[GH] (texera/gh-readonly-queue/main/pr-9064-589b5675822049ea57348df23c787bf746471c3f): Workflow run "Required Checks" failed!

[GitBox <gi...@apache.org>]

The GitHub Actions job "Required Checks" on texera.git/gh-readonly-queue/main/pr-9064-589b5675822049ea57348df23c787bf746471c3f has failed.
Run started by GitHub user aglinxinyuan (triggered by aglinxinyuan).

Head commit for run:
bb83a7092926db928c0f37f212d8d21e5d84abca / Xinyuan Lin <xi...@uci.edu>
fix(deps, ci): bump sbt/setup-sbt to v1.5.12 to restore CI (#9064)

### What changes were proposed in this PR?

CI has been red since 2026-10-19 on `main` and on every PR that runs a
Scala stack (`amber`, `amber-integration`, `Bench`). The jobs die in
under 40s at *Set up job*, before checkout, so they produce no test
output.

As in #7710, the cause is the ASF actions allowlist, not anything in
this repository. `sbt/setup-sbt` reaches nested `carabiner-dev` actions
that are no longer permitted:

```
.github/workflows/*.yml
  └─ sbt/setup-sbt@8feba82                                        v1.5.7   allowed
       └─ carabiner-dev/actions/ampel/verify@36a39ef              v1.2.6   allowed
            └─ carabiner-dev/actions/install/ampel@2fec8bd8                BLOCKED
                 └─ install/download-and-verify@16009dca                   BLOCKED
                      └─ install/ampel-bootstrap@619a474                   BLOCKED
```

> The action
carabiner-dev/actions/install/ampel-bootstrap@619a474b2178d06ccf274349397cd67a7802a4fe
is not allowed in apache/texera because all actions must be from a
repository owned by your enterprise, created by GitHub, or match one of
the patterns: …

Nothing in the tree changed. `apache/infrastructure-actions` commit
`7a8ef18970` ("Remove Expired Refs", 2026-10-19T02:35Z) dropped the
transitive `ampel-bootstrap` refs that carabiner's older internal refs
use. Last clean run: `main` @ `a46ddc6e` at 2026-10-19T00:53Z. First
failures: #9028 / #9029 at 07:07Z, and `main` @ `22b82a29` at 23:39Z.

This bumps all 9 call sites from v1.5.7 to v1.5.12, which resolves down
a fully allowed path:

| | v1.5.7 (current) | v1.5.12 (this PR) |
| --- | --- | --- |
| `ampel/verify` | `36a39ef` (v1.2.6) | `32587e8` |
| `install/ampel` | **`2fec8bd8` — blocked** | `d6d91c5` |
| `install/download-and-verify` | **`16009dca` — blocked** | `2fec8bd8`
|
| `install/ampel-bootstrap` | **`619a474` — blocked** | `16009dca` |

Every link on the v1.5.12 side is in the current
`approved_patterns.yml`, and `actions.yml` gives v1.5.12 no expiry date
(v1.5.7's own entry expires 2026-11-17). The action's inputs
(`sbt-runner-version`, `disk-cache`) are the same in both versions, so
no call site needs editing beyond the pin.

Call sites: `benchmarks.yml` (1), `build-and-push-images.yml` (3),
`build.yml` (4), `dependency-graph.yml` (1).

`release/v1.2` and `release/v1.3` pin the same v1.5.7, so this carries
their backport labels. `release/v1.1` pins `setup-sbt@508b753`, which is
not on the allowlist either; it needs its own bump if that branch still
runs CI.

### Any related issues, documentation, discussions?

No issue filed — the regression originates outside the repository and
this PR is the unblock. The previous bump of this pin was #7710.

### How was this PR tested?

By this PR's CI, which is the only place the failure reproduces — it
depends on the `apache/texera` actions policy and cannot be triggered
locally or on a fork.

The change touches `.github/**`, so the labeler applies `ci`, which runs
every stack in `LABEL_STACKS` plus `Bench`. Every job that uses
`sbt/setup-sbt` is exercised here.

### Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Claude Opus 5.5)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Report URL: https://github.com/apache/texera/actions/runs/39726981821

With regards,
GitHub Actions via GitBox