FreeOnePlus opened a new pull request, #139: URL: https://github.com/apache/doris-mcp-server/pull/139
## Root cause Apache's GitHub Actions policy rejected the third-party `astral-sh/setup-uv` Action before any job could start. The workflow syntax and project gates were valid, but the enterprise Action allowlist only permits GitHub-owned Actions or explicitly approved entries. ## Fix - install the same pinned `uv==0.9.0` release through Python after the allowed GitHub-owned setup-python Action - restrict every remaining `uses:` entry to a GitHub-owned Action pinned by full commit SHA - extend the CI contract test so a disallowed third-party Action or an unpinned uv install cannot be reintroduced ## Validation - actionlint: passed - isolated Python 3.12 virtual environment installed and executed `uv 0.9.0` - CI contract tests: 4 passed - Ruff, Mypy (58 source files), and Bandit: passed - pytest with warnings as errors: 633 passed, 64 skipped, 0 warnings - build and clean-wheel CLI/import smoke: passed - official MCP Conformance 0.2.0-alpha.10 at 49103de: server-stateless [2026-07-28], 25/25 passed, 0 failed, 0 warnings - real Doris integration: 7/7 passed across Streamable HTTP and true subprocess Stdio; temporary tables/users and tunnels were cleaned -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
