You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by wu...@apache.org on 2026/06/25 12:48:10 UTC
(skywalking-python) 01/01: fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker
This is an automated email from the ASF dual-hosted git repository.
wu-sheng pushed a commit to branch fix/ci-publish-docker-approved-pins
in repository https://gitbox.apache.org/repos/asf/skywalking-python.git
commit dbd69cf68a365f2e2c05f248e338475eac61c685
Author: Wu Sheng <wu...@foxmail.com>
AuthorDate: Thu Jun 25 20:47:59 2026 +0800
fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker
The publish-docker workflow used floating @v3 tags for docker/login-action,
docker/setup-qemu-action, and docker/setup-buildx-action. The ASF GitHub
Actions allow-list only approves specific SHAs for third-party actions, so
the workflow was rejected at startup (startup_failure) on master pushes.
This workflow only runs on push-to-master and release, never on PRs, so the
rejection did not surface in PR CI — it first failed when #388 merged.
Pin all three to the approved SHAs already used across the sibling ASF
SkyWalking repos:
- docker/login-action@650006c6... # v4.2.0
- docker/setup-qemu-action@06116385... # v4.1.0
- docker/setup-buildx-action@d7f5e7f5... # v4.1.0
Co-Authored-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
.github/workflows/publish-docker.yaml | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml
index e5d00e5..617244a 100644
--- a/.github/workflows/publish-docker.yaml
+++ b/.github/workflows/publish-docker.yaml
@@ -55,14 +55,14 @@ jobs:
echo "VERSION=${{ github.sha }}" >> $GITHUB_ENV
fi
- name: Log in to the Container registry
- uses: docker/login-action@v3
+ uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ${{ env.DOCKER_REGISTRY }}
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
- name: Set up QEMU
- uses: docker/setup-qemu-action@v3
+ uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
+ uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Build and push docker image
run: make push-image -j 5