[
https://issues.apache.org/jira/browse/HADOOP-20050?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135852#comment-18135852
]
ASF GitHub Bot commented on HADOOP-20050:
-----------------------------------------
GauthamBanasandra opened a new pull request, #8906:
URL: https://github.com/apache/hadoop/pull/8906
### Description of PR
JIRA: https://issues.apache.org/jira/browse/HADOOP-20050
Every `Build` and `Image Cache` run in apache/hadoop has ended in
`startup_failure` since
2026-10-17 (first:
https://github.com/apache/hadoop/actions/runs/39033320107). The annotation on
run 41101032776 says:
> The action docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c is
not allowed in apache/hadoop
ASF Infra removed that SHA from the
[action
allowlist](https://github.com/apache/infrastructure-actions/blob/main/actions.yml)
on
2026-10-16. Forks aren't subject to the allowlist, so PR builds kept passing
and nobody noticed. The
upstream image cache was last refreshed on 2026-09-18.
**Pin bumps.** All four new SHAs are listed in `actions.yml` with no expiry,
and each matches its
upstream release tag:
| Action | From | To | Old pin's status |
|---|---|---|---|
| `docker/login-action` | v4.5.0 `06fb636f` | v4.7.0 `81c6f93d` | removed
2026-10-16 |
| `docker/setup-buildx-action` | v4.2.0 `bb05f3f5` | v4.4.1 `f87e5991` |
expires 2026-11-19 |
| `docker/build-push-action` | v7.3.0 `53b7df96` | v7.4.0 `c3c9e263` |
expires 2026-12-09 |
| `dorny/test-reporter` | v3.0.0 `a43b3a5f` | v3.2.0 `d1b5dff0` | expires
2026-12-27 |
None of the inputs we use changed between these versions. The docker actions
gained hardening and
Docker Hub OIDC changes. dorny added an optional `list-files` input and
nested-testsuite support for
`java-junit`.
**Stopping it from recurring.** This is the third time an expired pin has
caused
`startup_failure` (HADOOP-19893, HADOOP-19933).
- `.github/dependabot.yml`
- Covers the `github-actions` ecosystem for `/` (workflows) and
`/.github/actions/*` (composite actions).
- Runs weekly, with grouped version updates and a separate group for
security updates.
- Uses a 7-day cooldown. SECURITY.md requires a cooldown, ASF suggests 4
days, and zizmor requires at least 7. A longer cooldown also gives Infra time
to allowlist a new release before Dependabot proposes it.
- The ASF GitHub Actions policy makes Dependabot or Renovate mandatory.
- `.github/workflows/asf_allowlist_check.yml`
- Runs
[`apache/infrastructure-actions/allowlist-check`](https://github.com/apache/infrastructure-actions/tree/main/allowlist-check)
(v1.0.4, SHA-pinned) on PRs touching `.github/**`, on trunk pushes, and weekly.
- Fails on refs that aren't allowlisted and warns 30 days before a pin
expires.
- Has read-only permissions and runs on `ubuntu-slim`.
### How was this patch tested?
- Checked each new SHA against `actions.yml` and against `git ls-remote` of
the upstream tag.
- Simulated the allowlist check locally over every `uses:` in `.github/`: 0
violations, and no pin with an expiry date.
- `actionlint` 1.7.12: clean on all changed workflows.
- `zizmor` 1.31.1, with online audits so impostor-commit checks ran: the two
new files have no findings. The four edited files have the same 25 findings
before and after this change; all are pre-existing and out of scope (tag-pinned
`actions/*`, template injection, `workflow_run`, unpinned `container:` images).
- A push of this branch to my fork ran `Build` with the bumped docker
actions, and every job passed: all three image builds, both build-only jobs and
the full ubuntu_24 test matrix
(https://github.com/GauthamBanasandra/hadoop/actions/runs/41196179730).
- That run doesn't exercise `dorny/test-reporter`, which only
`report_cloud_aws.yml` uses. The new allowlist check runs on this PR itself.
- The real check is after merge: the next trunk `Build` run in apache/hadoop
should start instead of ending in `startup_failure`.
Notes for reviewers:
- Dependabot opens PRs from `dependabot/**` branches in apache/hadoop.
`build_and_test.yml` runs on push to every branch, so each such PR costs one
upstream `Build` run on ASF minutes. Grouping keeps it to about one PR a week.
- Dependabot PRs don't receive Actions secrets. A Dependabot PR that touches
`.github/actions/build_image**` will trigger Cloud-AWS without
`LOCALSTACK_CI_KEY`, so that job may fail on it.
### For code changes:
- [x] Does the title of this PR start with the corresponding JIRA issue id
(e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: N/A
- [ ] New dependencies: N/A (CI-only action versions)
- [ ] LICENSE / NOTICE updates: N/A
### AI Tooling
- [x] The PR includes the phrase "Contains content generated by Claude Code".
- [x] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
🤖 Generated with [Claude Code](https://claude.com/claude-code)
> Bump expired GitHub Actions pins to ASF-allowlisted versions and add
> Dependabot
> -------------------------------------------------------------------------------
>
> Key: HADOOP-20050
> URL: https://issues.apache.org/jira/browse/HADOOP-20050
> Project: Hadoop Common
> Issue Type: Bug
> Components: hadoop-common
> Affects Versions: 3.5.0
> Reporter: Gautham Banasandra
> Assignee: Gautham Banasandra
> Priority: Major
> Fix For: 3.5.0
>
>
> h3. Problem
> Since 2026-10-17, every {{Build}} ({{build_and_test.yml}}) and {{Image
> Cache}} ({{build_image_cache.yml}}) run in apache/hadoop has ended in
> {{startup_failure}}, with no logs. The run annotation says:
> {quote}The action
> docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c is not allowed
> in apache/hadoop{quote}
> ASF Infra removed that pin (v4.5.0) from the [action
> allowlist|https://github.com/apache/infrastructure-actions/blob/main/actions.yml]
> on 2026-10-16. Forks are not subject to the allowlist, so PR builds in
> contributors' forks kept passing and nobody noticed. The upstream image cache
> has not been refreshed since 2026-09-18.
> First failing run: https://github.com/apache/hadoop/actions/runs/39033320107
> Three more pins are about to be removed:
> ||Action||Pinned version||Removed from allowlist||
> |docker/login-action|v4.5.0|2026-10-16 (already removed)|
> |docker/setup-buildx-action|v4.2.0|2026-11-19|
> |docker/build-push-action|v7.3.0|2026-12-09|
> |dorny/test-reporter|v3.0.0|2026-12-27|
> This is the third time an expired pin has broken CI (HADOOP-19893,
> HADOOP-19933). The repository has no Dependabot configuration, although the
> [ASF GitHub Actions
> policy|https://infra.apache.org/github-actions-policy.html] requires one, so
> nothing proposes bumps before pins expire.
> h3. Proposed fix
> # Bump the four pins to allowlisted versions that have no expiry date:
> docker/login-action v4.7.0, docker/setup-buildx-action v4.4.1,
> docker/build-push-action v7.4.0, dorny/test-reporter v3.2.0.
> # Add {{.github/dependabot.yml}} for the github-actions ecosystem, covering
> the workflows and the composite actions under {{.github/actions}}. Weekly
> grouped updates, with security updates in a separate group and a 7-day
> cooldown, as required by SECURITY.md.
> # Add an "ASF Allowlist Check" workflow using
> {{apache/infrastructure-actions/allowlist-check}}. It fails a PR that touches
> {{.github/}} when a ref is not on the allowlist, warns 30 days before an
> allowlisted pin expires, and runs weekly on apache/hadoop.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
