You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@otava.apache.org by Henrik Ingo <he...@nyrkio.com> on 2026/03/29 20:53:48 UTC
3rd party github actions no longer allowed?
FYI, GitHub actions not working, I filed:
https://issues.apache.org/jira/browse/INFRA-27784
Otava github actions broken after Trivy fix
--
*nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
Henrik Ingo, CEO
henrik@nyrkio.com LinkedIn:
www.linkedin.com/in/heingo
+358 40 569 7354 Twitter: twitter.com/h_ingo
Re: 3rd party github actions no longer allowed?
Posted by Lari Hotari <lh...@apache.org>.
I created a new sandboxed Trivy action, which is currently in review
to be added to the approved ASF actions:
https://github.com/apache/infrastructure-actions/pull/582
In Pulsar, I've been thinking of replacing Trivy with Google's OSV
Scanner (https://github.com/google/osv-scanner); however, it's not a
direct replacement in how it's used in GitHub Actions workflows.
-Lari
On Sun, 29 Mar 2026 at 23:52, Henrik Ingo <he...@nyrkio.com> wrote:
>
> FYI, GitHub actions not working, I filed:
>
> https://issues.apache.org/jira/browse/INFRA-27784
> Otava github actions broken after Trivy fix
>
> --
> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
>
> Henrik Ingo, CEO
> henrik@nyrkio.com LinkedIn:
> www.linkedin.com/in/heingo
> +358 40 569 7354 Twitter: twitter.com/h_ingo
Re: 3rd party github actions no longer allowed?
Posted by Austin Bennett <au...@apache.org>.
Without a doubt. Apologies for the false-start/fakeout.
Will continue to be on the lookout for places to make clear contributions.
As, yes, discrete PRs are def valid places to submit.
For release, there is often need to iterate, rerun CI, etc -- Lack of that
ability sounded like would be frustrating.
On Tue, Mar 31, 2026 at 10:44 AM Henrik Ingo <he...@nyrkio.com> wrote:
> On Tue, Mar 31, 2026 at 8:00 AM Austin Bennett <
> whatwouldaustindo@gmail.com>
> wrote:
>
> > Well, I didn't even think about permissions.
> >
> > Since I am not a committer here, I can't merge stuff, doesn't look like
> can
> > run ci, etc. So, can't even do much with dependabot, etc.
> >
> >
> Oh, sorry about that. Since you had an apache.org address I assumed you
> volunteered because you would have some other permissions that I didn't
> know about, perhaps via the Incubator PMC or something.
>
> So I can do the release, no problem. It's supposed to rotate around the
> PPMC members anyway. This is a requirement in the incubation process.
>
>
> > Since I haven't done much for the community, I can understand why I don't
> > have that ability [ ex: committer ]. But, that puts me in a not great
> > place to actually get things done, as otherwise seems like alot of
> friction
> > :-/ to ask people to perform basic actions around things like version
> > bumps, pinning dependencies, basic repo hygeine . Not sure how to
> > resolve(?), so I guess I can find other opportunities for contributing
> more
> > easily.
> >
> > Yes, def requires PMC for keys/signing.
> >
> >
> For sure. The release process is quite bureaucratic compared to everything
> else. For a good reason, of course.
>
> I would say there's no reason to let this be demotivating. After a year+ of
> upgrading python versions, writing out dependencies, etc... We are finally
> in a position where it is possible for new (and not so new) contirbutors to
> work on meaningful tasks.
>
> henrik
>
>
> --
> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
>
> Henrik Ingo, CEO
> henrik@nyrkio.com LinkedIn:
> www.linkedin.com/in/heingo
> +358 40 569 7354 Twitter:
> twitter.com/h_ingo
>
Re: 3rd party github actions no longer allowed?
Posted by Henrik Ingo <he...@nyrkio.com>.
Just to keep the communication open...
Thanks to Alex for fixing the github action issue and merging the
dependabot udpates. I thought I should also review the docs PRs before the
release, as they on first glance looked close to ready, but I was wrong,
there were quite many small things.
Now it's late and tomorrow I have a sailing related errand, so will
continue with release activities on Sunday.
henrik
On Wed, Apr 1, 2026 at 4:20 PM Henrik Ingo <he...@nyrkio.com> wrote:
> Ah thanks. I have one more meeting, then I will focus on this, still today.
