From 29a3cc8337aca48cde8a9e180a71aa7d86c8a0e1 Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Sat, 29 Aug 2026 01:37:12 +0300 Subject: [PATCH] [improve][ci] Upgrade GitHub Actions to latest and ASF-approved revisions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two Docker actions were pinned to SHAs that are not on the ASF org-wide allowlist: docker/setup-buildx-action@4d04d5d9 docker/setup-qemu-action@ce360397 A workflow referencing a non-allowlisted action fails with a bare "Startup failure": no logs, no notifications, and the PR can look green because no checks ran. PR #605 hit exactly this — its "PR validation" run never started, so the build and unit tests did not execute while CodeQL and Analyze(cpp) still reported success. Bump both to the latest approved revisions from apache/infrastructure-actions, and record the tag in a trailing comment so Dependabot can track them: docker/setup-buildx-action -> 37fe6310 # v4.3.0 docker/setup-qemu-action -> 96fe6ef7 # v4.2.0 docker/build-push-action 53b7df96 # v7.3.0 (already latest) Also update the GitHub-owned actions, which the ASF allowlist treats as implicitly trusted, to their latest majors: actions/checkout v3, v4 -> v7 actions/cache v3, v4 -> v6 actions/upload-artifact master -> v7 github/codeql-action v3 -> v4 jidicula/clang-format-action v4.11.0 -> v4.18.0 (allowlisted via *) actions/upload-artifact was tracking @master, an unpinned moving target. All four call sites already use unique artifact names, so the v4+ one-artifact-per-name rule is satisfied. --- .../workflows/ci-build-binary-artifacts.yaml | 24 ++++++------- .github/workflows/ci-pr-validation.yaml | 36 +++++++++---------- .github/workflows/codeql-analysis.yml | 6 ++-- 3 files changed, 33 insertions(+), 33 deletions(-) diff --git a/.github/workflows/ci-build-binary-artifacts.yaml b/.github/workflows/ci-build-binary-artifacts.yaml index 14557c7d..bdd70e99 100644 --- a/.github/workflows/ci-build-binary-artifacts.yaml +++ b/.github/workflows/ci-build-binary-artifacts.yaml @@ -47,10 +47,10 @@ jobs: steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 - name: Restore vcpkg binary cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/.cache/vcpkg/archives key: vcpkg-linux-${{matrix.pkg.type}}-${{matrix.cpu.platform}}-${{hashFiles('vcpkg.json')}} @@ -60,10 +60,10 @@ jobs: - name: Package Pulsar source run: build-support/generate-source-archive.sh - - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Build dependencies Docker image - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ./pkg/${{matrix.pkg.type}} load: true @@ -80,7 +80,7 @@ jobs: run: zip -r ${{matrix.pkg.type}}-${{matrix.cpu.platform}}.zip ${{matrix.pkg.path}} - name: Upload artifacts - uses: actions/upload-artifact@master + uses: actions/upload-artifact@v7 with: name: ${{matrix.pkg.type}}-${{matrix.cpu.platform}} path: ${{matrix.pkg.path}} @@ -111,10 +111,10 @@ jobs: steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 - name: Restore vcpkg and its artifacts. - uses: actions/cache@v3 + uses: actions/cache@v6 id: vcpkg-cache with: path: | @@ -166,7 +166,7 @@ jobs: run: 7z a -tzip pulsar-client-cpp-${{ matrix.triplet }}.zip ${{ env.INSTALL_DIR }}/* - name: Upload artifacts - uses: actions/upload-artifact@master + uses: actions/upload-artifact@v7 with: name: ${{ matrix.triplet }} path: ${{ env.INSTALL_DIR }} @@ -194,7 +194,7 @@ jobs: run: 7z a -tzip pulsar-client-cpp-${{ matrix.triplet }}-Debug.zip ${{ env.INSTALL_DIR }}-Debug/* - name: Upload artifacts (Debug) - uses: actions/upload-artifact@master + uses: actions/upload-artifact@v7 with: name: ${{ matrix.triplet }}-Debug path: ${{ env.INSTALL_DIR }}-Debug @@ -211,13 +211,13 @@ jobs: steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: recursive - name: Restore vcpkg binary cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ~/Library/Caches/vcpkg/archives key: vcpkg-macos-${{ matrix.arch }}-${{ hashFiles('vcpkg.json') }} @@ -236,7 +236,7 @@ jobs: cp macos-${{ matrix.arch }}.zip ../../../ - name: Upload artifacts - uses: actions/upload-artifact@master + uses: actions/upload-artifact@v7 with: name: macos-${{ matrix.arch }}.zip path: macos-${{ matrix.arch }}.zip diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml index b1d83cc2..bd2ea0c0 100644 --- a/.github/workflows/ci-pr-validation.yaml +++ b/.github/workflows/ci-pr-validation.yaml @@ -33,9 +33,9 @@ jobs: name: Formatting Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v7 - name: Run clang-format style check for C/C++/Protobuf programs. - uses: jidicula/clang-format-action@v4.11.0 + uses: jidicula/clang-format-action@v4.18.0 with: clang-format-version: '11' exclude-regex: '.*\.(proto|hpp)' @@ -52,7 +52,7 @@ jobs: steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 - name: Install deps (Ubuntu) if: ${{ startsWith(matrix.os, 'ubuntu') }} @@ -85,13 +85,13 @@ jobs: steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: recursive - name: Restore vcpkg installed cache - uses: actions/cache@v4 + uses: actions/cache@v6 id: vcpkg-cache if: always() && steps.vcpkg-cache.outputs.cache-hit != 'true' with: @@ -100,7 +100,7 @@ jobs: restore-keys: vcpkg-${{ runner.os }}- - name: Restore vcpkg downloads cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: vcpkg/downloads key: vcpkg-downloads-${{ runner.os }}-${{ hashFiles('vcpkg.json') }} @@ -136,13 +136,13 @@ jobs: steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: recursive - name: Restore vcpkg installed cache - uses: actions/cache@v4 + uses: actions/cache@v6 id: vcpkg-cache if: always() && steps.vcpkg-cache.outputs.cache-hit != 'true' with: @@ -153,7 +153,7 @@ jobs: restore-keys: vcpkg-${{ runner.os }}- - name: Restore vcpkg downloads cache - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: vcpkg/downloads key: vcpkg-downloads-${{ runner.os }}-${{ hashFiles('vcpkg.json') }} @@ -218,7 +218,7 @@ jobs: steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 - name: Install deps run: | sudo apt-get update -y @@ -259,12 +259,12 @@ jobs: arch: '-A Win32' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: submodules: true - name: Restore vcpkg and its artifacts. - uses: actions/cache@v4 + uses: actions/cache@v6 id: vcpkg-cache if: always() && steps.vcpkg-cache.outputs.cache-hit != 'true' with: @@ -392,18 +392,18 @@ jobs: steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 - name: Set up QEMU - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Package Pulsar source run: build-support/generate-source-archive.sh - - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Build dependencies Docker image - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ./pkg/${{matrix.pkg.type}} load: true @@ -425,13 +425,13 @@ jobs: needs: lint steps: - name: checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: recursive - name: Restore vcpkg installed cache - uses: actions/cache@v4 + uses: actions/cache@v6 id: vcpkg-cache if: always() && steps.vcpkg-cache.outputs.cache-hit != 'true' with: diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index c877c642..88f9d01a 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -43,14 +43,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: recursive # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} @@ -68,6 +68,6 @@ jobs: cmake --build . -j8 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 with: category: "/language:${{matrix.language}}"