kz930 opened a new pull request, #9092: URL: https://github.com/apache/texera/pull/9092
### What changes were proposed in this PR? Pin `sbt/setup-sbt` to v1.5.12 (`ecad189`) in place of v1.5.7 (`8feba82`), in all nine places across `build.yml`, `benchmarks.yml`, `build-and-push-images.yml` and `dependency-graph.yml`. Every job that sets up sbt fails before its first step, because GitHub resolves each action the job references, including the ones an action uses inside itself, and checks it against the ASF allowlist. setup-sbt verifies the sbt download with carabiner's `ampel/verify`, and three of the commits v1.5.7 reaches that way are no longer listed: | setup-sbt | ampel/verify | install/ampel | install/download-and-verify | install/ampel-bootstrap | | --- | --- | --- | --- | --- | | v1.5.7 (now) | `36a39ef` listed | `2fec8bd8` not listed | `16009dca` not listed | `619a474b` not listed | | v1.5.12 | `32587e82` listed | `d6d91c5c` listed | `2fec8bd8` listed | `16009dca` listed | The workflows pass setup-sbt no inputs, and the releases since v1.5.7 change only the sbt version it installs and the action's own dependencies. ### Any related issues, documentation, discussions? Closes #9044 `docker/login-action` v4.4.0 in `build-and-push-images.yml` has also dropped off the allowlist, which lists only v4.6.0 now. That workflow does not run on pull requests or in the merge queue, so it is left to a separate change. ### How was this PR tested? I followed each action's `uses:` from both setup-sbt commits and checked every commit against `actions.yml` in apache/infrastructure-actions, which gives the table above. A fork does not enforce the allowlist, so this PR's own CI is the real test: a pull request runs the workflow files it changes. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Claude Opus 5.5) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
