fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker#406
Merged
Conversation
The publish-docker workflow used floating @V3 tags for docker/login-action, docker/setup-qemu-action, and docker/setup-buildx-action. The ASF GitHub Actions allow-list only approves specific SHAs for third-party actions, so the workflow was rejected at startup (startup_failure) on master pushes. This workflow only runs on push-to-master and release, never on PRs, so the rejection did not surface in PR CI — it first failed when #388 merged. Pin all three to the approved SHAs already used across the sibling ASF SkyWalking repos: - docker/login-action@650006c6... # v4.2.0 - docker/setup-qemu-action@06116385... # v4.1.0 - docker/setup-buildx-action@d7f5e7f5... # v4.1.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
wankai123
approved these changes
Jun 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
publish-dockerworkflow fails at startup (startup_failure) on every push tomaster— the ASF GitHub Actions allow-list rejects its three third-party docker actions because they are pinned to floating@v3tags instead of approved SHAs:docker/login-action@v3docker/setup-qemu-action@v3docker/setup-buildx-action@v3This workflow runs only on
pushtomasterand onrelease— never onpull_request— so the rejection does not appear in PR CI. It first surfaced when #388 merged: run 28161685059.Fix
Pin all three to the SHAs already approved on the ASF allow-list and used consistently across the sibling ASF SkyWalking repos:
docker/login-action650006c6eb7dba73a995cc03b0b2d7f5ca915bee# v4.2.0docker/setup-qemu-action06116385d9baf250c9f4dcb4858b16962ea869c3# v4.1.0docker/setup-buildx-actiond7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5# v4.1.0Audit
Swept every
uses:across all workflows. After this change, all third-party actions are SHA-pinned and on the allow-list (dorny/paths-filterwas fixed in #405;tcort/github-action-markdown-link-checkwas already pinned).actions/*andapache/*are auto-allowed. No other floating third-party tags remain.🤖 Generated with Claude Code