[Bug][CI] GitHub Actions startup failure: third-party actions not in ASF allow-list
評価
- 難易度
- 3/5
- 見積もり時間
- 1〜2日
- 初心者へのやさしさ
- 35/100
調査の方向性
Inspect .github/workflows/integration-test.yml, .github/workflows/publish-docker.yaml, and .github/workflows/auto-comment.yml; compare each referenced action with apache/infrastructure-actions/approved_patterns.yml. Pin permitted actions to approved commit SHAs with version comments, and replace actions-cool/issues-helper because it is not allow-listed. Done when the affected workflows start successfully; PR #5486 is already open against this issue.
索引モデルが issue の本文から書いたものです。
説明
Search before asking
- I searched the issues and found no similar issues.
Linkis Component
- linkis-dist (GitHub Actions CI workflows)
Description
All third-party GitHub Actions that are not covered by the ASF organization Actions allow-list are rejected by GitHub before any job starts, so affected workflows end with conclusion startup_failure (status: "Startup failure"). The jobs never actually run.
Affected references (5 in total):
| Workflow | Line | Reference |
|---|---|---|
.github/workflows/integration-test.yml |
99 | docker/setup-buildx-action@v1 |
.github/workflows/publish-docker.yaml |
58 | docker/setup-qemu-action@v1 |
.github/workflows/publish-docker.yaml |
60 | docker/setup-buildx-action@v1 |
.github/workflows/publish-docker.yaml |
72 | docker/[email protected] |
.github/workflows/auto-comment.yml |
28 | actions-cool/issues-helper@v3 |
The reported annotation is:
The action
docker/setup-buildx-action@v1is not allowed in apache/linkis because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: ...
Steps to reproduce
- Open any pull request against
master(for example #5484, a dependabot PR). - Open the triggered
Integration Testrun: https://github.com/apache/linkis/actions/runs/37706014594 - Observe the run status
startup_failureand the allow-list annotation above; no job step ever executes. - Push to
masterand observePublish Dockerfailing the same way: https://github.com/apache/linkis/actions/runs/32231573096 (and every run since 2025-11-24, last success was 2025-11-23). - Open a new issue and observe
Create Commentfailing the same way: https://github.com/apache/linkis/actions/runs/35649775965
Expected behavior
All workflows start and execute their jobs. Third-party actions must be referenced by the exact commit SHA listed in apache/infrastructure-actions/approved_patterns.yml, with the version kept as an inline comment.
Your environment
- GitHub-hosted runner:
ubuntu-latest - Repository: apache/linkis, default branch
master - Trigger:
pull_request,push,issues
Anything else
- This failure is invisible on the PR checks page: a workflow-level
startup_failuredoes not create a check run, so PRs can look green whileIntegration Testis failing (PR #5483 has sixstartup_failureruns yet shows 11 green checks). Runs must be inspected on the Actions tab. actions-cool/issues-helperhas no entry in the ASF allow-list in any form, so it cannot be fixed by pinning a SHA; the step has to be replaced (for example with the runner-providedghCLI).- The red checks currently shown on PRs (
build-backend,spotless-check,sql-check,third-party-dependencies-check) are a separate, unrelated problem: master is broken (see #5482 / PR #5483). - Please also note that the ASF allow-list changes over time, so pinned SHAs may need to be re-synced occasionally.
Are you willing to submit a PR?
- Yes I am willing to submit a PR!
- 主要言語
- Java
- スター
- 3.4k
- フォーク
- 1.2k
- PR マージ指標
- 30日以内にマージされた PR はありません
環境構築
- Dockerfile・Docker Compose ファイルなし
- プルリクエストのテンプレートあり
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
apache/linkis のほかの issue
-
[Bug] linkis-application-manager's RMUtils class has a logic bug再び着手できるかも @zhang-arvin が 39 日前に担当しましたが、オープン中のプルリクエストはありません。 オープンbug
難易度 1/5 1時間未満 初心者へのやさしさ 86/100
-
Scala Compilation is broken on master branch and recent PRs対応中かも @pjfanning が 17 日前に担当しました。 オープン
難易度 4/5 3〜5日 初心者へのやさしさ 38/100
-
[bug][CGS][entrance] parallelgroup cache not updated when entrance instance goes offline対応中かも @zhang-arvin が 30 日前に担当しました。 オープン
難易度 4/5 3〜5日 初心者へのやさしさ 55/100
-
難易度 4/5 3〜5日 初心者へのやさしさ 28/100
-
難易度 3/5 1〜2日 初心者へのやさしさ 55/100
似ている issue
-
backend
難易度 2/5 1〜3時間 初心者へのやさしさ 76/100
bcgov/nr-forest-client#2524 ·
メンテナーはふだん 1 日以内に返信
-
難易度 1/5 1時間未満 初心者へのやさしさ 85/100
Sinytra/ForgifiedFabricAPI#298 ·
-
難易度 2/5 1〜3時間 初心者へのやさしさ 67/100
メンテナーはふだん 1 日以内に返信
-
難易度 1/5 1時間未満 初心者へのやさしさ 74/100
メンテナーはふだん 1 日以内に返信
-
team:Lumberjack
難易度 2/5 1〜3時間 初心者へのやさしさ 76/100
OpenLiberty/open-liberty#35998 ·
メンテナーはふだん 1 日以内に返信