>
> On Wed, Apr 1, 2026 at 8:11 AM Alexander Sorokoumov <
> aleksandr.sorokoumov@gmail.com> wrote:
>
>> I fixed CI by pinning uv to one of the allowed versions.
>>
>> Best,
>> Alex
>>
>> On Tue, Mar 31, 2026 at 12:14 PM Dave Fisher <wa...@apache.org> wrote:
>>
>> >
>> >
>> > > On Mar 31, 2026, at 10:45 AM, Henrik Ingo <he...@nyrkio.com> wrote:
>> > >
>> > > On Tue, Mar 31, 2026 at 8:00 AM Austin Bennett <
>> > whatwouldaustindo@gmail.com>
>> > > wrote:
>> > >
>> > >> Well, I didn't even think about permissions.
>> > >>
>> > >> Since I am not a committer here, I can't merge stuff, doesn't look
>> like
>> > can
>> > >> run ci, etc. So, can't even do much with dependabot, etc.
>> > >>
>> > >>
>> > > Oh, sorry about that. Since you had an apache.org address I assumed
>> you
>> > > volunteered because you would have some other permissions that I
>> didn't
>> > > know about, perhaps via the Incubator PMC or something.
>> > >
>> > > So I can do the release, no problem. It's supposed to rotate around
>> the
>> > > PPMC members anyway. This is a requirement in the incubation process.
>> > >
>> > >
>> > >> Since I haven't done much for the community, I can understand why I
>> > don't
>> > >> have that ability [ ex: committer ]. But, that puts me in a not
>> great
>> > >> place to actually get things done, as otherwise seems like alot of
>> > friction
>> > >> :-/ to ask people to perform basic actions around things like version
>> > >> bumps, pinning dependencies, basic repo hygeine . Not sure how to
>> > >> resolve(?), so I guess I can find other opportunities for
>> contributing
>> > more
>> > >> easily.
>> > >>
>> > >> Yes, def requires PMC for keys/signing.
>> > >>
>> > >>
>> > > For sure. The release process is quite bureaucratic compared to
>> > everything
>> > > else. For a good reason, of course.
>> >
>> > For your next release please give the new Apache Trusted Releases
>> process
>> > a try.
>> >
>> > https://release-test.apache.org/#project-otava
>> >
>> > I’m managing this development and have tested with the last Otava
>> release.
>> > We are getting close to a Beta release.
>> >
>> > Best,
>> > Dave
>> >
>> > >
>> > > I would say there's no reason to let this be demotivating. After a
>> year+
>> > of
>> > > upgrading python versions, writing out dependencies, etc... We are
>> > finally
>> > > in a position where it is possible for new (and not so new)
>> contirbutors
>> > to
>> > > work on meaningful tasks.
>> > >
>> > > henrik
>> > >
>> > >
>> > > --
>> > > *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
>> > Service*
>> > >
>> > > Henrik Ingo, CEO
>> > > henrik@nyrkio.com LinkedIn:
>> > > www.linkedin.com/in/heingo
>> > > +358 40 569 7354 Twitter:
>> > twitter.com/h_ingo
>> >
>> >
>>
>
>
> --
> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
>
> Henrik Ingo, CEO
> henrik@nyrkio.com LinkedIn:
> www.linkedin.com/in/heingo
> +358 40 569 7354 Twitter:
> twitter.com/h_ingo
>
--
*nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
Henrik Ingo, CEO
henrik@nyrkio.com LinkedIn:
www.linkedin.com/in/heingo
+358 40 569 7354 Twitter: twitter.com/h_ingo
Re: 3rd party github actions no longer allowed?
Posted by Henrik Ingo <he...@nyrkio.com>.
Ah thanks. I have one more meeting, then I will focus on this, still today.
On Wed, Apr 1, 2026 at 8:11 AM Alexander Sorokoumov <
aleksandr.sorokoumov@gmail.com> wrote:
> I fixed CI by pinning uv to one of the allowed versions.
