[Bug][CI] GitHub Actions startup failure: third-party actions not in ASF allow-list
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 35/100
调研方向
Inspect .github/workflows/integration-test.yml, .github/workflows/publish-docker.yaml, and .github/workflows/auto-comment.yml; compare each referenced action with apache/infrastructure-actions/approved_patterns.yml. Pin permitted actions to approved commit SHAs with version comments, and replace actions-cool/issues-helper because it is not allow-listed. Done when the affected workflows start successfully; PR #5486 is already open against this issue.
由索引模型根据 Issue 内容生成。
描述
Search before asking
- I searched the issues and found no similar issues.
Linkis Component
- linkis-dist (GitHub Actions CI workflows)
Description
All third-party GitHub Actions that are not covered by the ASF organization Actions allow-list are rejected by GitHub before any job starts, so affected workflows end with conclusion startup_failure (status: "Startup failure"). The jobs never actually run.
Affected references (5 in total):
| Workflow | Line | Reference |
|---|---|---|
.github/workflows/integration-test.yml |
99 | docker/setup-buildx-action@v1 |
.github/workflows/publish-docker.yaml |
58 | docker/setup-qemu-action@v1 |
.github/workflows/publish-docker.yaml |
60 | docker/setup-buildx-action@v1 |
.github/workflows/publish-docker.yaml |
72 | docker/[email protected] |
.github/workflows/auto-comment.yml |
28 | actions-cool/issues-helper@v3 |
The reported annotation is:
The action
docker/setup-buildx-action@v1is not allowed in apache/linkis because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: ...
Steps to reproduce
- Open any pull request against
master(for example #5484, a dependabot PR). - Open the triggered
Integration Testrun: https://github.com/apache/linkis/actions/runs/37706014594 - Observe the run status
startup_failureand the allow-list annotation above; no job step ever executes. - Push to
masterand observePublish Dockerfailing the same way: https://github.com/apache/linkis/actions/runs/32231573096 (and every run since 2025-11-24, last success was 2025-11-23). - Open a new issue and observe
Create Commentfailing the same way: https://github.com/apache/linkis/actions/runs/35649775965
Expected behavior
All workflows start and execute their jobs. Third-party actions must be referenced by the exact commit SHA listed in apache/infrastructure-actions/approved_patterns.yml, with the version kept as an inline comment.
Your environment
- GitHub-hosted runner:
ubuntu-latest - Repository: apache/linkis, default branch
master - Trigger:
pull_request,push,issues
Anything else
- This failure is invisible on the PR checks page: a workflow-level
startup_failuredoes not create a check run, so PRs can look green whileIntegration Testis failing (PR #5483 has sixstartup_failureruns yet shows 11 green checks). Runs must be inspected on the Actions tab. actions-cool/issues-helperhas no entry in the ASF allow-list in any form, so it cannot be fixed by pinning a SHA; the step has to be replaced (for example with the runner-providedghCLI).- The red checks currently shown on PRs (
build-backend,spotless-check,sql-check,third-party-dependencies-check) are a separate, unrelated problem: master is broken (see #5482 / PR #5483). - Please also note that the ASF allow-list changes over time, so pinned SHAs may need to be re-synced occasionally.
Are you willing to submit a PR?
- Yes I am willing to submit a PR!
- 主要语言
- Java
- 星标
- 3.4k
- 派生
- 1.2k
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
apache/linkis 的其他 Issue
-
[Bug] linkis-application-manager's RMUtils class has a logic bug可能重新可做 @zhang-arvin 于 38 天前认领，目前没有进行中的 PR。 未关闭bug
难度 1/5 1 小时以内 新手友好度 86/100
-
Scala Compilation is broken on master branch and recent PRs可能已有人在做 @pjfanning 于 17 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 38/100
-
[bug][CGS][entrance] parallelgroup cache not updated when entrance instance goes offline可能已有人在做 @zhang-arvin 于 30 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 55/100
-
难度 4/5 3-5 天 新手友好度 28/100
-
难度 3/5 1-2 天 新手友好度 55/100
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 64/100
-
enhancement
难度 2/5 1-3 小时 新手友好度 65/100
liquid-java/liquidjava#373 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
NationalSecurityAgency/ghidra#9748 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 85/100
维护者通常 1 天内回复
-
spring-mcp-tools
难度 2/5 1-3 小时 新手友好度 85/100
explyt/spring-plugin#591 ·
维护者通常 1 天内回复