This is an automated email from the ASF dual-hosted git repository.
xushiyan pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/hudi-rs.git
The following commit(s) were added to refs/heads/main by this push:
new 5ad7c4a1 ci: use action refs the ASF allowlist accepts (#674)
5ad7c4a1 is described below
commit 5ad7c4a1e66bd90227c1a114f889fde821171fbf
Author: Lin Liu <[email protected]>
AuthorDate: Sun Aug 9 12:18:21 2026 -0700
ci: use action refs the ASF allowlist accepts (#674)
Every CI and Code run since 2026-06-05 has ended in "Startup failure" — on
every pull request, from every contributor. An action ref that is not on the
ASF org allowlist does not fail loudly: the run produces no logs and no
notification, and the pull request looks green because no check ever
reported.
Three refs are off the list: astral-sh/setup-uv and
docker/setup-buildx-action
were pinned to commits the allowlist does not carry, and
Swatinem/rust-cache is
listed under a lower-case owner. Move each to an allowlisted ref, and add
the
check that would have caught this the day it broke.
Co-authored-by: Claude Opus 5 <[email protected]>
---
.../{code.yml => asf-allowlist-check.yml} | 52 +++++++---------------
.github/workflows/ci.yml | 8 ++--
.github/workflows/code.yml | 2 +-
3 files changed, 21 insertions(+), 41 deletions(-)
diff --git a/.github/workflows/code.yml
b/.github/workflows/asf-allowlist-check.yml
similarity index 53%
copy from .github/workflows/code.yml
copy to .github/workflows/asf-allowlist-check.yml
index db350146..4877adc7 100644
--- a/.github/workflows/code.yml
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -15,51 +15,31 @@
# specific language governing permissions and limitations
# under the License.
-name: Code
+# An action ref that is not on the ASF allowlist does not fail loudly — the run
+# ends in "Startup failure" with no logs and no notification, and the pull
+# request looks green because no check ever reported. This job is the only
thing
+# that makes such a ref visible. See
+# https://github.com/apache/infrastructure-actions/issues/574
+name: ASF Allowlist Check
on:
- push:
+ workflow_dispatch:
+ pull_request:
branches:
- main
- - release/**
- pull_request:
+ push:
branches:
- main
+ - release/**
+
+permissions:
+ contents: read
jobs:
- check-code:
+ asf-allowlist-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
-
- - name: Check license header
- uses: apache/skywalking-eyes/[email protected]
-
- - name: Install system dependencies
- run: |
- sudo apt-get update
- sudo apt-get install -y protobuf-compiler
-
- - name: Install uv
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
with:
- version: "0.7.19"
-
- - name: Check rust code style
- run: make check-rust
-
- - name: Setup Python
- uses: actions/setup-python@v6
- with:
- python-version: '3.10'
-
- - name: Install python linter dependencies
- run: |
- make setup-venv
- source .venv/bin/activate
- uv pip install -r python/pyproject.toml --extra lint
-
- - name: Check python code style
- run: |
- source .venv/bin/activate
- make check-python
+ persist-credentials: false
+ - uses: apache/infrastructure-actions/allowlist-check@main
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 902e35dd..f1fb1556 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,7 +65,7 @@ jobs:
apt-get update
apt-get install -y protobuf-compiler
- name: Cache dependencies
- uses: Swatinem/rust-cache@v2
+ uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 #
v2.9.2
with:
# Only cache cargo registry and git, not target directory
# Tarpaulin needs clean builds for accurate coverage
@@ -120,7 +120,7 @@ jobs:
# Cache Rust dependencies and build artifacts
- name: Cache Rust dependencies
- uses: Swatinem/rust-cache@v2
+ uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 #
v2.9.2
with:
# Cache based on Python version and OS for better hit rate
shared-key: "python-binding-${{ matrix.os }}-py${{
matrix.python-version }}"
@@ -128,7 +128,7 @@ jobs:
save-if: ${{ github.ref == 'refs/heads/main' || github.event_name ==
'pull_request' }}
- name: install uv and set the python version
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
+ uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 #
v8.3.2
with:
version: "0.7.19"
python-version: ${{ matrix.python-version }}
@@ -181,7 +181,7 @@ jobs:
steps:
- uses: actions/checkout@v6
- name: Set up Docker Buildx
- uses:
docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+ uses:
docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
- name: Pre-pull base images
run: |
docker pull quay.io/minio/minio:latest
diff --git a/.github/workflows/code.yml b/.github/workflows/code.yml
index db350146..71e87cb3 100644
--- a/.github/workflows/code.yml
+++ b/.github/workflows/code.yml
@@ -41,7 +41,7 @@ jobs:
sudo apt-get install -y protobuf-compiler
- name: Install uv
- uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
+ uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 #
v8.3.2
with:
version: "0.7.19"
