You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudberry.apache.org by dj...@apache.org on 2026/10/08 08:01:17 UTC
(cloudberry) 02/03: CI: use ASF-approved actions in the Docker workflows
This is an automated email from the ASF dual-hosted git repository.
tuhaihe pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 385d736b90fecc0960312f57a00296c3bc1bc6ff
Author: Dianjin Wang <wa...@gmail.com>
AuthorDate: Thu Oct 8 10:13:10 2026 +0800
CI: use ASF-approved actions in the Docker workflows
The docker-cbdb-build-containers and docker-cbdb-test-containers
workflows fail with startup_failure on every pull request, so no job
is created and no log is produced. The five third-party actions they
pin are no longer on the ASF allowlist (apache/infrastructure-actions,
approved_patterns.yml), which has moved on to newer major versions.
Pin each action to the newest approved release:
- docker/setup-qemu-action v4.0.0 -> v4.4.0
- docker/login-action v3.7.0 -> v4.6.0
- docker/setup-buildx-action v3.12.0 -> v4.4.1
- docker/build-push-action v6.19.2 -> v7.4.0
- dorny/paths-filter v3.0.2 -> v4.0.3
The inputs used by the workflows (username, password, buildkitd-flags,
context, push, platforms, tags, labels, filters) are unchanged in these
versions, and all of them run on Node 24 like the actions/* steps
already do.
Assisted-by: Claude Code
Backpatch-through: REL_2_STABLE
---
.github/workflows/docker-cbdb-build-containers.yml | 10 +++++-----
.github/workflows/docker-cbdb-test-containers.yml | 10 +++++-----
2 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/.github/workflows/docker-cbdb-build-containers.yml b/.github/workflows/docker-cbdb-build-containers.yml
index 71e2a403002..e9e70d6aa35 100644
--- a/.github/workflows/docker-cbdb-build-containers.yml
+++ b/.github/workflows/docker-cbdb-build-containers.yml
@@ -102,7 +102,7 @@ jobs:
# This prevents unnecessary builds if only one platform was modified
- name: Determine if platform changed
id: platform-filter
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+ uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
with:
filters: |
rocky8:
@@ -120,13 +120,13 @@ jobs:
# This allows building ARM64 images on AMD64 infrastructure and vice versa
- name: Set up QEMU
if: ${{ steps.platform-filter.outputs[matrix.platform] == 'true' }}
- uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+ uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
# Login to DockerHub for pushing images
# Requires DOCKERHUB_USER and DOCKERHUB_TOKEN secrets to be set
- name: Login to Docker Hub
if: ${{ steps.platform-filter.outputs[matrix.platform] == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -135,7 +135,7 @@ jobs:
# Enable debug mode for better troubleshooting
- name: Set up Docker Buildx
if: ${{ steps.platform-filter.outputs[matrix.platform] == 'true' }}
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+ uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
with:
buildkitd-flags: --debug
@@ -175,7 +175,7 @@ jobs:
# This creates a manifest list that supports both architectures
- name: Build and Push Multi-arch Docker images
if: ${{ steps.platform-filter.outputs[matrix.platform] == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
- uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+ uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
with:
context: ./devops/deploy/docker/build/${{ matrix.platform }}
push: true
diff --git a/.github/workflows/docker-cbdb-test-containers.yml b/.github/workflows/docker-cbdb-test-containers.yml
index eee8fafea2f..0785a4e367a 100644
--- a/.github/workflows/docker-cbdb-test-containers.yml
+++ b/.github/workflows/docker-cbdb-test-containers.yml
@@ -86,7 +86,7 @@ jobs:
# Determine if the current platform's files have changed
- name: Determine if platform changed
id: platform-filter
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+ uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
with:
filters: |
rocky8:
@@ -109,12 +109,12 @@ jobs:
# This allows building ARM64 images on AMD64 infrastructure and vice versa
- name: Set up QEMU
if: ${{ steps.platform-filter.outputs[matrix.platform] == 'true' }}
- uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+ uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
# Login to DockerHub for pushing images
- name: Login to Docker Hub
if: ${{ steps.platform-filter.outputs[matrix.platform] == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
- uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -122,7 +122,7 @@ jobs:
# Setup Docker Buildx for efficient multi-architecture builds
- name: Set up Docker Buildx
if: ${{ steps.platform-filter.outputs[matrix.platform] == 'true' }}
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+ uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
with:
buildkitd-flags: --debug
@@ -145,7 +145,7 @@ jobs:
# Creates a manifest list that supports both architectures
- name: Build and Push Multi-arch Docker images
if: ${{ steps.platform-filter.outputs[matrix.platform] == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
- uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+ uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
with:
context: ./devops/deploy/docker/test/${{ matrix.platform }}
push: true
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org