.0. ### Does this close any open issues? Closes #9094 ### Screenshots N/A ### Other Information Failed run: https://github.com/apache/devlake/actions/runs/33074025058 Same class of failure as #8851 / #8852. After this lands, re-run `Build-Images-Push-Docker` on tag `v1.0.3-beta16` (or retag) so Hub actually gets the images. Note: tag `v1.0.3-alpha1` got past startup and then failed in `build-devlake` (`make all` exit 2). That is a separate image-build issue and is not addressed here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
