aglinxinyuan opened a new pull request, #9064:
URL: https://github.com/apache/texera/pull/9064
### What changes were proposed in this PR?
CI has been red since 2026-10-19 on `main` and on every PR that runs a Scala
stack (`amber`, `amber-integration`, `Bench`). The jobs die in under 40s at
*Set up job*, before checkout, so they produce no test output.
As in #7710, the cause is the ASF actions allowlist, not anything in this
repository. `sbt/setup-sbt` reaches nested `carabiner-dev` actions that are no
longer permitted:
```
.github/workflows/*.yml
└─ sbt/setup-sbt@8feba82 v1.5.7
allowed
└─ carabiner-dev/actions/ampel/verify@36a39ef v1.2.6
allowed
└─ carabiner-dev/actions/install/ampel@2fec8bd8
BLOCKED
└─ install/download-and-verify@16009dca
BLOCKED
└─ install/ampel-bootstrap@619a474
BLOCKED
```
> The action
carabiner-dev/actions/install/ampel-bootstrap@619a474b2178d06ccf274349397cd67a7802a4fe
is not allowed in apache/texera because all actions must be from a repository
owned by your enterprise, created by GitHub, or match one of the patterns: …
Nothing in the tree changed. `apache/infrastructure-actions` commit
`7a8ef18970` ("Remove Expired Refs", 2026-10-19T02:35Z) dropped the transitive
`ampel-bootstrap` refs that carabiner's older internal refs use. Last clean
run: `main` @ `a46ddc6e` at 2026-10-19T00:53Z. First failures: #9028 / #9029 at
07:07Z, and `main` @ `22b82a29` at 23:39Z.
This bumps all 9 call sites from v1.5.7 to v1.5.12, which resolves down a
fully allowed path:
| | v1.5.7 (current) | v1.5.12 (this PR) |
| --- | --- | --- |
| `ampel/verify` | `36a39ef` (v1.2.6) | `32587e8` |
| `install/ampel` | **`2fec8bd8` — blocked** | `d6d91c5` |
| `install/download-and-verify` | **`16009dca` — blocked** | `2fec8bd8` |
| `install/ampel-bootstrap` | **`619a474` — blocked** | `16009dca` |
Every link on the v1.5.12 side is in the current `approved_patterns.yml`,
and `actions.yml` gives v1.5.12 no expiry date (v1.5.7's own entry expires
2026-11-17). The action's inputs (`sbt-runner-version`, `disk-cache`) are the
same in both versions, so no call site needs editing beyond the pin.
Call sites: `benchmarks.yml` (1), `build-and-push-images.yml` (3),
`build.yml` (4), `dependency-graph.yml` (1).
`release/v1.2` and `release/v1.3` pin the same v1.5.7, so this carries their
backport labels. `release/v1.1` pins `setup-sbt@508b753`, which is not on the
allowlist either; it needs its own bump if that branch still runs CI.
### Any related issues, documentation, discussions?
No issue filed — the regression originates outside the repository and this
PR is the unblock. The previous bump of this pin was #7710.
### How was this PR tested?
By this PR's CI, which is the only place the failure reproduces — it depends
on the `apache/texera` actions policy and cannot be triggered locally or on a
fork.
The change touches `.github/**`, so the labeler applies `ci`, which runs
every stack in `LABEL_STACKS` plus `Bench`. Every job that uses `sbt/setup-sbt`
is exercised here.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Opus 5.5)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
