[
https://issues.apache.org/jira/browse/HADOOP-20056?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18136747#comment-18136747
]
ASF GitHub Bot commented on HADOOP-20056:
-----------------------------------------
hadoop-yetus commented on PR #8912:
URL: https://github.com/apache/hadoop/pull/8912#issuecomment-6587443916
:confetti_ball: **+1 overall**
| Vote | Subsystem | Runtime | Logfile | Comment |
|:----:|----------:|--------:|:--------:|:-------:|
| +0 :ok: | reexec | 1m 5s | | Docker mode activated. |
|||| _ Prechecks _ |
| +1 :green_heart: | dupname | 0m 0s | | No case conflicting files
found. |
| +0 :ok: | codespell | 0m 0s | | codespell was not available. |
| +0 :ok: | detsecrets | 0m 0s | | detect-secrets was not available.
|
| +0 :ok: | yamllint | 0m 0s | | yamllint was not available. |
| +0 :ok: | markdownlint | 0m 0s | | markdownlint was not available.
|
| +1 :green_heart: | @author | 0m 0s | | The patch does not contain
any @author tags. |
|||| _ trunk Compile Tests _ |
| +1 :green_heart: | mvninstall | 45m 49s | | trunk passed |
| +1 :green_heart: | mvnsite | 19m 41s | | trunk passed |
| +1 :green_heart: | shadedclient | 96m 39s | | branch has no errors
when building and testing our client artifacts. |
|||| _ Patch Compile Tests _ |
| +1 :green_heart: | mvninstall | 36m 57s | | the patch passed |
| +1 :green_heart: | blanks | 0m 1s | | The patch has no blanks
issues. |
| +1 :green_heart: | mvnsite | 18m 35s | | the patch passed |
| +1 :green_heart: | shadedclient | 46m 35s | | patch has no errors
when building and testing our client artifacts. |
|||| _ Other Tests _ |
| +1 :green_heart: | asflicense | 0m 51s | | The patch does not
generate ASF License warnings. |
| | | 184m 19s | | |
| Subsystem | Report/Notes |
|----------:|:-------------|
| Docker | ClientAPI=1.56 ServerAPI=1.56 base:
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8912/1/artifact/out/Dockerfile
|
| GITHUB PR | https://github.com/apache/hadoop/pull/8912 |
| Optional Tests | dupname asflicense codespell detsecrets yamllint mvnsite
markdownlint |
| uname | Linux 207431ade37d 5.15.0-190-generic #200-Ubuntu SMP Fri Aug 7
15:06:04 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux |
| Build tool | maven |
| Personality | dev-support/bin/hadoop.sh |
| git revision | trunk / f954cd736101bdcda3a61775a596625a125fa49d |
| Max. process+thread count | 610 (vs. ulimit of 10000) |
| modules | C: . U: . |
| Console output |
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8912/1/console |
| versions | git=2.43.0 maven=3.9.15 |
| Powered by | Apache Yetus 0.14.1 https://yetus.apache.org |
This message was automatically generated.
> Replace the pull_request_target "Build" check bridge with ASF fork-ci
> ---------------------------------------------------------------------
>
> Key: HADOOP-20056
> URL: https://issues.apache.org/jira/browse/HADOOP-20056
> Project: Hadoop Common
> Issue Type: Bug
> Components: hadoop-common
> Affects Versions: 3.5.0
> Reporter: Gautham Banasandra
> Assignee: Gautham Banasandra
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.5.0
>
>
> ASF Infra disables the {{pull_request_target}} trigger for ASF repositories
> from November 2026 ([ASF GitHub Actions
> policy|https://infra.apache.org/github-actions-policy.html]). ASF
> repositories cannot opt back in.
> Hadoop uses {{pull_request_target}} to put the "Build" check on pull
> requests. Contributors run {{build_and_test.yml}} in their own fork on
> {{push}}, and two upstream workflows mirror that run onto the PR:
> * {{notify_test_workflow.yml}} ({{pull_request_target}}) finds the fork's run
> and creates the "Build" check.
> * {{update_build_status.yml}} (cron, every 15 minutes) updates the check
> until the fork run completes.
> Once the trigger is disabled, PRs lose the "Build" check.
> h3. Proposal
> Replace both workflows with one schedule-driven bridge built on ASF Infra's
> [fork-ci
> action|https://github.com/apache/infrastructure-actions/tree/fork-ci/v1.0.0/fork-ci]
> ({{fork-ci/v1.0.0}}):
> * Add {{.github/workflows/fork_ci_status.yml}}. It is triggered only by
> {{schedule}} (every 10 minutes) and {{workflow_dispatch}}. It has no
> {{pull_request_target}} and no {{workflow_run}} trigger, which SECURITY.md
> disallows and zizmor flags as a dangerous trigger.
> * The job token has only {{actions: read}}, {{checks: write}} and
> {{pull-requests: read}}. The workflow is guarded to {{apache/hadoop}},
> serialized in one concurrency group, and runs on {{ubuntu-slim}} with a
> 10-minute timeout. The action is pinned by commit SHA.
> * fork-ci reads GitHub API metadata only. It never checks out, builds or
> downloads anything from the PR or the fork, and it writes only its own checks.
> * Keep the check name "Build". Mirror PRs against {{trunk}}, the only branch
> that currently has {{build_and_test.yml}}.
> * Add {{workflow_dispatch}} to {{build_and_test.yml}}, as fork-ci requires.
> Contributors can then rerun the build on their PR branch without pushing
> again.
> * Delete {{notify_test_workflow.yml}} and {{update_build_status.yml}} in the
> same change, so two bridges never write "Build" checks at the same time.
> * Update {{.github/workflow-security.md}} to describe the new bridge and the
> {{schedule}} / {{workflow_dispatch}} triggers.
> h3. Behaviour changes for contributors
> * A new PR's "Build" check appears on the next scheduled run, typically
> within 10-20 minutes, instead of right after the PR is opened.
> * If no fork run is found, the check is now "neutral" with setup advice
> instead of "action required". Disabled fork workflows still get "action
> required".
> * On PRs that are open at the cutover, the old "Build" check stops updating,
> and a new "Build" check appears beside it until the next push.
> h3. Out of scope (follow-ups)
> * {{labeler.yml}} and {{notify_cloud_aws.yml}} also use
> {{pull_request_target}} and need their own migration before the cutoff.
> * A "Build (Windows)" check for the planned {{build_and_test_windows.yml}}
> can be added later as a second fork-ci step in the same workflow.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
