dongjoon-hyun opened a new pull request, #907: URL: https://github.com/apache/spark-kubernetes-operator/pull/907
### What changes were proposed in this pull request? This PR aims to update the following GitHub Actions to their latest versions. | Action | Before | After | |---|---|---| | `docker/setup-qemu-action` | v4.2.0 | [v4.4.0](https://github.com/docker/setup-qemu-action/releases/tag/v4.4.0) (2026-09-15) | | `docker/setup-buildx-action` | v4.3.0 | [v4.4.1](https://github.com/docker/setup-buildx-action/releases/tag/v4.4.1) (2026-09-16) | | `docker/build-push-action` | v7.3.0 | [v7.4.0](https://github.com/docker/build-push-action/releases/tag/v7.4.0) (2026-09-15) | | `burnett01/rsync-deployments` | v8.0.5 | [v9.0.1](https://github.com/Burnett01/rsync-deployments/releases/tag/9.0.1) (2026-09-04) | | `apache/skywalking-eyes` | v0.8.0 | [v0.9.0](https://github.com/apache/skywalking-eyes/releases/tag/v0.9.0) (2026-09-01) | All actions remain pinned to commit SHAs. Except for `apache/skywalking-eyes`, every SHA is listed in the ASF [approved_patterns.yml](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml). - `apache/skywalking-eyes` is under the `apache/*` organization, so it is not subject to the approved list. - The previous `apache/skywalking-eyes` pin (`e9f91c35`) was the SHA of the annotated `v0.8.0` tag object, not of the commit. The new pin (`a196742f`) is the `v0.9.0` commit SHA. - `gradle/actions/setup-gradle` is intentionally kept at v6.3.0. The latest v6.4.0 (2026-09-28) is not in the approved list yet (apache/infrastructure-actions#1339 is still open). - All `actions/*` actions and `medyagh/setup-minikube` are already at their latest versions. ### Why are the changes needed? To keep CI up to date with the latest bug fixes and security patches while complying with the ASF policy on pinned, approved GitHub Actions. - `burnett01/rsync-deployments` v9 updates the Alpine base image to 3.24.1 and picks up the rsync 3.5.0 CVE fixes. The inputs used by `publish_snapshot_chart.yml` are unchanged. - `apache/skywalking-eyes` v0.9.0 has no breaking change for the current `.github/.licenserc.yaml`. ### Does this PR introduce _any_ user-facing change? No. This only changes CI workflows. ### How was this patch tested? Pass the CIs. The updated SHAs were verified against the `approved_patterns.yml` of `apache/infrastructure-actions`. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Sonnet 5.5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
