fix: pin docker/login-action to an ASF-approved commit SHA - #280
Merged
Conversation
The publish-docker workflow failed at startup (startup_failure, no jobs run) because `docker/login-action@v1.10.0` is referenced by version tag. The ASF org-wide GitHub Actions policy requires every third-party action to be pinned to a reviewed commit SHA present in apache/infrastructure-actions/approved_patterns.yml; only the actions/*, apache/* and github/* namespaces are exempt. Pin to 650006c6eb7dba73a995cc03b0b2d7f5ca915bee (v4.2.0), which is on the approved list and is the same pin already used by skywalking, skywalking-java, skywalking-cli, skywalking-go and skywalking-python. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
wankai123
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
publish-dockerworkflow has been failing on every push tomainwithstartup_failure— no jobs ever start, so there is no job log to inspect:https://github.com/apache/skywalking-eyes/actions/runs/30420520851
Cause
.github/workflows/publish-docker.yamlreferenced a third-party action byversion tag:
The ASF GitHub Actions policy
requires every third-party action to be pinned to a reviewed commit SHA listed in
apache/infrastructure-actions/approved_patterns.yml.Only the
actions/*,apache/*andgithub/*namespaces are exempt — which is whylint.yamlandlicense-eye-check.yamlare unaffected. A tag reference is rejectedbefore the run starts, hence the startup failure.
This was the only unpinned third-party action left in the repo.
Fix
Pin to
650006c6eb7dba73a995cc03b0b2d7f5ca915bee(v4.2.0), which is on the approvedlist and is already the pin used by
skywalking,skywalking-java,skywalking-cli,skywalking-go,skywalking-python,skywalking-horizon-uiandskywalking-showcase.The v1 → v4 bump is safe for this step:
skywalking-cliruns the identical step shapeon this exact pin — same
registry: ${{ env.HUB }}(a value carrying a path,ghcr.io/apache/...), samegithub.actor/GITHUB_TOKENcredentials.🤖 Generated with Claude Code