GauthamBanasandra opened a new pull request, #8906: URL: https://github.com/apache/hadoop/pull/8906
### Description of PR JIRA: https://issues.apache.org/jira/browse/HADOOP-20050 Every `Build` and `Image Cache` run in apache/hadoop has ended in `startup_failure` since 2026-10-17 (first: https://github.com/apache/hadoop/actions/runs/39033320107). The annotation on run 41101032776 says: > The action docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c is not allowed in apache/hadoop ASF Infra removed that SHA from the [action allowlist](https://github.com/apache/infrastructure-actions/blob/main/actions.yml) on 2026-10-16. Forks aren't subject to the allowlist, so PR builds kept passing and nobody noticed. The upstream image cache was last refreshed on 2026-09-18. **Pin bumps.** All four new SHAs are listed in `actions.yml` with no expiry, and each matches its upstream release tag: | Action | From | To | Old pin's status | |---|---|---|---| | `docker/login-action` | v4.5.0 `06fb636f` | v4.7.0 `81c6f93d` | removed 2026-10-16 | | `docker/setup-buildx-action` | v4.2.0 `bb05f3f5` | v4.4.1 `f87e5991` | expires 2026-11-19 | | `docker/build-push-action` | v7.3.0 `53b7df96` | v7.4.0 `c3c9e263` | expires 2026-12-09 | | `dorny/test-reporter` | v3.0.0 `a43b3a5f` | v3.2.0 `d1b5dff0` | expires 2026-12-27 | None of the inputs we use changed between these versions. The docker actions gained hardening and Docker Hub OIDC changes. dorny added an optional `list-files` input and nested-testsuite support for `java-junit`. **Stopping it from recurring.** This is the third time an expired pin has caused `startup_failure` (HADOOP-19893, HADOOP-19933). - `.github/dependabot.yml` - Covers the `github-actions` ecosystem for `/` (workflows) and `/.github/actions/*` (composite actions). - Runs weekly, with grouped version updates and a separate group for security updates. - Uses a 7-day cooldown. SECURITY.md requires a cooldown, ASF suggests 4 days, and zizmor requires at least 7. A longer cooldown also gives Infra time to allowlist a new release before Dependabot proposes it. - The ASF GitHub Actions policy makes Dependabot or Renovate mandatory. - `.github/workflows/asf_allowlist_check.yml` - Runs [`apache/infrastructure-actions/allowlist-check`](https://github.com/apache/infrastructure-actions/tree/main/allowlist-check) (v1.0.4, SHA-pinned) on PRs touching `.github/**`, on trunk pushes, and weekly. - Fails on refs that aren't allowlisted and warns 30 days before a pin expires. - Has read-only permissions and runs on `ubuntu-slim`. ### How was this patch tested? - Checked each new SHA against `actions.yml` and against `git ls-remote` of the upstream tag. - Simulated the allowlist check locally over every `uses:` in `.github/`: 0 violations, and no pin with an expiry date. - `actionlint` 1.7.12: clean on all changed workflows. - `zizmor` 1.31.1, with online audits so impostor-commit checks ran: the two new files have no findings. The four edited files have the same 25 findings before and after this change; all are pre-existing and out of scope (tag-pinned `actions/*`, template injection, `workflow_run`, unpinned `container:` images). - A push of this branch to my fork ran `Build` with the bumped docker actions, and every job passed: all three image builds, both build-only jobs and the full ubuntu_24 test matrix (https://github.com/GauthamBanasandra/hadoop/actions/runs/41196179730). - That run doesn't exercise `dorny/test-reporter`, which only `report_cloud_aws.yml` uses. The new allowlist check runs on this PR itself. - The real check is after merge: the next trunk `Build` run in apache/hadoop should start instead of ending in `startup_failure`. Notes for reviewers: - Dependabot opens PRs from `dependabot/**` branches in apache/hadoop. `build_and_test.yml` runs on push to every branch, so each such PR costs one upstream `Build` run on ASF minutes. Grouping keeps it to about one PR a week. - Dependabot PRs don't receive Actions secrets. A Dependabot PR that touches `.github/actions/build_image**` will trigger Cloud-AWS without `LOCALSTACK_CI_KEY`, so that job may fail on it. ### For code changes: - [x] Does the title of this PR start with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')? - [ ] Object storage: N/A - [ ] New dependencies: N/A (CI-only action versions) - [ ] LICENSE / NOTICE updates: N/A ### AI Tooling - [x] The PR includes the phrase "Contains content generated by Claude Code". - [x] My use of AI contributions follows the ASF legal policy https://www.apache.org/legal/generative-tooling.html 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
