slachiewicz commented on issue #284: URL: https://github.com/apache/maven-gh-actions-shared/issues/284#issuecomment-5233441206
#300 fixes this on `v5`, but **not on `v4`**, and there are still branches pinning `v4` that hit it. The guard added by #300 is present on one branch only: ``` v5 ea600e09 2026-08-09 needs.setup-maven-version.result == 'success' present v4 91f6cada 2026-08-04 absent ``` That it works on `v5` is confirmed by real runs. `v5` picked the fix up at 09:47 today, and since then `pull_request` runs on non-fork branches in `apache/maven-resolver` come out as **`skipped`** rather than erroring — 11:47, 13:48, 14:53, 15:19 and 17:34 all clean. So the `if:` guard is enough; GitHub does not evaluate the `strategy` block once a needed job is skipped, which I had half expected to be the problem. The remaining failure is on the maintenance line. `apache/maven-resolver` run [31311660356](https://github.com/apache/maven-resolver/actions/runs/31311660356) failed at 11:47 today — after the fix — with no failed jobs, which is the signature of the workflow-level error rather than a build failure. Its branch is `dependabot/maven/maven-resolver-1.9.x/...`, and: ``` apache/maven-resolver @ maven-resolver-1.9.x -> maven-verify.yml@v4 apache/maven-wagon @ wagon-3.x -> maven-verify.yml@v4 ``` Both still pin `v4`. Other maintenance branches I checked are already on `v5` (`maven-plugin-tools-3.x`, `maven-filtering-3.x`, `maven-archiver-3.x`), so the exposure is narrow but live. Worth noting that GitHub code search returns zero hits for `maven-verify.yml@v4` across `org:apache`, because it only indexes default branches — so searching for affected consumers underreports this to nothing. The maintenance branches have to be checked directly. Two ways to close it, and they are not exclusive: 1. Cherry-pick #300 onto `v4`. One line, same change, and it fixes both branches above without them having to do anything. 2. Move `maven-resolver-1.9.x` and `wagon-3.x` to `@v5`. Better long-term, but it is a change per repository and per branch, and until it happens they stay broken. I would do (1) now regardless, since `v4` is still being maintained — #296 and #298 landed there this month — and anything else pinning it on a branch nobody has audited gets fixed for free. Happy to open the `v4` cherry-pick if that is wanted. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