>
> Best,
> Alex
>
> On Tue, Mar 31, 2026 at 12:14 PM Dave Fisher <wa...@apache.org> wrote:
>
> >
> >
> > > On Mar 31, 2026, at 10:45 AM, Henrik Ingo <he...@nyrkio.com> wrote:
> > >
> > > On Tue, Mar 31, 2026 at 8:00 AM Austin Bennett <
> > whatwouldaustindo@gmail.com>
> > > wrote:
> > >
> > >> Well, I didn't even think about permissions.
> > >>
> > >> Since I am not a committer here, I can't merge stuff, doesn't look
> like
> > can
> > >> run ci, etc. So, can't even do much with dependabot, etc.
> > >>
> > >>
> > > Oh, sorry about that. Since you had an apache.org address I assumed
> you
> > > volunteered because you would have some other permissions that I didn't
> > > know about, perhaps via the Incubator PMC or something.
> > >
> > > So I can do the release, no problem. It's supposed to rotate around the
> > > PPMC members anyway. This is a requirement in the incubation process.
> > >
> > >
> > >> Since I haven't done much for the community, I can understand why I
> > don't
> > >> have that ability [ ex: committer ]. But, that puts me in a not great
> > >> place to actually get things done, as otherwise seems like alot of
> > friction
> > >> :-/ to ask people to perform basic actions around things like version
> > >> bumps, pinning dependencies, basic repo hygeine . Not sure how to
> > >> resolve(?), so I guess I can find other opportunities for contributing
> > more
> > >> easily.
> > >>
> > >> Yes, def requires PMC for keys/signing.
> > >>
> > >>
> > > For sure. The release process is quite bureaucratic compared to
> > everything
> > > else. For a good reason, of course.
> >
> > For your next release please give the new Apache Trusted Releases process
> > a try.
> >
> > https://release-test.apache.org/#project-otava
> >
> > I’m managing this development and have tested with the last Otava
> release.
> > We are getting close to a Beta release.
> >
> > Best,
> > Dave
> >
> > >
> > > I would say there's no reason to let this be demotivating. After a
> year+
> > of
> > > upgrading python versions, writing out dependencies, etc... We are
> > finally
> > > in a position where it is possible for new (and not so new)
> contirbutors
> > to
> > > work on meaningful tasks.
> > >
> > > henrik
> > >
> > >
> > > --
> > > *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
> > Service*
> > >
> > > Henrik Ingo, CEO
> > > henrik@nyrkio.com LinkedIn:
> > > www.linkedin.com/in/heingo
> > > +358 40 569 7354 Twitter:
> > twitter.com/h_ingo
> >
> >
>
--
*nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
Henrik Ingo, CEO
henrik@nyrkio.com LinkedIn:
www.linkedin.com/in/heingo
+358 40 569 7354 Twitter: twitter.com/h_ingo
Re: 3rd party github actions no longer allowed?
Posted by Alexander Sorokoumov <al...@gmail.com>.
I fixed CI by pinning uv to one of the allowed versions.
Best,
Alex
On Tue, Mar 31, 2026 at 12:14 PM Dave Fisher <wa...@apache.org> wrote:
>
>
> > On Mar 31, 2026, at 10:45 AM, Henrik Ingo <he...@nyrkio.com> wrote:
> >
> > On Tue, Mar 31, 2026 at 8:00 AM Austin Bennett <
> whatwouldaustindo@gmail.com>
> > wrote:
> >
> >> Well, I didn't even think about permissions.
> >>
> >> Since I am not a committer here, I can't merge stuff, doesn't look like
> can
> >> run ci, etc. So, can't even do much with dependabot, etc.
> >>
> >>
> > Oh, sorry about that. Since you had an apache.org address I assumed you
> > volunteered because you would have some other permissions that I didn't
> > know about, perhaps via the Incubator PMC or something.
> >
> > So I can do the release, no problem. It's supposed to rotate around the
> > PPMC members anyway. This is a requirement in the incubation process.
> >
> >
> >> Since I haven't done much for the community, I can understand why I
> don't
> >> have that ability [ ex: committer ]. But, that puts me in a not great
> >> place to actually get things done, as otherwise seems like alot of
> friction
> >> :-/ to ask people to perform basic actions around things like version
> >> bumps, pinning dependencies, basic repo hygeine . Not sure how to
> >> resolve(?), so I guess I can find other opportunities for contributing
> more
> >> easily.
