[
https://issues.apache.org/jira/browse/HADOOP-20050?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135883#comment-18135883
]
ASF GitHub Bot commented on HADOOP-20050:
-----------------------------------------
hadoop-yetus commented on PR #8906:
URL: https://github.com/apache/hadoop/pull/8906#issuecomment-6546902977
:confetti_ball: **+1 overall**
| Vote | Subsystem | Runtime | Logfile | Comment |
|:----:|----------:|--------:|:--------:|:-------:|
| +0 :ok: | reexec | 0m 36s | | Docker mode activated. |
|||| _ Prechecks _ |
| +1 :green_heart: | dupname | 0m 0s | | No case conflicting files
found. |
| +0 :ok: | codespell | 0m 0s | | codespell was not available. |
| +0 :ok: | detsecrets | 0m 0s | | detect-secrets was not available.
|
| +0 :ok: | yamllint | 0m 0s | | yamllint was not available. |
| +1 :green_heart: | @author | 0m 0s | | The patch does not contain
any @author tags. |
|||| _ trunk Compile Tests _ |
| +1 :green_heart: | shadedclient | 31m 48s | | branch has no errors
when building and testing our client artifacts. |
|||| _ Patch Compile Tests _ |
| +1 :green_heart: | blanks | 0m 0s | | The patch has no blanks
issues. |
| +1 :green_heart: | shadedclient | 27m 20s | | patch has no errors
when building and testing our client artifacts. |
|||| _ Other Tests _ |
| +1 :green_heart: | asflicense | 0m 37s | | The patch does not
generate ASF License warnings. |
| | | 61m 54s | | |
| Subsystem | Report/Notes |
|----------:|:-------------|
| Docker | ClientAPI=1.56 ServerAPI=1.56 base:
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8906/1/artifact/out/Dockerfile
|
| GITHUB PR | https://github.com/apache/hadoop/pull/8906 |
| Optional Tests | dupname asflicense codespell detsecrets yamllint |
| uname | Linux 510298e0cc6b 5.15.0-198-generic #208-Ubuntu SMP Fri Sep 4
10:22:38 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux |
| Build tool | maven |
| Personality | dev-support/bin/hadoop.sh |
| git revision | trunk / 5b24d37a855496a64b1738918dd47dbd85883bb2 |
| Max. process+thread count | 615 (vs. ulimit of 10000) |
| modules | C: . U: . |
| Console output |
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8906/1/console |
| versions | git=2.43.0 maven=3.9.15 |
| Powered by | Apache Yetus 0.14.1 https://yetus.apache.org |
This message was automatically generated.
> Bump expired GitHub Actions pins to ASF-allowlisted versions and add
> Dependabot
> -------------------------------------------------------------------------------
>
> Key: HADOOP-20050
> URL: https://issues.apache.org/jira/browse/HADOOP-20050
> Project: Hadoop Common
> Issue Type: Bug
> Components: hadoop-common
> Affects Versions: 3.5.0
> Reporter: Gautham Banasandra
> Assignee: Gautham Banasandra
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.5.0
>
>
> h3. Problem
> Since 2026-10-17, every {{Build}} ({{build_and_test.yml}}) and {{Image
> Cache}} ({{build_image_cache.yml}}) run in apache/hadoop has ended in
> {{startup_failure}}, with no logs. The run annotation says:
> {quote}The action
> docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c is not allowed
> in apache/hadoop{quote}
> ASF Infra removed that pin (v4.5.0) from the [action
> allowlist|https://github.com/apache/infrastructure-actions/blob/main/actions.yml]
> on 2026-10-16. Forks are not subject to the allowlist, so PR builds in
> contributors' forks kept passing and nobody noticed. The upstream image cache
> has not been refreshed since 2026-09-18.
> First failing run: https://github.com/apache/hadoop/actions/runs/39033320107
> Three more pins are about to be removed:
> ||Action||Pinned version||Removed from allowlist||
> |docker/login-action|v4.5.0|2026-10-16 (already removed)|
> |docker/setup-buildx-action|v4.2.0|2026-11-19|
> |docker/build-push-action|v7.3.0|2026-12-09|
> |dorny/test-reporter|v3.0.0|2026-12-27|
> This is the third time an expired pin has broken CI (HADOOP-19893,
> HADOOP-19933). The repository has no Dependabot configuration, although the
> [ASF GitHub Actions
> policy|https://infra.apache.org/github-actions-policy.html] requires one, so
> nothing proposes bumps before pins expire.
> h3. Proposed fix
> # Bump the four pins to allowlisted versions that have no expiry date:
> docker/login-action v4.7.0, docker/setup-buildx-action v4.4.1,
> docker/build-push-action v7.4.0, dorny/test-reporter v3.2.0.
> # Add {{.github/dependabot.yml}} for the github-actions ecosystem, covering
> the workflows and the composite actions under {{.github/actions}}. Weekly
> grouped updates, with security updates in a separate group and a 7-day
> cooldown, as required by SECURITY.md.
> # Add an "ASF Allowlist Check" workflow using
> {{apache/infrastructure-actions/allowlist-check}}. It fails a PR that touches
> {{.github/}} when a ref is not on the allowlist, warns 30 days before an
> allowlisted pin expires, and runs weekly on apache/hadoop.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
