[
https://issues.apache.org/jira/browse/HADOOP-20050?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18136555#comment-18136555
]
ASF GitHub Bot commented on HADOOP-20050:
-----------------------------------------
GauthamBanasandra merged PR #8906:
URL: https://github.com/apache/hadoop/pull/8906
> Bump expired GitHub Actions pins to ASF-allowlisted versions and add
> Dependabot
> -------------------------------------------------------------------------------
>
> Key: HADOOP-20050
> URL: https://issues.apache.org/jira/browse/HADOOP-20050
> Project: Hadoop Common
> Issue Type: Bug
> Components: hadoop-common
> Affects Versions: 3.5.0
> Reporter: Gautham Banasandra
> Assignee: Gautham Banasandra
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.5.0
>
>
> h3. Problem
> Since 2026-10-17, every {{Build}} ({{build_and_test.yml}}) and {{Image
> Cache}} ({{build_image_cache.yml}}) run in apache/hadoop has ended in
> {{startup_failure}}, with no logs. The run annotation says:
> {quote}The action
> docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c is not allowed
> in apache/hadoop{quote}
> ASF Infra removed that pin (v4.5.0) from the [action
> allowlist|https://github.com/apache/infrastructure-actions/blob/main/actions.yml]
> on 2026-10-16. Forks are not subject to the allowlist, so PR builds in
> contributors' forks kept passing and nobody noticed. The upstream image cache
> has not been refreshed since 2026-09-18.
> First failing run: https://github.com/apache/hadoop/actions/runs/39033320107
> Three more pins are about to be removed:
> ||Action||Pinned version||Removed from allowlist||
> |docker/login-action|v4.5.0|2026-10-16 (already removed)|
> |docker/setup-buildx-action|v4.2.0|2026-11-19|
> |docker/build-push-action|v7.3.0|2026-12-09|
> |dorny/test-reporter|v3.0.0|2026-12-27|
> This is the third time an expired pin has broken CI (HADOOP-19893,
> HADOOP-19933). The repository has no Dependabot configuration, although the
> [ASF GitHub Actions
> policy|https://infra.apache.org/github-actions-policy.html] requires one, so
> nothing proposes bumps before pins expire.
> h3. Proposed fix
> # Bump the four pins to allowlisted versions that have no expiry date:
> docker/login-action v4.7.0, docker/setup-buildx-action v4.4.1,
> docker/build-push-action v7.4.0, dorny/test-reporter v3.2.0.
> # Add {{.github/dependabot.yml}} for the github-actions ecosystem, covering
> the workflows and the composite actions under {{.github/actions}}. Weekly
> grouped updates, with security updates in a separate group and a 7-day
> cooldown, as required by SECURITY.md.
> # Add an "ASF Allowlist Check" workflow using
> {{apache/infrastructure-actions/allowlist-check}}. It fails a PR that touches
> {{.github/}} when a ref is not on the allowlist, warns 30 days before an
> allowlisted pin expires, and runs weekly on apache/hadoop.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
