Skip to content

[SPARK-56724][INFRA][4.x] Make docker/* GitHub Actions up-to-date#56517

Open
sarutak wants to merge 1 commit into
apache:branch-4.xfrom
sarutak:update-docker-actions-branch-4x
Open

[SPARK-56724][INFRA][4.x] Make docker/* GitHub Actions up-to-date#56517
sarutak wants to merge 1 commit into
apache:branch-4.xfrom
sarutak:update-docker-actions-branch-4x

Conversation

@sarutak

@sarutak sarutak commented Jun 15, 2026 •
edited by dongjoon-hyun
Loading

Copy link
Copy Markdown
Member

What changes were proposed in this pull request?

Update the commit SHAs of the following Docker-related GitHub Actions in branch-4.x to match the ones registered in the Apache organization's GitHub Actions allowlist:

  • docker/login-action
  • docker/setup-qemu-action
  • docker/setup-buildx-action
  • docker/build-push-action

Why are the changes needed?

CI on branch-4.x fails with the error:

The actions docker/login-action@c94ce9fb..., docker/setup-qemu-action@29109295..., docker/setup-buildx-action@8d2750c6..., and docker/build-push-action@10e90e36... are not allowed in apache/spark because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns...

https://github.com/apache/spark/actions/runs/27544506457

The master branch was already updated to the new SHAs, but branch-4.x still had the old ones that are no longer in the allowlist.

Does this PR introduce any user-facing change?

No.

How was this patch tested?

CI should pass with this change.

Was this patch authored or co-authored using generative AI tooling?

Kiro CLI / Claude

@sarutak sarutak force-pushed the update-docker-actions-branch-4x branch from 22fe456 to a2ce3cd Compare June 15, 2026 16:41
dongjoon-hyun
dongjoon-hyun approved these changes Jun 15, 2026
View reviewed changes

@dongjoon-hyun dongjoon-hyun left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1, LGTM.

I revised the PR description by referring.

@gaogaotiantian

gaogaotiantian commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Thank you for noticing this. We need the fix to all other maintenance branches too. 4.2 is probably freezing now so let's fix others first. The trigger is that we are moving CIs to the corresponding branches, which means we need to maintain the build_and_test.yml file for every branch (but it would be a much simpler file in the future).

@dongjoon-hyun

dongjoon-hyun commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

BTW, @sarutak , if SHAs are different from #55687, you need to start from master branch again.

And, if there is not much difference, you had better cherry-pick and resolve the conflict while preserving the original JIRA ID. I guess we need this in branch-4.2 and older branch too, don't we?

Otherwise, it might be difficult to track because we need multiple JIRA issues for the same SHAs; master/branch-4.x/branch-4.2/branch-4.1/branch-4.0/branch-3.5.

@dongjoon-hyun @sarutak
[SPARK-56724][INFRA] Make docker/* GitHub Actions up-to-date
0e0a2d8 
This PR upgrades four `docker/*` GitHub Actions to the latest commit hashes approved by the Apache Software Foundation in [`infrastructure-actions/approved_patterns.yml`](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml):

| Action | Before (tag) | After (tag) |
| --- | --- | --- |
| `docker/build-push-action` | `10e90e3645eae34f1e60eeb005ba3a3d33f178e8` (v6.19.2) | `bcafcacb16a39f128d818304e6c9c0c18556b85f` (v7.1.0) |
| `docker/login-action` | `c94ce9fb468520275223c153574b00df6fe4bcc9` (v3.7.0) | `4907a6ddec9925e35a0a9e82d7399ccc52663121` (v4.1.0) |
| `docker/setup-buildx-action` | `8d2750c68a42422c14e847fe6c8ac0403b4cbd6f` (v3.12.0) | `4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd` (v4.0.0) |
| `docker/setup-qemu-action` | `29109295f81e9208d7d86ff1c6c12d2833863392` (v3.6.0) | `ce360397dd3f832beb865e1373c09c0e9f86d70a` (v4.0.0) |

Updated workflow files (25 references in total):

- `.github/workflows/build_and_test.yml` (8 references)
- `.github/workflows/build_infra_images_cache.yml` (17 references)

The previously pinned hashes were one major version behind upstream and predate the Node.js 20 runtime that Docker actions require going forward. Apache Infrastructure has already approved the newer hashes in `approved_patterns.yml`, so this PR brings Apache Spark's Docker actions onto the supported baseline while keeping ASF policy compliance.

