Gautham Banasandra created HADOOP-20050:
-------------------------------------------
Summary: Bump expired GitHub Actions pins to ASF-allowlisted
versions and add Dependabot
Key: HADOOP-20050
URL: https://issues.apache.org/jira/browse/HADOOP-20050
Project: Hadoop Common
Issue Type: Bug
Components: hadoop-common
Affects Versions: 3.5.0
Reporter: Gautham Banasandra
Assignee: Gautham Banasandra
Fix For: 3.5.0
h3. Problem
Since 2026-10-17, every {{Build}} ({{build_and_test.yml}}) and {{Image Cache}}
({{build_image_cache.yml}}) run in apache/hadoop has ended in
{{startup_failure}}, with no logs. The run annotation says:
{quote}The action docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c
is not allowed in apache/hadoop{quote}
ASF Infra removed that pin (v4.5.0) from the [action
allowlist|https://github.com/apache/infrastructure-actions/blob/main/actions.yml]
on 2026-10-16. Forks are not subject to the allowlist, so PR builds in
contributors' forks kept passing and nobody noticed. The upstream image cache
has not been refreshed since 2026-09-18.
First failing run: https://github.com/apache/hadoop/actions/runs/39033320107
Three more pins are about to be removed:
||Action||Pinned version||Removed from allowlist||
|docker/login-action|v4.5.0|2026-10-16 (already removed)|
|docker/setup-buildx-action|v4.2.0|2026-11-19|
|docker/build-push-action|v7.3.0|2026-12-09|
|dorny/test-reporter|v3.0.0|2026-12-27|
This is the third time an expired pin has broken CI (HADOOP-19893,
HADOOP-19933). The repository has no Dependabot configuration, although the
[ASF GitHub Actions policy|https://infra.apache.org/github-actions-policy.html]
requires one, so nothing proposes bumps before pins expire.
h3. Proposed fix
# Bump the four pins to allowlisted versions that have no expiry date:
docker/login-action v4.7.0, docker/setup-buildx-action v4.4.1,
docker/build-push-action v7.4.0, dorny/test-reporter v3.2.0.
# Add {{.github/dependabot.yml}} for the github-actions ecosystem, covering the
workflows and the composite actions under {{.github/actions}}. Weekly grouped
updates, with security updates in a separate group and a 7-day cooldown, as
required by SECURITY.md.
# Add an "ASF Allowlist Check" workflow using
{{apache/infrastructure-actions/allowlist-check}}. It fails a PR that touches
{{.github/}} when a ref is not on the allowlist, warns 30 days before an
allowlisted pin expires, and runs weekly on apache/hadoop.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
