You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by wu...@apache.org on 2026/08/01 14:22:46 UTC
(skywalking-agent-test-tool) 01/01: fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker
This is an automated email from the ASF dual-hosted git repository.
wu-sheng pushed a commit to branch fix/publish-docker-asf-pins
in repository https://gitbox.apache.org/repos/asf/skywalking-agent-test-tool.git
commit b303d79891201691cd995eb0aea2e4b433639217
Author: Wu Sheng <wu...@foxmail.com>
AuthorDate: Sat Aug 1 22:22:35 2026 +0800
fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker
The workflow referenced docker/login-action, docker/setup-qemu-action and
docker/setup-buildx-action by floating tag. The ASF GitHub Actions
allow-list only approves specific commit SHAs for third-party actions, so
the workflow is rejected at startup: the run for #65 ended in
startup_failure and no image was published for that commit.
Since publish-docker only runs on push-to-master, the rejection never
surfaces in PR CI — it is only visible after a merge.
Pin all three to the approved SHAs already used across the sibling ASF
SkyWalking repositories (verified against apache/infrastructure-actions
approved_patterns.yml):
- docker/login-action@650006c6... # v4.2.0
- docker/setup-qemu-action@06116385... # v4.1.0
- docker/setup-buildx-action@d7f5e7f5... # v4.1.0
Merging this triggers a push-to-master build, which publishes an image
containing the #65 concurrency fix.
Co-Authored-By: Claude Fable 5 <no...@anthropic.com>
---
.github/workflows/publish-docker.yaml | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml
index 54c2859..8205159 100644
--- a/.github/workflows/publish-docker.yaml
+++ b/.github/workflows/publish-docker.yaml
@@ -46,14 +46,14 @@ jobs:
restore-keys: |
${{ runner.os }}-maven-
- name: Log in to the Container registry
- uses: docker/login-action@v1.10.0
+ uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ${{ env.HUB }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up QEMU
- uses: docker/setup-qemu-action@v1
+ uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v1
+ uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Build and push docker images
run: make build.mock-collector docker.push