mchades opened a new issue, #11819: URL: https://github.com/apache/gravitino/issues/11819
### Version main branch ### Describe what's wrong When manually triggering the `Publish Helm Charts` (`chart-release.yaml`) workflow, the run fails with a `startup_failure` during initialization. Failed run: https://github.com/apache/gravitino/actions/runs/28351561029 This is because the Apache foundation security policy restricts third-party actions with release tag references (e.g. `@v4.3.0`), requiring the use of a secure, approved commit SHA instead. ### Error message and/or stacktrace ```text The action azure/[email protected] is not allowed in apache/gravitino because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: ... ``` ### How to reproduce 1. Go to actions in `apache/gravitino` repository. 2. Trigger the `Publish Helm Charts` workflow. 3. Observe the `startup_failure`. ### Additional context We need to update `.github/workflows/chart-release.yaml` to use the secure, approved commit SHA for `azure/setup-helm`: `azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` (which corresponds to version `v5.0.1`). **Why this commit SHA is chosen:** - According to the [ASF Infrastructure allowed actions list](https://github.com/apache/infrastructure-actions/blob/main/actions.yml), the older `v4` commit hashes have been removed/retired, and the active allowed commit SHA for `azure/setup-helm` is now `9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310` (corresponding to release tag `v5.0.1`). - Link to the official release commit: [azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310](https://github.com/azure/setup-helm/commit/9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