> >>
> >> Yes, def requires PMC for keys/signing.
> >>
> >>
> > For sure. The release process is quite bureaucratic compared to
> everything
> > else. For a good reason, of course.
>
> For your next release please give the new Apache Trusted Releases process
> a try.
>
> https://release-test.apache.org/#project-otava
>
> I’m managing this development and have tested with the last Otava release.
> We are getting close to a Beta release.
>
> Best,
> Dave
>
> >
> > I would say there's no reason to let this be demotivating. After a year+
> of
> > upgrading python versions, writing out dependencies, etc... We are
> finally
> > in a position where it is possible for new (and not so new) contirbutors
> to
> > work on meaningful tasks.
> >
> > henrik
> >
> >
> > --
> > *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
> Service*
> >
> > Henrik Ingo, CEO
> > henrik@nyrkio.com LinkedIn:
> > www.linkedin.com/in/heingo
> > +358 40 569 7354 Twitter:
> twitter.com/h_ingo
>
>
Re: 3rd party github actions no longer allowed?
Posted by Dave Fisher <wa...@apache.org>.
> On Mar 31, 2026, at 10:45 AM, Henrik Ingo <he...@nyrkio.com> wrote:
>
> On Tue, Mar 31, 2026 at 8:00 AM Austin Bennett <wh...@gmail.com>
> wrote:
>
>> Well, I didn't even think about permissions.
>>
>> Since I am not a committer here, I can't merge stuff, doesn't look like can
>> run ci, etc. So, can't even do much with dependabot, etc.
>>
>>
> Oh, sorry about that. Since you had an apache.org address I assumed you
> volunteered because you would have some other permissions that I didn't
> know about, perhaps via the Incubator PMC or something.
>
> So I can do the release, no problem. It's supposed to rotate around the
> PPMC members anyway. This is a requirement in the incubation process.
>
>
>> Since I haven't done much for the community, I can understand why I don't
>> have that ability [ ex: committer ]. But, that puts me in a not great
>> place to actually get things done, as otherwise seems like alot of friction
>> :-/ to ask people to perform basic actions around things like version
>> bumps, pinning dependencies, basic repo hygeine . Not sure how to
>> resolve(?), so I guess I can find other opportunities for contributing more
>> easily.
>>
>> Yes, def requires PMC for keys/signing.
>>
>>
> For sure. The release process is quite bureaucratic compared to everything
> else. For a good reason, of course.
For your next release please give the new Apache Trusted Releases process a try.
https://release-test.apache.org/#project-otava
I’m managing this development and have tested with the last Otava release. We are getting close to a Beta release.
Best,
Dave
>
> I would say there's no reason to let this be demotivating. After a year+ of
> upgrading python versions, writing out dependencies, etc... We are finally
> in a position where it is possible for new (and not so new) contirbutors to
> work on meaningful tasks.
>
> henrik
>
>
> --
> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
>
> Henrik Ingo, CEO
> henrik@nyrkio.com LinkedIn:
> www.linkedin.com/in/heingo
> +358 40 569 7354 Twitter: twitter.com/h_ingo
Re: 3rd party github actions no longer allowed?
Posted by Henrik Ingo <he...@nyrkio.com>.
On Tue, Mar 31, 2026 at 8:00 AM Austin Bennett <wh...@gmail.com>
wrote:
> Well, I didn't even think about permissions.
>
> Since I am not a committer here, I can't merge stuff, doesn't look like can
> run ci, etc. So, can't even do much with dependabot, etc.
>
>
Oh, sorry about that. Since you had an apache.org address I assumed you
volunteered because you would have some other permissions that I didn't
know about, perhaps via the Incubator PMC or something.
So I can do the release, no problem. It's supposed to rotate around the
PPMC members anyway. This is a requirement in the incubation process.
> Since I haven't done much for the community, I can understand why I don't
> have that ability [ ex: committer ]. But, that puts me in a not great
> place to actually get things done, as otherwise seems like alot of friction
> :-/ to ask people to perform basic actions around things like version
> bumps, pinning dependencies, basic repo hygeine . Not sure how to
> resolve(?), so I guess I can find other opportunities for contributing more
> easily.
