You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by wu...@apache.org on 2026/03/22 02:50:21 UTC
(skywalking) branch master updated: Pin Docker GitHub Actions to Apache approved SHAs (#13753)
This is an automated email from the ASF dual-hosted git repository.
wusheng pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/skywalking.git
The following commit(s) were added to refs/heads/master by this push:
new 5806ff2f7c Pin Docker GitHub Actions to Apache approved SHAs (#13753)
5806ff2f7c is described below
commit 5806ff2f7c268e970f5488a8438d19bd2745e42e
Author: 吴晟 Wu Sheng <wu...@foxmail.com>
AuthorDate: Sun Mar 22 10:50:15 2026 +0800
Pin Docker GitHub Actions to Apache approved SHAs (#13753)
* Pin Docker GitHub Actions to Apache approved SHAs
Replace version tags with SHA pins from Apache infrastructure-actions
approved_patterns.yml to comply with the enterprise action allow list.
- docker/login-action: v3/v1.10.0 → c94ce9fb...
- docker/setup-buildx-action: v3 → 8d2750c6...
- docker/setup-qemu-action: v3 → 29109295...
* Remove memory limits from OTLP traces e2e test services
The frontend was dropping 312K+ spans due to maxQueueSize reached,
likely caused by memory pressure from the 200M limit on Node.js.
The productcatalogservice had only 20M which is very tight for a
Go service with gRPC + OTLP export.
---
.github/workflows/publish-docker-e2e-service.yaml | 6 +++---
.github/workflows/publish-docker.yaml | 6 +++---
.github/workflows/skywalking.yaml | 8 ++++----
CLAUDE.md | 9 +++++++++
test/e2e-v2/cases/otlp-traces/docker-compose.yml | 8 --------
5 files changed, 19 insertions(+), 18 deletions(-)
diff --git a/.github/workflows/publish-docker-e2e-service.yaml b/.github/workflows/publish-docker-e2e-service.yaml
index 661053ec40..e96ab745eb 100644
--- a/.github/workflows/publish-docker-e2e-service.yaml
+++ b/.github/workflows/publish-docker-e2e-service.yaml
@@ -51,14 +51,14 @@ jobs:
restore-keys: |
${{ runner.os }}-maven-
- name: Log in to the Container registry
- uses: docker/login-action@v1.10.0
+ uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
with:
registry: ${{ env.HUB }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up QEMU
- uses: docker/setup-qemu-action@v3
+ uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
+ uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- name: Build and push images
run: make -C test build.e2e-service docker.push-e2e-service
diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml
index 3e2a3c757d..4d4fd851d9 100644
--- a/.github/workflows/publish-docker.yaml
+++ b/.github/workflows/publish-docker.yaml
@@ -66,15 +66,15 @@ jobs:
echo "TAG=${{ github.sha }}" >> $GITHUB_ENV
fi
- name: Log in to the Container registry
- uses: docker/login-action@v3
+ uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
with:
registry: ${{ env.DOCKER_REGISTRY }}
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Set up QEMU
- uses: docker/setup-qemu-action@v3
+ uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
+ uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- name: Build and push docker images based on Java 11
env:
SW_OAP_BASE_IMAGE: eclipse-temurin:11-jre
diff --git a/.github/workflows/skywalking.yaml b/.github/workflows/skywalking.yaml
index 3e4158e969..eeb41da645 100644
--- a/.github/workflows/skywalking.yaml
+++ b/.github/workflows/skywalking.yaml
@@ -734,7 +734,7 @@ jobs:
name: dist
path: dist
- name: Login to ghcr
- uses: docker/login-action@v3
+ uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -821,7 +821,7 @@ jobs:
find docker-images -name "*.tar" -exec docker load -i {} \;
find docker-images -name "*.tar" -exec rm {} \;
- name: Login to ghcr
- uses: docker/login-action@v3
+ uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -892,7 +892,7 @@ jobs:
find docker-images -name "*.tar" -exec docker load -i {} \;
find docker-images -name "*.tar" -exec rm {} \;
- name: Login to ghcr
- uses: docker/login-action@v3
+ uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -1007,7 +1007,7 @@ jobs:
name: dist
path: dist
- name: Login to ghcr
- uses: docker/login-action@v3
+ uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
diff --git a/CLAUDE.md b/CLAUDE.md
index 0307c6c0c5..5cda8aa29b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -231,6 +231,15 @@ Always use `--recurse-submodules` when cloning or update submodules manually.
Use the `/gh-pull-request` skill for committing and pushing to a PR branch. It runs pre-flight checks (compile, checkstyle, license headers) before every push, and creates the PR if one doesn't exist yet.
+## GitHub Actions Allow List
+
+Apache enforces an allow list for third-party GitHub Actions. All third-party actions must be pinned to an approved SHA from:
+https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
+
+If a PR is blocked by "action is not allowed" errors, check the approved list and update `.github/workflows/` files to use the approved SHA pin instead of a version tag.
+
+Actions owned by `actions/*` (GitHub), `github/*`, and `apache/*` are always allowed (enterprise-owned).
+
## Tips for AI Assistants
1. **Always check submodules**: Protocol changes may require submodule updates
diff --git a/test/e2e-v2/cases/otlp-traces/docker-compose.yml b/test/e2e-v2/cases/otlp-traces/docker-compose.yml
index 3bf59ea734..2d5b81f301 100644
--- a/test/e2e-v2/cases/otlp-traces/docker-compose.yml
+++ b/test/e2e-v2/cases/otlp-traces/docker-compose.yml
@@ -23,10 +23,6 @@ x-default-logging: &logging
services:
frontend:
image: ghcr.io/open-telemetry/demo:1.4.0-frontend
- deploy:
- resources:
- limits:
- memory: 200M
restart: unless-stopped
ports:
- 8080
@@ -56,10 +52,6 @@ services:
productcatalogservice:
image: ghcr.io/open-telemetry/demo:1.4.0-productcatalogservice
- deploy:
- resources:
- limits:
- memory: 20M
restart: unless-stopped
ports:
- "3550"