MonkeyCanCode commented on PR #4847: URL: https://github.com/apache/polaris/pull/4847#issuecomment-4775901963
> The composite action at .github/actions/ci-incr-build-cache-prepare/action.yml:74 pins: > > uses: [gradle/actions@0723195](https://github.com/gradle/actions/commit/0723195856401067f7a2779048b490ace7a47d7c) # v5 > > The Apache org enforces an allowlist of permitted GitHub Actions (by SHA). That specific v5 SHA is not on the ASF allowlist, so GitHub refuses to download the action and the job fails immediately. > > Why it's in this state — the history shows churn: > > * [e7ebe8d](https://github.com/apache/polaris/commit/e7ebe8dab2a67c4db908d1f73c222efd18d2a7cf) bumped gradle/actions to v6 ([Update gradle/actions action to v6 #4512](https://github.com/apache/polaris/pull/4512)) > * [382613a](https://github.com/apache/polaris/commit/382613adac5c0b8e482c0392ef5b9a8b728633fd) reverted back to v5 ([Revert update gradle/actions action to v5 #4518](https://github.com/apache/polaris/pull/4518)) — because, per the renovate.json5 comment, "v6 defaults to the proprietary enhanced caching provider" > > The v5 SHA that the revert landed on apparently was never added to (or was dropped from) the ASF org allowlist. > > This affects every PR, not just #4847, since it's the same composite action used across CI. > > Two ways to resolve it: > > 1. Get the SHA allowlisted — file an ASF INFRA Jira ticket to add [gradle/actions@0723195](https://github.com/gradle/actions/commit/0723195856401067f7a2779048b490ace7a47d7c) to the apache org allowed-actions list. (The "correct" fix, since the pin is intentional.) > 2. Re-pin to an already-allowlisted SHA of gradle/actions/setup-gradle v5 — only works if a different v5 SHA is already on the list. As the hash got added back, I will proceed with the merge shortly after change review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
