jzhao20230918 opened a new pull request, #129: URL: https://github.com/apache/rocketmq-docker/pull/129
Fixes #128. ### Root cause Since August 2026 every `docker-publish` run ends with `startup_failure`, so `apache/rocketmq:5.5.1` was never published. The workflow pins three third-party actions by SHA: | action | pinned SHA | |---|---| | `docker/setup-buildx-action` | `4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd` | | `docker/login-action` | `4907a6ddec9925e35a0a9e82d7399ccc52663121` | | `docker/build-push-action` | `bcafcacb16a39f128d818304e6c9c0c18556b85f` | None of these SHAs is present any more in the ASF approved-actions list (`apache/infrastructure-actions/actions.yml`). ASF entries carry an `expires_at`, and once a SHA is dropped the org policy refuses to start any workflow that references it — which is exactly what `startup_failure` means. This is the same situation as #125, which was fixed by #126. ### Change Update the three pins to SHAs that are currently on the ASF allow list **without** an `expires_at`, so the pipeline does not break again on the next expiry: - `docker/setup-buildx-action` → `f87e5991a6d7451dcb8d9637bfbc97413f497069` (v4.4.1) - `docker/login-action` → `dbcb813823bdd20940b903addbd779551569679f` (v4.6.0) - `docker/build-push-action` → `c3c9e263c25d99ce0380d002d59b67737d91b0dc` (v7.4.0) The inputs used by this workflow (`registry` / `username` / `password`; `context` / `file` / `platforms` / `pull` / `push` / `tags` / `build-args` / `cache-from` / `cache-to`) are unchanged across these major versions. `actions/checkout` and `actions/github-script` are GitHub-owned and not subject to the allow list. ### Verification The workflow also runs on `pull_request` (build without push), so this PR's own check run shows whether the workflow starts again. After merge, the next hourly scheduled run should detect that `5.5.1` is missing on Docker Hub and publish it. Maintainers may prefer to pick whichever SHAs are newest on the allow list at merge time — the key point is that the current pins have been removed from it -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
