This is an automated email from the ASF dual-hosted git repository.
viirya pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/spark-connect-gateway.git
The following commit(s) were added to refs/heads/main by this push:
new b1eb448 Use an allowlisted CI toolchain setup
b1eb448 is described below
commit b1eb448764a0a99148bd0b3c1ec28c3576403d92
Author: Liang-Chi Hsieh <[email protected]>
AuthorDate: Wed Aug 12 10:11:59 2026 -0700
Use an allowlisted CI toolchain setup
The Apache Actions allowlist rejects dtolnay/rust-toolchain, so install the
Rust toolchain through a local composite action
(.github/actions/setup-builder)
that uses rustup, matching apache/datafusion and apache/iceberg-rust. Pin
arduino/setup-protoc and swatinem/rust-cache to the commit SHAs those Apache
projects use (which are on the allowlist), and pin actions/checkout.
Co-authored-by: Claude Code
---
.github/actions/setup-builder/action.yml | 43 ++++++++++++++++++++++++++++++++
.github/workflows/ci.yml | 12 +++++----
.github/workflows/license.yml | 2 +-
3 files changed, 51 insertions(+), 6 deletions(-)
diff --git a/.github/actions/setup-builder/action.yml
b/.github/actions/setup-builder/action.yml
new file mode 100644
index 0000000..e3e5a67
--- /dev/null
+++ b/.github/actions/setup-builder/action.yml
@@ -0,0 +1,43 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Installs the Rust toolchain via rustup (preinstalled on GitHub runners),
+# avoiding third-party toolchain actions that are not on the Apache Actions
+# allowlist. Inspired by apache/datafusion and apache/iceberg-rust.
+name: Prepare Rust Builder
+description: 'Prepare Rust Build Environment'
+inputs:
+ rust-version:
+ description: 'version of rust to install and use'
+ required: false
+ default: 'stable'
+runs:
+ using: "composite"
+ steps:
+ - name: Setup Rust toolchain
+ shell: bash
+ env:
+ RUST_VERSION: ${{ inputs.rust-version }}
+ run: |
+ echo "Installing ${RUST_VERSION}"
+ rustup toolchain install "${RUST_VERSION}"
+ rustup default "${RUST_VERSION}"
+ rustup component add rustfmt clippy
+ - name: Fixup git permissions
+ # https://github.com/actions/checkout/issues/766
+ shell: bash
+ run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad6cafa..101e76c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,20 +39,22 @@ jobs:
name: fmt / clippy / build / test
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #
v4.2.2
with:
persist-credentials: false
- - uses: dtolnay/rust-toolchain@stable
+ - name: Setup Rust toolchain
+ uses: ./.github/actions/setup-builder
with:
- components: rustfmt, clippy
+ rust-version: stable
- - uses: arduino/setup-protoc@v3
+ - name: Install protoc
+ uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b #
v3.0.0
with:
version: "29.x"
repo-token: ${{ secrets.GITHUB_TOKEN }}
- - uses: Swatinem/rust-cache@v2
+ - uses: swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Format check
run: cargo fmt --all -- --check
diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index 084a116..30025dd 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -35,7 +35,7 @@ jobs:
name: Check license header
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #
v4.2.2
with:
persist-credentials: false
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
