flyrain commented on PR #4847: URL: https://github.com/apache/polaris/pull/4847#issuecomment-4765147270
The composite action at .github/actions/ci-incr-build-cache-prepare/action.yml:74 pins: uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 The Apache org enforces an allowlist of permitted GitHub Actions (by SHA). That specific v5 SHA is not on the ASF allowlist, so GitHub refuses to download the action and the job fails immediately. Why it's in this state — the history shows churn: - e7ebe8dab bumped gradle/actions to v6 (#4512) - 382613ada reverted back to v5 (#4518) — because, per the renovate.json5 comment, "v6 defaults to the proprietary enhanced caching provider" The v5 SHA that the revert landed on apparently was never added to (or was dropped from) the ASF org allowlist. This affects every PR, not just #4847, since it's the same composite action used across CI. Two ways to resolve it: 1. Get the SHA allowlisted — file an ASF INFRA Jira ticket to add gradle/actions@0723195856401067f7a2779048b490ace7a47d7c to the apache org allowed-actions list. (The "correct" fix, since the pin is intentional.) 2. Re-pin to an already-allowlisted SHA of gradle/actions/setup-gradle v5 — only works if a different v5 SHA is already on the list. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