>
> Yes, def requires PMC for keys/signing.
>
>
For sure. The release process is quite bureaucratic compared to everything
else. For a good reason, of course.
I would say there's no reason to let this be demotivating. After a year+ of
upgrading python versions, writing out dependencies, etc... We are finally
in a position where it is possible for new (and not so new) contirbutors to
work on meaningful tasks.
henrik
--
*nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
Henrik Ingo, CEO
henrik@nyrkio.com LinkedIn:
www.linkedin.com/in/heingo
+358 40 569 7354 Twitter: twitter.com/h_ingo
Re: 3rd party github actions no longer allowed?
Posted by Austin Bennett <wh...@gmail.com>.
Well, I didn't even think about permissions.
Since I am not a committer here, I can't merge stuff, doesn't look like can
run ci, etc. So, can't even do much with dependabot, etc.
Since I haven't done much for the community, I can understand why I don't
have that ability [ ex: committer ]. But, that puts me in a not great
place to actually get things done, as otherwise seems like alot of friction
:-/ to ask people to perform basic actions around things like version
bumps, pinning dependencies, basic repo hygeine . Not sure how to
resolve(?), so I guess I can find other opportunities for contributing more
easily.
Yes, def requires PMC for keys/signing.
On Mon, Mar 30, 2026 at 2:05 PM Alexander Sorokoumov <
aleksandr.sorokoumov@gmail.com> wrote:
> Thanks for volunteering, Austin!
>
> If you have any questions about the release process / missing information
> in the release doc, feel free to ask here or ping me directly in ASF Slack.
>
> Best,
> Alex
>
> On Mon, Mar 30, 2026 at 1:34 PM Austin Bennett <au...@apache.org> wrote:
>
> > Can do. Agreed, very quick task.
> >
> > Give me the ~ week to get through overall release steps, though.
> >
> > I'll try to knock out a little bit each day.
> >
> > On Mon, Mar 30, 2026 at 1:27 PM Henrik Ingo <he...@nyrkio.com> wrote:
> >
> > > Infra already responded the same on the ticket. I was thinking maybe
> > Austin
> > > wants to do that one and also merge the dependabot PRs as part of
> > > releasing. I can of course do that too, for either of us it's a 2
> minute
> > > task, but I thought it's like a good warmup task for whoever does the
> > > release.
> > >
> > > henrik
> > >
> > > On Mon, Mar 30, 2026 at 6:16 PM Dave Fisher <wa...@apache.org> wrote:
> > >
> > > > The requirement is to switch to the correct SHA for the action. See
> > > >
> > >
> >
> https://github.com/apache/infrastructure-actions/blob/main/actions.yml#L72-L87
> > > > - don’t wait for Infra to tell you the same.
> > > >
> > > > Best,
> > > > Dave
> > > >
> > > > > On Mar 29, 2026, at 3:12 PM, Alexander Sorokoumov <
> > > > aleksandr.sorokoumov@gmail.com> wrote:
> > > > >
> > > > > Thanks for noticing and filing this, Henrik!
> > > > >
> > > > > On Sun, Mar 29, 2026 at 1:52 PM Henrik Ingo <he...@nyrkio.com>
> > wrote:
> > > > >
> > > > >> FYI, GitHub actions not working, I filed:
> > > > >>
> > > > >> https://issues.apache.org/jira/browse/INFRA-27784
> > > > >> Otava github actions broken after Trivy fix
> > > > >>
> > > > >> --
> > > > >> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
> > > > Service*
> > > > >>
> > > > >> Henrik Ingo, CEO
> > > > >> henrik@nyrkio.com LinkedIn:
> > > > >> www.linkedin.com/in/heingo
> > > > >> +358 40 569 7354 Twitter:
> > > > >> twitter.com/h_ingo
> > > > >>
> > > >
> > > >
> > >
> > > --
> > > *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
> > Service*
> > >
> > > Henrik Ingo, CEO
> > > henrik@nyrkio.com LinkedIn:
> > > www.linkedin.com/in/heingo
> > > +358 40 569 7354 Twitter:
> > > twitter.com/h_ingo
> > >
> >
>
Re: 3rd party github actions no longer allowed?
