This is an automated email from the ASF dual-hosted git repository. wu-sheng pushed a commit to branch fix/pin-docker-login-action in repository https://gitbox.apache.org/repos/asf/skywalking-eyes.git
commit e07988b8287863998baa3f6c3661fa4adde58ac7 Author: Wu Sheng <[email protected]> AuthorDate: Thu Jul 30 00:06:03 2026 +0800 fix: pin docker/login-action to an ASF-approved commit SHA The publish-docker workflow failed at startup (startup_failure, no jobs run) because `docker/[email protected]` is referenced by version tag. The ASF org-wide GitHub Actions policy requires every third-party action to be pinned to a reviewed commit SHA present in apache/infrastructure-actions/approved_patterns.yml; only the actions/*, apache/* and github/* namespaces are exempt. Pin to 650006c6eb7dba73a995cc03b0b2d7f5ca915bee (v4.2.0), which is on the approved list and is the same pin already used by skywalking, skywalking-java, skywalking-cli, skywalking-go and skywalking-python. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .github/workflows/publish-docker.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml index ba7ca49..a30aa29 100644 --- a/.github/workflows/publish-docker.yaml +++ b/.github/workflows/publish-docker.yaml @@ -47,7 +47,7 @@ jobs: key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} restore-keys: ${{ runner.os }}-go- - name: Log in to the Container registry - uses: docker/[email protected] + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 with: registry: ${{ env.HUB }} username: ${{ github.actor }}
