linliu-code opened a new pull request, #674: URL: https://github.com/apache/hudi-rs/pull/674
### CI has not run on this repository since 2026-06-05 Every `CI` and `Code` run since then — on every pull request, from every contributor — has ended in **`startup_failure`**: ``` 2026-08-05 sushiljacksparrow/hudi-rs feat/parallel-pruning-leaf-listing startup_failure 2026-08-05 vinothchandar/hudi-rs feat/table-writes startup_failure 2026-08-07 linliu-code/hudi-rs feat/v2-gap-reporting startup_failure ``` Last green `CI`: `2026-06-05`. There have been none since. ### Why it is invisible When a workflow references an action that is not on the ASF org-level allowlist, the run fails **before any job starts**. No logs, no annotation, no notification — and because no check ever reports, `gh pr checks` says *"no checks reported"* and the pull request page looks unremarkable. Upstream writeup: [apache/infrastructure-actions#574](https://github.com/apache/infrastructure-actions/issues/574). The `PR` workflow is unaffected and still reports, which is why the failure looks like a partial outage rather than a total one — it uses only `actions/*`, which is trusted by owner. ### The three offending refs Verified against [`approved_patterns.yml`](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml) with ASF's own [`check_asf_allowlist.py`](https://github.com/apache/infrastructure-actions/tree/main/allowlist-check): | Ref | Why it fails | Moved to | |---|---|---| | `astral-sh/setup-uv@5a095e7…` (v7.3.1) | that commit is not on the list; the list carries v8.1.0–v9.0.0 | `@11f9893b…` (v8.3.2) | | `docker/setup-buildx-action@8d2750c…` (v3.12.0) | not on the list; the list carries v4.0.0–v4.2.0 | `@bb05f3f5…` (v4.2.0) | | `Swatinem/rust-cache@v2` | the entry is `swatinem/rust-cache@*` — lower-case owner; the check is case-sensitive | `swatinem/rust-cache@6323deb1…` (v2.9.2) | `codecov/codecov-action@v6`, `PyO3/maturin-action@v1` and everything under `actions/*` and `apache/*` already pass. Version choices: `setup-uv` v8 is the lowest allowlisted major, so this is the smallest bump available — its breaking changes are the `manifest-file` format and the removal of floating tags, neither of which this repo uses. v9.0.0 is also allowlisted but flips `prune-cache` to `false`, which would grow cache usage; that seemed worth leaving to a maintainer's judgement. `setup-buildx-action` v4 has no allowlisted v3, and its breaking changes are the Node 24 runtime and removed inputs — this repo passes none. ### Preventing a silent recurrence Adds `.github/workflows/asf-allowlist-check.yml`, the check ASF publishes for exactly this failure mode. It uses only trusted-owner actions, so it cannot itself be silenced the same way. `apache/iceberg-rust` runs the same guard. After the fix, ASF's checker passes on the full tree: ``` All 13 unique action refs are on the ASF allowlist ``` ### What this does not fix Fork pull requests still land in `action_required` and need a committer to press **Approve and run** — that gate is separate and is working as configured. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