No. CI-only change; no Spark runtime, API, or release artifact is affected.

Pass the CIs.

Generated-by: Claude Code (claude-opus-4-7)

Closes apache#55687 from dongjoon-hyun/SPARK-56724.

Authored-by: Dongjoon Hyun <dongjoon@apache.org>
Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>
@sarutak sarutak force-pushed the update-docker-actions-branch-4x branch from a2ce3cd to 0e0a2d8 Compare June 15, 2026 20:38
@sarutak sarutak changed the title [SPARK-57470][INFRA][4.x] Update docker action SHAs to match the allowlist on branch-4.x [SPARK-56724][INFRA][4.x] Update docker action SHAs to match the allowlist on branch-4.x Jun 15, 2026
@sarutak sarutak changed the title [SPARK-56724][INFRA][4.x] Update docker action SHAs to match the allowlist on branch-4.x [SPARK-56724][INFRA][4.x] Make docker/* GitHub Actions up-to-date Jun 15, 2026
@dongjoon-hyun

dongjoon-hyun commented Jun 15, 2026

Copy link
Copy Markdown
Member

Thank you for revising this PR, @sarutak .

@sarutak

sarutak commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Cherry-picked from #55687 and change the PR title.
Also opened a PR for branch-4.1. Will open another PR for branch-4.2 once 4.0.3 4.2.0 is released.
I think branch-4.0 and older branches don't need to change the hash because branch-4.0 and older branches use tag-based references (e.g., @V3) instead of pinned SHAs, so they are not affected by this allowlist change.

@dongjoon-hyun

dongjoon-hyun commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

I guess you want to mention 4.2.0 RC3 instead of 4.0.3? I released 4.0.3 already last week. :)

Will open another PR for branch-4.2 once 4.0.3 is released.

And, it's great for branch-4.0 and olders~ Thank you for checking.

@sarutak

sarutak commented Jun 15, 2026

Copy link
Copy Markdown
Member Author

I guess you want to mention 4.2.0 RC3 instead of 4.0.3? I released 4.0.3 already last week. :)

Oh sorry for the typo, I was half-asleep because I just woke up a few minutes ago, so...

@gaogaotiantian

gaogaotiantian commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Hi @sarutak , if it's possible, could you merge this to the older branches as well.

I don't think we are supposed to use version pins like v3 for apache projects (unless it's pre-approved like github/apache official actions?). It was okay because the yml file is almost never used for older branches. Once the branch is cut, the build_and_test.yml file would only be used when a new commit is pushed to that branch.

However, we are moving to a point where build_and_test.yml on that branch is the only CI source for that branch, so the scheduled CI is using the build_and_test.yml file from that branch, instead of master. This change will effectively make build_and_test.yml on every branch active. We will need to update those files in the future so maybe it's nice to just update them now.

Even if we don't think about scheduled CI, the current commit to the branch will trigger CI based on build_and_test.yml on the old branch so maybe it's good to just update them?

@sarutak

sarutak commented Jun 15, 2026

Copy link
Copy Markdown
Member Author

I think branch-4.0 and older branches don't need to change the hash because branch-4.0 and older branches use tag-based references (e.g., @V3) instead of pinned SHAs, so they are not affected by this allowlist change.

Let me correct my comment above. branch-4.0 uses pinned SHAs. Anyway, I'm OK to open PRs for older branches as @gaogaotiantian suggested. What do you think, @dongjoon-hyun ?

@dongjoon-hyun

dongjoon-hyun commented Jun 15, 2026

Copy link
Copy Markdown
Member

I'm okay too~

@sarutak

sarutak commented Jun 16, 2026

Copy link
Copy Markdown
Member Author

Opend following PRs:
branch-4.0: #56531
branch-3.5: #56532

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dongjoon-hyun dongjoon-hyun dongjoon-hyun approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sarutak @gaogaotiantian @dongjoon-hyun