FrankChen021 opened a new issue, #20423: URL: https://github.com/apache/druid/issues/20423
_This issue was generated automatically by Claude Code (Anthropic's AI coding agent) running a scheduled CI-triage routine on behalf of @FrankChen021. Analysis and suggested fixes are AI-produced; please verify before acting on them._ This triage covers the 6 master commits from 2026-09-24 (UTC+8). 2 of them had a failed push-triggered run. Both are `Unit & Integration tests CI` runs that ended in `startup_failure` before any job ran. The cause is CI infrastructure, not the commits. ASF's allowlist automation removed the pinned `Kesin11/actions-timeline@44c9c178` ref ([apache/infrastructure-actions@3f48e92](https://github.com/apache/infrastructure-actions/commit/3f48e92779e8619d8219b6e259433e086400123e), 2026-09-24T02:27Z), and both runs stayed queued until 05:22Z, after the removal. The neighbouring commits b7b560dfd2 and fe9dd22977 use the same workflow file. Their runs started at 02:04Z and 02:05Z, before the removal, and passed. Neither failing commit touches `.github/`. No test failed, and no retries were attempted. The fix (#20415) has already been merged. ### Summary | Commit | Failed job | Failure log | Root cause | Verdict | |---|---|---|---|---| | f541ae200c (#20405, bump org.apache:apache 39 → 40) | `Unit & Integration tests CI` (startup, no jobs created) | [run 35944541953](https://github.com/apache/druid/actions/runs/35944541953) | `startup_failure`: action `kesin11/actions-timeline@44c9c178…` is not allowed in apache/druid (removed from ASF allowlist) | Infra (fix in #20415) | | d311319e73 (#20317, fix flaky ReferenceCountingResourceHolderTest) | `Unit & Integration tests CI` (startup, no jobs created) | [run 35945726665](https://github.com/apache/druid/actions/runs/35945726665) | `startup_failure`: action `kesin11/actions-timeline@44c9c178…` is not allowed in apache/druid (removed from ASF allowlist) | Infra (fix in #20415) | ### Analysis and suggested fixes **1. `Unit & Integration tests CI` startup failure: `Kesin11/actions-timeline` pin removed from the ASF allowlist** In `.github/workflows/unit-and-integration-tests-unified.yml`, the `actions-timeline` job used `Kesin11/actions-timeline@44c9c178ffb2fb1d9859614a3ffa79ccfb77565e` (v3.1.0). The ASF enterprise policy only allows third-party actions pinned to SHAs listed in `apache/infrastructure-actions/approved_patterns.yml`. That entry had an expiry date, and the `remove_expired.yml` automation removed it at 2026-09-24T02:27Z. GitHub checks every `uses:` ref in the whole workflow graph at run start. From that point, any run of this workflow was rejected with `startup_failure` and no jobs, and so were reruns of older runs. This hit both master pushes above and several PR runs on the same day (for example 35993640622, 36003648762, 36038970963). The two master runs were created at 01:48Z and 02:04Z but did not start until 05:22Z, after the removal. The adjacent pushes started at 02:04Z and 02:05Z and passed. The failing commits change only `pom.xml` (#20405) and one test file (#20317), so they did n ot cause the failures. Suggested fix: already done in #20415 (merged 2026-09-24T20:01Z), which pins `Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad` (v3.2.0, allowlisted without an expiry). To keep this from happening again, let Dependabot's `github-actions` ecosystem track allowlisted SHAs. Optionally, also add a scheduled check that compares every `uses:` pin in `.github/workflows/` against `approved_patterns.yml` and flags entries close to expiry. Re-run the two failed master runs if coverage for f541ae200c and d311319e73 is needed. Rerunning with the old workflow file will still fail, so push a new commit or start a fresh workflow run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
