Skip to content

Add Docker official actions (login, buildx, metadata, build-push)#547

Merged
dfoulks1 merged 1 commit intoapache:mainfrom
hubcio:add-docker-actions
Mar 20, 2026
Merged

Add Docker official actions (login, buildx, metadata, build-push)#547
dfoulks1 merged 1 commit intoapache:mainfrom
hubcio:add-docker-actions

Conversation

@hubcio
Copy link
Copy Markdown
Contributor

@hubcio hubcio commented Mar 20, 2026

Request for adding new GitHub Actions to the allow list

Overview

Docker's official CI/CD actions used by apache/iggy for multi-arch Docker image builds and publishing. These are companion actions to docker/setup-qemu-action which is already on the allow list.

These actions were previously allowed implicitly but started failing on March 20, 2026 after an apparent org-level policy change.

Name of actions:
docker/login-action
docker/setup-buildx-action
docker/metadata-action
docker/build-push-action

URL of actions:
https://github.com/docker/login-action
https://github.com/docker/setup-buildx-action
https://github.com/docker/metadata-action
https://github.com/docker/build-push-action

Version to pin to (hash only):

Action Hash Tag
docker/login-action c94ce9fb468520275223c153574b00df6fe4bcc9 v3.7.0
docker/setup-buildx-action 8d2750c68a42422c14e847fe6c8ac0403b4cbd6f v3.12.0
docker/metadata-action c299e40c65443455700f0fdfc63efafe5b349051 v5.10.0
docker/build-push-action 10e90e3645eae34f1e60eeb005ba3a3d33f178e8 v6.19.2

Permissions

  • docker/login-action: Reads Docker Hub credentials from environment variables to authenticate with the registry. Requires DOCKERHUB_USER and DOCKERHUB_TOKEN to be set.
  • docker/setup-buildx-action: Sets up Docker Buildx builder instance. No special permissions required.
  • docker/metadata-action: Extracts metadata (tags, labels) from Git reference and GitHub events. No special permissions required.
  • docker/build-push-action: Builds and pushes Docker images using Buildx. Requires registry credentials to be configured via docker/login-action for push operations.

Related Actions

docker/setup-qemu-action is already approved (SHA 29109295f81e9208d7d86ff1c6c12d2833863392, tag v3.6.0). These four actions form the standard Docker CI/CD toolkit and are typically used together for multi-arch image builds.

Checklist

  • The action is listed in the GitHub Actions Marketplace
  • The action is not already on the list of approved actions
  • The action has a sufficient number of contributors or has contributors within the ASF community
  • The action has a clearly defined license (Apache-2.0)
  • The action is actively developed or maintained
  • The action has CI/unit tests configured

hubcio added a commit to apache/iggy that referenced this pull request Mar 20, 2026
@hubcio
ci(docker): pin all Docker actions to SHA and restore setup-buildx-ac…
3727e2e 
…tion

Revert shell workaround from ba8e865 and restore
docker/setup-buildx-action usage. Pin all Docker actions to
exact commit SHAs per ASF GitHub Actions policy:

- docker/setup-qemu-action@29109295 (v3.6.0) - already approved
- docker/setup-buildx-action@8d2750c6 (v3.12.0)
- docker/login-action@c94ce9fb (v3.7.0)
- docker/metadata-action@c299e40c (v5.10.0)
- docker/build-push-action@10e90e36 (v6.19.2)

Allowlist PR: apache/infrastructure-actions#547
hubcio added a commit to apache/iggy that referenced this pull request Mar 20, 2026
@hubcio
ci(docker): pin Docker actions to SHA per ASF allowlist policy
9e5cea5 
ASF tightened GitHub Actions enforcement on 2026-03-20,
switching from "verified creators" to explicit allowlist
only. Docker actions that worked implicitly now require
SHA-pinned entries in apache/infrastructure-actions.

Restore docker/setup-buildx-action (reverts shell
workaround from ba8e865) and pin all Docker actions
to approved commit SHAs.

