The GitHub Actions job "Required Checks" on texera.git/main has failed. Run started by GitHub user github-merge-queue[bot] (triggered by github-merge-queue[bot]).
Head commit for run: 7a2c8d03b5a81a895ba12e7c616c961bcc420048 / Xinyuan Lin <[email protected]> fix(deps, ci): bump sbt/setup-sbt to v1.5.7 to restore CI (#7710) ### What changes were proposed in this PR? CI has been red repo-wide since 2026-08-16 ~02:00 UTC — `main`, the merge queue, and every PR that runs a Scala stack. The jobs die in 3–7s during *Prepare all required actions*, before checkout, so they produce no test output at all. The cause is the ASF actions allowlist, not anything in this repository. `sbt/setup-sbt` reaches a nested `carabiner-dev` action that is no longer permitted: ``` .github/workflows/*.yml └─ sbt/setup-sbt@6444f4c v1.5.2 allowed └─ carabiner-dev/actions/ampel/verify@94f2939 v1.2.1 allowed └─ carabiner-dev/actions/install/ampel@2a11d59 v1.1.7 BLOCKED ``` > The action carabiner-dev/actions/install/ampel@2a11d59a135c5e291f305f249a92ad7903e3ee0f is not allowed in apache/texera because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: … Nothing in the tree changed — every link in that chain is SHA-pinned, and the `sbt/setup-sbt` pin last moved in #6710 on 2026-07-22. The same `2a11d59` downloaded successfully at `2026-08-15T02:01Z` (#7674's amber job) and is rejected at `2026-08-17T02:13Z`. Last clean run before the break: merge-queue `pr-7699` at `2026-08-16T01:52:00Z`; first failure: `main` at `2026-08-16T02:04:42Z`. This bumps all 9 call sites from v1.5.2 to v1.5.7, which resolves down a different path: | | v1.5.2 (current) | v1.5.7 (this PR) | | --- | --- | --- | | `ampel/verify` | `94f2939` (v1.2.1) | `36a39ef` (v1.2.6) | | `install/ampel` | **`2a11d59` — blocked** | `2fec8bd8` | | `install/bnd` | `2a11d59` | no longer referenced | Call sites: `benchmarks.yml` (1), `build-and-push-images.yml` (3), `build.yml` (4), `dependency-graph.yml` (1). > Reviewer note — one thing I could not verify up front. The org allowlist is not readable without repo-admin (`403`), and the error message truncates the pattern list before the `carabiner-dev` entries, so I could not confirm in advance that `2fec8bd8` is permitted. **This PR's own CI run is the experiment.** If it fails on the same error, the bump is a dead end and the fallback is an INFRA request to re-allow `carabiner-dev/actions@2a11d59a135c5e291f305f249a92ad7903e3ee0f`. ### Any related issues, documentation, discussions? No issue filed — the regression originates outside the repository and this PR is the unblock. The previous bump of this pin was #6710. ### How was this PR tested? By this PR's CI, which is the only place the failure reproduces — it depends on the `apache/texera` actions policy and cannot be triggered locally or on a fork. The change touches `.github/**`, so the labeler applies `ci`, and `ci` maps to every stack in `LABEL_STACKS` (`.github/workflows/precheck.yml`) — `frontend`, `amber`, `amber-integration`, `platform`, `platform-integration`, `pyamber`, `agent-service`, `infra`, `pyright-language-service` — plus `Bench`. Every job that consumes `sbt/setup-sbt` is therefore exercised here. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Claude Opus 5) Report URL: https://github.com/apache/texera/actions/runs/31991977499 With regards, GitHub Actions via GitBox