Posted by Alexander Sorokoumov <al...@gmail.com>.
Thanks for volunteering, Austin!
If you have any questions about the release process / missing information
in the release doc, feel free to ask here or ping me directly in ASF Slack.
Best,
Alex
On Mon, Mar 30, 2026 at 1:34 PM Austin Bennett <au...@apache.org> wrote:
> Can do. Agreed, very quick task.
>
> Give me the ~ week to get through overall release steps, though.
>
> I'll try to knock out a little bit each day.
>
> On Mon, Mar 30, 2026 at 1:27 PM Henrik Ingo <he...@nyrkio.com> wrote:
>
> > Infra already responded the same on the ticket. I was thinking maybe
> Austin
> > wants to do that one and also merge the dependabot PRs as part of
> > releasing. I can of course do that too, for either of us it's a 2 minute
> > task, but I thought it's like a good warmup task for whoever does the
> > release.
> >
> > henrik
> >
> > On Mon, Mar 30, 2026 at 6:16 PM Dave Fisher <wa...@apache.org> wrote:
> >
> > > The requirement is to switch to the correct SHA for the action. See
> > >
> >
> https://github.com/apache/infrastructure-actions/blob/main/actions.yml#L72-L87
> > > - don’t wait for Infra to tell you the same.
> > >
> > > Best,
> > > Dave
> > >
> > > > On Mar 29, 2026, at 3:12 PM, Alexander Sorokoumov <
> > > aleksandr.sorokoumov@gmail.com> wrote:
> > > >
> > > > Thanks for noticing and filing this, Henrik!
> > > >
> > > > On Sun, Mar 29, 2026 at 1:52 PM Henrik Ingo <he...@nyrkio.com>
> wrote:
> > > >
> > > >> FYI, GitHub actions not working, I filed:
> > > >>
> > > >> https://issues.apache.org/jira/browse/INFRA-27784
> > > >> Otava github actions broken after Trivy fix
> > > >>
> > > >> --
> > > >> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
> > > Service*
> > > >>
> > > >> Henrik Ingo, CEO
> > > >> henrik@nyrkio.com LinkedIn:
> > > >> www.linkedin.com/in/heingo
> > > >> +358 40 569 7354 Twitter:
> > > >> twitter.com/h_ingo
> > > >>
> > >
> > >
> >
> > --
> > *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
> Service*
> >
> > Henrik Ingo, CEO
> > henrik@nyrkio.com LinkedIn:
> > www.linkedin.com/in/heingo
> > +358 40 569 7354 Twitter:
> > twitter.com/h_ingo
> >
>
Re: 3rd party github actions no longer allowed?
Posted by Austin Bennett <au...@apache.org>.
Can do. Agreed, very quick task.
Give me the ~ week to get through overall release steps, though.
I'll try to knock out a little bit each day.
On Mon, Mar 30, 2026 at 1:27 PM Henrik Ingo <he...@nyrkio.com> wrote:
> Infra already responded the same on the ticket. I was thinking maybe Austin
> wants to do that one and also merge the dependabot PRs as part of
> releasing. I can of course do that too, for either of us it's a 2 minute
> task, but I thought it's like a good warmup task for whoever does the
> release.
>
> henrik
>
> On Mon, Mar 30, 2026 at 6:16 PM Dave Fisher <wa...@apache.org> wrote:
>
> > The requirement is to switch to the correct SHA for the action. See
> >
> https://github.com/apache/infrastructure-actions/blob/main/actions.yml#L72-L87
> > - don’t wait for Infra to tell you the same.
> >
> > Best,
> > Dave
> >
> > > On Mar 29, 2026, at 3:12 PM, Alexander Sorokoumov <
> > aleksandr.sorokoumov@gmail.com> wrote:
> > >
> > > Thanks for noticing and filing this, Henrik!