Allowlist PR: apache/infrastructure-actions#547
@dfoulks1 dfoulks1 merged commit 0e2e2ad into apache:main Mar 20, 2026
5 checks passed
@hubcio hubcio mentioned this pull request Mar 20, 2026
Merged
hubcio added a commit to apache/iggy that referenced this pull request Mar 20, 2026
@hubcio
ci(docker): pin Docker actions to SHA per ASF allowlist policy
ffd417b 
ASF tightened GitHub Actions enforcement on 2026-03-20,
switching from "verified creators" to explicit allowlist
only. Docker actions that worked implicitly now require
SHA-pinned entries in apache/infrastructure-actions.

Restore docker/setup-buildx-action (reverts shell
workaround from ba8e865) and pin all Docker actions
to approved commit SHAs.

Allowlist PR: apache/infrastructure-actions#547
@dongjoon-hyun dongjoon-hyun mentioned this pull request Mar 20, 2026
Closed
dongjoon-hyun added a commit to apache/spark-kubernetes-operator that referenced this pull request Mar 21, 2026
@dongjoon-hyun
[SPARK-56119] Sync docker-related GitHub Actions versions to the AS…
0d8394f 
…F approved patterns

### What changes were proposed in this pull request?

This PR aims to sync `docker`-related GitHub Actions versions to the ASF approved patterns.

### Why are the changes needed?

Currently, the CI is blocked by the ASF check because of the recent change.
- https://github.com/apache/spark-connect-swift/actions/runs/23365458370

- apache/infrastructure-actions#547

> The actions docker/setup-qemu-actionv3, docker/setup-buildx-actionv3, docker/login-actionv3, and docker/build-push-actionv6 are not allowed in apache/spark-connect-swift because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns

As of now, the updated patterns are the following.

- https://github.com/apache/infrastructure-actions/blob/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L100-L104
```
- docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
- docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
- docker/metadata-actionc299e40c65443455700f0fdfc63efafe5b349051
- docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Manual review because the updated CI should be triggered manually.

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-opus-4-6)

Closes #567 from dongjoon-hyun/SPARK-56119.

Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
@dongjoon-hyun dongjoon-hyun mentioned this pull request Mar 21, 2026
Closed
dongjoon-hyun added a commit to apache/spark-connect-swift that referenced this pull request Mar 21, 2026
@dongjoon-hyun
[SPARK-56124] Sync docker-related GitHub Actions versions to the AS…
dc1f02d 
…F approved patterns

### What changes were proposed in this pull request?

This PR aims to sync `docker`-related GitHub Actions versions to the ASF approved patterns.

### Why are the changes needed?

Currently, the CI is blocked by the ASF check because of the recent change.
- https://github.com/apache/spark-connect-swift/actions/runs/23365458370

- apache/infrastructure-actions#547

> The actions docker/setup-qemu-actionv3, docker/setup-buildx-actionv3, docker/login-actionv3, and docker/build-push-actionv6 are not allowed in apache/spark-connect-swift because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns

As of now, the updated patterns are the following.

- https://github.com/apache/infrastructure-actions/blob/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L100-L104
```
- docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
- docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
- docker/metadata-actionc299e40c65443455700f0fdfc63efafe5b349051
- docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Manual review because the updated CI should be triggered manually.

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-opus-4-6)

Closes #334 from dongjoon-hyun/SPARK-56124.

Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
This was referenced Mar 21, 2026
Closed
Closed
Closed
dongjoon-hyun added a commit to apache/spark that referenced this pull request Mar 21, 2026
@dongjoon-hyun
[SPARK-56126][INFRA] Sync docker-related GitHub Actions versions to…
dc93335 
… the ASF approved patterns

### What changes were proposed in this pull request?

This PR aims to sync `docker`-related GitHub Actions versions to the ASF approved patterns.

### Why are the changes needed?

Currently, the CI is blocked by the ASF check because of the recent change.
- https://github.com/apache/spark/actions/workflows/build_main.yml
  - https://github.com/apache/spark/actions/runs/23362042477
- https://github.com/apache/spark/actions/workflows/build_non_ansi.yml
  - https://github.com/apache/spark/actions/runs/23369253367

> The actions docker/login-actionv3, docker/setup-qemu-actionv3, docker/setup-buildx-actionv3, and docker/build-push-actionv6 are not allowed in apache/spark because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns:

<img width="905" height="380" alt="Screenshot 2026-03-20 at 20 32 56" src="https://github.com/user-attachments/assets/2582b68a-6303-44ab-b961-d9b753072f1e" />

This is due to the following change.
- apache/infrastructure-actions#547

As of now, the updated patterns are the following.

