slachiewicz opened a new pull request, #1730: URL: https://github.com/apache/maven-mvnd/pull/1730
The apache org only permits action SHAs present in [`apache/infrastructure-actions/approved_patterns.yml`](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml). When a bump PR is opened before INFRA's allowlist review lands the new SHA, `Early Access` ends in `startup_failure` and **no check is attached to the PR at all** — it reads as if CI were never configured for the branch. Dependabot's built-in cooldown is 3 days; INFRA's turnaround has been closer to a week. `graalvm/setup-graalvm` v1.6.4 was released 06 Aug, the PRs opened 10 Aug, and the SHA was allowlisted 12 Aug in apache/infrastructure-actions#1165 — so #1723 and #1724 both sat dead until a manual `@dependabot rebase`. The same thing silently killed the 1.6.0, 1.6.1 and 1.6.2 bumps, all closed unmerged. 10 days clears the observed gap with margin. The cost is that every action bump, allowlisted or not, waits that long. It is not a guarantee — if a future review is slower, the fallback is still `@dependabot rebase` once the SHA appears. Only master's `dependabot.yml` is in scope: Dependabot reads its config solely from the default branch, so the copy on `mvnd-1.x` is inert and the `target-branch: mvnd-1.x` entries here are what actually drive that branch's PRs. Generated-by: Claude Opus 5 (1M context) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
