[PR] fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker [skywalking-agent-test-tool]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng opened a new pull request, #66:
URL: https://github.com/apache/skywalking-agent-test-tool/pull/66

   ### Problem
   
   `publish-docker` references three third-party actions by floating tag:
   
   ```yaml
   uses: docker/login-action@v1.10.0
   uses: docker/setup-qemu-action@v1
   uses: docker/setup-buildx-action@v1
   ```
   
   The ASF GitHub Actions allow-list only approves specific commit SHAs for third-party actions, so the workflow is rejected before it starts. The run triggered by merging #65 ended in [`startup_failure`](https://github.com/apache/skywalking-agent-test-tool/actions/runs/30703522854), so **no image was published for that commit** — the concurrency fix is on master but not in any published image.
   
   Because `publish-docker` only runs on push-to-master (never on PRs), this rejection is invisible in PR CI and only shows up after a merge.
   
   ### Fix
   
   Pin all three to the approved SHAs already used across the sibling ASF SkyWalking repositories (see apache/skywalking-python#406 for the same fix there). Each SHA was verified to be present in [`apache/infrastructure-actions/approved_patterns.yml`](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml):
   
   | action | pinned SHA | version |
   |---|---|---|
   | `docker/login-action` | `650006c6eb7dba73a995cc03b0b2d7f5ca915bee` | v4.2.0 |
   | `docker/setup-qemu-action` | `06116385d9baf250c9f4dcb4858b16962ea869c3` | v4.1.0 |
   | `docker/setup-buildx-action` | `d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5` | v4.1.0 |
   
   `actions/checkout` and `actions/cache` need no pin — the `actions/*` namespace is enterprise-owned and always allowed.
   
   ### Effect
   
   Merging this is itself a push to master, which triggers a build that publishes an image containing the #65 concurrency fix, tagged with the new master SHA.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker [skywalking-agent-test-tool]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng merged PR #66:
URL: https://github.com/apache/skywalking-agent-test-tool/pull/66


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org