Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug][CI] GitHub Actions startup failure: third-party actions not in ASF allow-list

Aperta
  • Qualcosa non va?
#5,485 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

@aiceflower ci sta già lavorando.

Dal 8/10/2026.

  • #5486 di @aiceflower — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
github-actions, shell, yaml
Ambito
ci-cd

Direzione di ricerca

Inspect .github/workflows/integration-test.yml, .github/workflows/publish-docker.yaml, and .github/workflows/auto-comment.yml; compare each referenced action with apache/infrastructure-actions/approved_patterns.yml. Pin permitted actions to approved commit SHAs with version comments, and replace actions-cool/issues-helper because it is not allow-listed. Done when the affected workflows start successfully; PR #5486 is already open against this issue.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
Search before asking
  • I searched the issues and found no similar issues.
Linkis Component
  • linkis-dist (GitHub Actions CI workflows)
Description

All third-party GitHub Actions that are not covered by the ASF organization Actions allow-list are rejected by GitHub before any job starts, so affected workflows end with conclusion startup_failure (status: "Startup failure"). The jobs never actually run.

Affected references (5 in total):

Workflow Line Reference
.github/workflows/integration-test.yml 99 docker/setup-buildx-action@v1
.github/workflows/publish-docker.yaml 58 docker/setup-qemu-action@v1
.github/workflows/publish-docker.yaml 60 docker/setup-buildx-action@v1
.github/workflows/publish-docker.yaml 72 docker/[email protected]
.github/workflows/auto-comment.yml 28 actions-cool/issues-helper@v3

The reported annotation is:

The action docker/setup-buildx-action@v1 is not allowed in apache/linkis because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: ...

Steps to reproduce
  1. Open any pull request against master (for example #5484, a dependabot PR).
  2. Open the triggered Integration Test run: https://github.com/apache/linkis/actions/runs/37706014594
  3. Observe the run status startup_failure and the allow-list annotation above; no job step ever executes.
  4. Push to master and observe Publish Docker failing the same way: https://github.com/apache/linkis/actions/runs/32231573096 (and every run since 2025-11-24, last success was 2025-11-23).
  5. Open a new issue and observe Create Comment failing the same way: https://github.com/apache/linkis/actions/runs/35649775965
Expected behavior

All workflows start and execute their jobs. Third-party actions must be referenced by the exact commit SHA listed in apache/infrastructure-actions/approved_patterns.yml, with the version kept as an inline comment.

Your environment
  • GitHub-hosted runner: ubuntu-latest
  • Repository: apache/linkis, default branch master
  • Trigger: pull_request, push, issues
Anything else
  • This failure is invisible on the PR checks page: a workflow-level startup_failure does not create a check run, so PRs can look green while Integration Test is failing (PR #5483 has six startup_failure runs yet shows 11 green checks). Runs must be inspected on the Actions tab.
  • actions-cool/issues-helper has no entry in the ASF allow-list in any form, so it cannot be fixed by pinning a SHA; the step has to be replaced (for example with the runner-provided gh CLI).
  • The red checks currently shown on PRs (build-backend, spotless-check, sql-check, third-party-dependencies-check) are a separate, unrelated problem: master is broken (see #5482 / PR #5483).
  • Please also note that the ASF allow-list changes over time, so pinned SHAs may need to be re-synced occasionally.
Are you willing to submit a PR?
  • Yes I am willing to submit a PR!
Lingua principale
Java
Stelle
3.4k
Fork
1.2k
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/linkis

Tutte le issue di apache/linkis

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.