xuang7 opened a new pull request, #7581: URL: https://github.com/apache/texera/pull/7581
### What changes were proposed in this PR? CI on `release/v1.2` fails at workflow parse because the branch pins `coursier/cache-action` v8.1.0, whose ASF actions-allowlist entry expired on 2026-08-05 (v8.1.1 was approved in July with a one-month grace for the old SHA). The docker action pins on the branch have allowlist expiry dates of Aug 16/19, so they are bumped in the same pass instead of waiting for the next breakage. All five pins move to the SHAs `main` already uses (allowlisted, exercised on `main` daily): | Action | v1.2 pin | New pin (= main) | | --- | --- | --- | | coursier/cache-action | v8.1.0 (expired Aug 5) | v8.1.1 | | docker/build-push-action | v7.1.0 (expires Aug 16) | v7.3.0 | | docker/login-action | v4.1.0 (expires Aug 16) | v4.4.0 | | docker/setup-buildx-action | v4.0.0 (expires Aug 16) | v4.2.0 | | docker/setup-qemu-action | v4.0.0 (expires Aug 19) | v4.2.0 | Only `uses:` lines change; no job logic is touched. ### Any related issues, documentation, discussions? Fixes #7572. ### How was this PR tested? YAML validated; every new SHA checked against the current `apache/infrastructure-actions` allowlist (`actions.yml`): the coursier/build-push/buildx/qemu entries carry no expiry, and login-action matches `main`'s Oct 16 lease. The coursier bump is exercised by this PR's own sbt CI legs; the docker pins are the same SHAs `main`'s daily image publishing runs. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 4.8) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
