xanderbailey opened a new pull request, #3193: URL: https://github.com/apache/iceberg-rust/pull/3193
## Which issue does this PR close? - None. Fixes a CI regression on `main` introduced by the interaction of #3161 and #3189. ## What changes are included in this PR? CI is currently red on `main` and on every open PR. Jobs fail at action-resolution time, before anything is built: ``` Can't find 'action.yml', 'action.yaml' or 'Dockerfile' for action 'apache/iceberg-rust/.github/actions/setup-builder@<sha>' ``` ### Cause Two changes that are each fine in isolation: - #3161 migrated 22 local action references from `./...` to GitHub self-repository `$/...` references, to resolve a zizmor 1.30 audit. CI passed on that commit and for three days afterwards. - #3189 added `.github export-ignore` to `.gitattributes`, to trim repo-only files from the release source archive. GitHub resolves a `uses: $/...` reference by fetching a repository archive, and those archives honour `export-ignore`. Excluding `.github` wholesale therefore hides `.github/actions` from that fetch, so every workflow using a local composite action (`setup-builder`, `get-msrv`, `overwrite-package-version`) fails to resolve it. `./...` references read the checked-out worktree and were unaffected, which is why this only surfaced once both changes were on `main`. Timeline on `main` (workflow `CI`): | commit | result | |---|---| | `1deceb138` #3161 — `$/` migration, 09-07 | success | | `28ede505e` … `4d83bc77d`, 09-07 → 09-09 | success | | `d6c2eb440` #3189 — `.github export-ignore`, 09-10 | **failure** | ### Fix List the `.github` entries individually rather than excluding the directory, so the repo-only files #3189 targeted stay out of the tarball while `.github/actions` remains resolvable. A `-export-ignore` negation on the subdirectory does not work — git does not descend into an export-ignored directory, so the child attribute is never consulted. Verified below. This keeps both earlier changes intact: no `$/` reference is reverted, and no zizmor suppression is added. ## Are these changes tested? `git archive --worktree-attributes HEAD | tar t`, comparing attribute sets: | `.gitattributes` | `.github/actions` | `.github/workflows` | other `.github` | |---|---|---|---| | `main` today | 0 | 0 | 0 | | `.github export-ignore` + `.github/actions -export-ignore` | 0 | 0 | 0 | | this PR | **7** | 0 | 0 | Everything else #3189 excluded (`website`, `.asf.yaml`, `.devcontainer`, `.gitattributes`, `.gitignore`, `.idea`) remains excluded — verified as 0 entries each. The action-resolution half can only be verified by CI, since it depends on GitHub's archive fetch. This PR's own checks are the test: they should resolve `setup-builder` and run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
