vernedeng opened a new issue, #12175:
URL: https://github.com/apache/inlong/issues/12175
### Description
## Symptom
Workflow run
[#5461](https://github.com/apache/inlong/actions/runs/29726231726), triggered
by commit `1cb5023a` ([INLONG-12167][Release] Bumped version of branch-2.4 to
2.4.0), ended with **Startup failure**. No build/push step was
executed.
The only annotation on the run is:
> The actions `docker/setup-qemu-action@v3` and
`docker/setup-buildx-action@v3` are not allowed in apache/inlong because all
actions must be from a repository owned by your enterprise, created by GitHub,
or match one of the patterns: ...
## Root Cause
The ASF Infrastructure GitHub Actions Policy
([infra.apache.org/github-actions-policy.html](https://infra.apache.org/github-actions-policy.html))
requires:
> You **MUST** pin all external actions to the specific git hash (SHA1) of
the action that has been reviewed for use by the project.
`docker/setup-qemu-action` and `docker/setup-buildx-action` are external
actions (not under `apache/*`, `github/*`, or `actions/*`). Referencing them
via the `@v3` tag is rejected by the ASF org-wide allowlist at workflow startup.
Both actions are already approved in the ASF allowlist
([apache/infrastructure-actions/actions.yml](https://github.com/apache/infrastructure-actions/blob/main/actions.yml)),
but only at specific SHA pins — `@v3` is not one of them.
## Impact
- 2.4.0 Docker images were never pushed to Docker Hub. Only
`2.4.0-SNAPSHOT` (from 2026-03-16) is available.
- Any future push to `branch-2.4` or `master` that touches `**/pom.xml` or
module paths will keep hitting the same failure.
- The `[Release] Change the tag of Docker images to 2.4.0` commit
(`68da721c`) does not re-trigger the workflow on its own — its changed files
(`*.md`, `*.yaml`, `*.env`, `*.conf`) are outside `ci_docker.yml`'s path
filter, and `*.md` is
excluded via `!**.md`.
## Proposed Fix
Pin both actions to SHA hashes that are already on the ASF allowlist.
`.github/workflows/ci_docker.yml` lines 100–105:
```yaml
# Before
- name: Set up QEMU dependency
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@v3
# After
- name: Set up QEMU dependency
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8
# v4.2.0
- name: Set up Docker Buildx
id: buildx
uses:
docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
Both SHAs are listed in the ASF allowlist with no expiry date (v4.2.0 is
the latest stable pin for each).
Follow-up After Fix
1. Merge the fix to both branch-2.4 and master.
2. Re-run workflow run #5461, or trigger a fresh run by pushing a
pom.xml-touching commit to branch-2.4.
3. Verify inlong/manager:2.4.0 (and the other 7 component images) appear
on Docker Hub after ~50 min.
References
- Failing run: https://github.com/apache/inlong/actions/runs/29726231726
- ASF GitHub Actions Policy:
https://infra.apache.org/github-actions-policy.html
- ASF allowlist source:
https://github.com/apache/infrastructure-actions/blob/main/actions.yml
- 2.3.0 successful run for comparison:
https://github.com/apache/inlong/actions/runs/18994859354
### InLong Component
Other for not specified component
### Are you willing to submit PR?
- [x] Yes, I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