> > >
> > > On Sun, Mar 29, 2026 at 1:52 PM Henrik Ingo <he...@nyrkio.com> wrote:
> > >
> > >> FYI, GitHub actions not working, I filed:
> > >>
> > >> https://issues.apache.org/jira/browse/INFRA-27784
> > >> Otava github actions broken after Trivy fix
> > >>
> > >> --
> > >> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
> > Service*
> > >>
> > >> Henrik Ingo, CEO
> > >> henrik@nyrkio.com LinkedIn:
> > >> www.linkedin.com/in/heingo
> > >> +358 40 569 7354 Twitter:
> > >> twitter.com/h_ingo
> > >>
> >
> >
>
> --
> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
>
> Henrik Ingo, CEO
> henrik@nyrkio.com LinkedIn:
> www.linkedin.com/in/heingo
> +358 40 569 7354 Twitter:
> twitter.com/h_ingo
>
Re: 3rd party github actions no longer allowed?
Posted by Henrik Ingo <he...@nyrkio.com>.
Infra already responded the same on the ticket. I was thinking maybe Austin
wants to do that one and also merge the dependabot PRs as part of
releasing. I can of course do that too, for either of us it's a 2 minute
task, but I thought it's like a good warmup task for whoever does the
release.
henrik
On Mon, Mar 30, 2026 at 6:16 PM Dave Fisher <wa...@apache.org> wrote:
> The requirement is to switch to the correct SHA for the action. See
> https://github.com/apache/infrastructure-actions/blob/main/actions.yml#L72-L87
> - don’t wait for Infra to tell you the same.
>
> Best,
> Dave
>
> > On Mar 29, 2026, at 3:12 PM, Alexander Sorokoumov <
> aleksandr.sorokoumov@gmail.com> wrote:
> >
> > Thanks for noticing and filing this, Henrik!
> >
> > On Sun, Mar 29, 2026 at 1:52 PM Henrik Ingo <he...@nyrkio.com> wrote:
> >
> >> FYI, GitHub actions not working, I filed:
> >>
> >> https://issues.apache.org/jira/browse/INFRA-27784
> >> Otava github actions broken after Trivy fix
> >>
> >> --
> >> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a
> Service*
> >>
> >> Henrik Ingo, CEO
> >> henrik@nyrkio.com LinkedIn:
> >> www.linkedin.com/in/heingo
> >> +358 40 569 7354 Twitter:
> >> twitter.com/h_ingo
> >>
>
>
--
*nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
Henrik Ingo, CEO
henrik@nyrkio.com LinkedIn:
www.linkedin.com/in/heingo
+358 40 569 7354 Twitter: twitter.com/h_ingo
Re: 3rd party github actions no longer allowed?
Posted by Dave Fisher <wa...@apache.org>.
The requirement is to switch to the correct SHA for the action. See https://github.com/apache/infrastructure-actions/blob/main/actions.yml#L72-L87 - don’t wait for Infra to tell you the same.
Best,
Dave
> On Mar 29, 2026, at 3:12 PM, Alexander Sorokoumov <al...@gmail.com> wrote:
>
> Thanks for noticing and filing this, Henrik!
>
> On Sun, Mar 29, 2026 at 1:52 PM Henrik Ingo <he...@nyrkio.com> wrote:
>
>> FYI, GitHub actions not working, I filed:
>>
>> https://issues.apache.org/jira/browse/INFRA-27784
>> Otava github actions broken after Trivy fix
>>
>> --
>> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
>>
>> Henrik Ingo, CEO
>> henrik@nyrkio.com LinkedIn:
>> www.linkedin.com/in/heingo
>> +358 40 569 7354 Twitter:
>> twitter.com/h_ingo
>>
Re: 3rd party github actions no longer allowed?
Posted by Alexander Sorokoumov <al...@gmail.com>.
Thanks for noticing and filing this, Henrik!
On Sun, Mar 29, 2026 at 1:52 PM Henrik Ingo <he...@nyrkio.com> wrote:
> FYI, GitHub actions not working, I filed:
>
> https://issues.apache.org/jira/browse/INFRA-27784
> Otava github actions broken after Trivy fix
>
> --
> *nyrkio.com <http://nyrkio.com/>* ~ *Continuous Benchmarking as a Service*
>
> Henrik Ingo, CEO
> henrik@nyrkio.com LinkedIn:
> www.linkedin.com/in/heingo
> +358 40 569 7354 Twitter:
> twitter.com/h_ingo
>