You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@celeborn.apache.org by ni...@apache.org on 2026/05/11 01:42:00 UTC
(celeborn) branch main updated: [CELEBORN-2322] Upgrade version of docker/login-action for Login to Docker Hub
This is an automated email from the ASF dual-hosted git repository.
SteNicholas pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/celeborn.git
The following commit(s) were added to refs/heads/main by this push:
new 7340428ba [CELEBORN-2322] Upgrade version of docker/login-action for Login to Docker Hub
7340428ba is described below
commit 7340428ba0849fed00e0575efd5fc3c69e79badf
Author: SteNicholas <pr...@163.com>
AuthorDate: Mon May 11 09:41:50 2026 +0800
[CELEBORN-2322] Upgrade version of docker/login-action for Login to Docker Hub
### What changes were proposed in this pull request?
Upgrade version of docker/login-action for Login to Docker Hub to `docker/login-action4907a6ddec9925e35a0a9e82d7399ccc52663121`.
### Why are the changes needed?
There is error of dockerhub login in https://github.com/apache/celeborn/actions/runs/24821432736, which is as follows:
```
The action docker/login-actionv3 is not allowed in apache/celeborn because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: 1Password/load-secrets-action13f58eec611f8e5db52ec16247f58c508398f3e6, 1Password/load-secrets-action8d0d610af187e78a2772c2d18d627f4c52d3fbfb, 1Password/load-secrets-action92467eb28f72e8255933372f1e0707c567ce2259, 1Password/load-secrets-actiondafbe7cb03502b260e2b2893c753c352eee545bf, AdoptOpenJDK/inst [...]
```
[INFRA-27901](https://issues.apache.org/jira/projects/INFRA/issues/INFRA-27901) gives the following suggestion:
> Following the Trivy compromise, more controls have been put in place regarding use of third party actions.
>
> The only allowed versions of this action are those in the repo:
>
> https://github.com/apache/infrastructure-actions
>
> In: https://raw.githubusercontent.com/apache/infrastructure-actions/refs/heads/main/actions.yml at the moment you can use :
>
> - docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
> - docker/login-actionb45d80f862d83dbcd57f89517bcf500b2ab88fb2
> - docker/login-action4907a6ddec9925e35a0a9e82d7399ccc52663121
>
> which correspond to these tagged versions:
>
> docker/login-action:
> c94ce9fb468520275223c153574b00df6fe4bcc9:
> tag: v3.7.0
> expires_at: 2026-06-14
> b45d80f862d83dbcd57f89517bcf500b2ab88fb2:
> tag: v4.0.0
> expires_at: 2026-07-05
> 4907a6ddec9925e35a0a9e82d7399ccc52663121:
> tag: v4.1.0
### Does this PR resolve a correctness bug?
No.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
No.
Closes #3681 from SteNicholas/CELEBORN-2322.
Authored-by: SteNicholas <pr...@163.com>
Signed-off-by: SteNicholas <pr...@163.com>
---
.github/workflows/docker-build.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index a62dbc5dc..0ef758cdc 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -33,7 +33,7 @@ jobs:
tar -xzf apache-celeborn-${VERSION}-bin.tgz
- name: Login to Docker Hub
- uses: docker/login-action@v3
+ uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
with:
username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_TOKEN }}