fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker - #66
Merged
Conversation
The workflow referenced docker/login-action, docker/setup-qemu-action and docker/setup-buildx-action by floating tag. The ASF GitHub Actions allow-list only approves specific commit SHAs for third-party actions, so the workflow is rejected at startup: the run for #65 ended in startup_failure and no image was published for that commit. Since publish-docker only runs on push-to-master, the rejection never surfaces in PR CI — it is only visible after a merge. Pin all three to the approved SHAs already used across the sibling ASF SkyWalking repositories (verified against apache/infrastructure-actions approved_patterns.yml): - docker/login-action@650006c6... # v4.2.0 - docker/setup-qemu-action@06116385... # v4.1.0 - docker/setup-buildx-action@d7f5e7f5... # v4.1.0 Merging this triggers a push-to-master build, which publishes an image containing the #65 concurrency fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
wankai123
approved these changes
Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
publish-dockerreferences three third-party actions by floating tag:The ASF GitHub Actions allow-list only approves specific commit SHAs for third-party actions, so the workflow is rejected before it starts. The run triggered by merging #65 ended in
startup_failure, so no image was published for that commit — the concurrency fix is on master but not in any published image.Because
publish-dockeronly runs on push-to-master (never on PRs), this rejection is invisible in PR CI and only shows up after a merge.Fix
Pin all three to the approved SHAs already used across the sibling ASF SkyWalking repositories (see apache/skywalking-python#406 for the same fix there). Each SHA was verified to be present in
apache/infrastructure-actions/approved_patterns.yml:docker/login-action650006c6eb7dba73a995cc03b0b2d7f5ca915beedocker/setup-qemu-action06116385d9baf250c9f4dcb4858b16962ea869c3docker/setup-buildx-actiond7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5actions/checkoutandactions/cacheneed no pin — theactions/*namespace is enterprise-owned and always allowed.Effect
Merging this is itself a push to master, which triggers a build that publishes an image containing the #65 concurrency fix, tagged with the new master SHA.