- https://github.com/apache/infrastructure-actions/blob/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L100-L104
```
- docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
- docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
- docker/metadata-actionc299e40c65443455700f0fdfc63efafe5b349051
- docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Manually check like the following because the updated CI should be triggered manually.

```
$ git grep 'uses: docker' | sort | uniq -c
   5 .github/workflows/build_and_test.yml:        uses: docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
   1 .github/workflows/build_and_test.yml:        uses: docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
   1 .github/workflows/build_and_test.yml:        uses: docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
   1 .github/workflows/build_and_test.yml:        uses: docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
  16 .github/workflows/build_infra_images_cache.yml:        uses: docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-opus-4-6)

Closes #54935 from dongjoon-hyun/SPARK-56126.

Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
dongjoon-hyun added a commit to apache/spark that referenced this pull request Mar 21, 2026
@dongjoon-hyun
[SPARK-56126][INFRA][4.1] Sync docker-related GitHub Actions versio…
c663e72 
…ns to the ASF approved patterns

### What changes were proposed in this pull request?

This PR aims to sync `docker`-related GitHub Actions versions to the ASF approved patterns.

### Why are the changes needed?

Currently, the `branch-4.1` CI is blocked by the ASF check because of the recent change.
- https://github.com/apache/spark/actions/workflows/build_branch41_non_ansi.yml
  - https://github.com/apache/spark/actions/runs/23370546081

  > The actions docker/login-actionv3, docker/setup-qemu-actionv3, docker/setup-buildx-actionv3, and docker/build-push-actionv6 are not allowed in apache/spark because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns:

This is due to the following change.
- apache/infrastructure-actions#547

As of now, the updated patterns are the following.

- https://github.com/apache/infrastructure-actions/blob/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L100-L104
```
- docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
- docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
- docker/metadata-actionc299e40c65443455700f0fdfc63efafe5b349051
- docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Manually check like the following because the updated CI should be triggered manually.

```
$ git grep 'uses: docker' | sort | uniq -c
   5 .github/workflows/build_and_test.yml:        uses: docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
   1 .github/workflows/build_and_test.yml:        uses: docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
   1 .github/workflows/build_and_test.yml:        uses: docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
   1 .github/workflows/build_and_test.yml:        uses: docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
  15 .github/workflows/build_infra_images_cache.yml:        uses: docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-opus-4-6)

Closes #54936 from dongjoon-hyun/SPARK-56126-4.1.

Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
dongjoon-hyun added a commit to apache/spark that referenced this pull request Mar 21, 2026
@dongjoon-hyun
[SPARK-56126][INFRA][4.0] Sync docker-related GitHub Actions versio…
a8973f3 
…ns to the ASF approved patterns

### What changes were proposed in this pull request?

This PR aims to sync `docker`-related GitHub Actions versions to the ASF approved patterns.

### Why are the changes needed?

Currently, the `branch-4.0` CI is blocked by the ASF check because of the recent change.
- https://github.com/apache/spark/actions/workflows/build_branch40_non_ansi.yml
  - https://github.com/apache/spark/actions/runs/23370475022

  > The actions docker/login-actionv3, docker/setup-qemu-actionv3, docker/setup-buildx-actionv3, and docker/build-push-actionv6 are not allowed in apache/spark because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns:

This is due to the following change.
- apache/infrastructure-actions#547

As of now, the updated patterns are the following.

- https://github.com/apache/infrastructure-actions/blob/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L100-L104
```
- docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
- docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
- docker/metadata-actionc299e40c65443455700f0fdfc63efafe5b349051
- docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Manually check like the following because the updated CI should be triggered manually.

```
$ git grep 'uses: docker' | sort | uniq -c
   5 .github/workflows/build_and_test.yml:        uses: docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
   1 .github/workflows/build_and_test.yml:        uses: docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
   1 .github/workflows/build_and_test.yml:        uses: docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
   1 .github/workflows/build_and_test.yml:        uses: docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
  12 .github/workflows/build_infra_images_cache.yml:        uses: docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-opus-4-6)

Closes #54937 from dongjoon-hyun/dongjoon/hopeful-kepler.

Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
@lupyuen lupyuen mentioned this pull request Mar 22, 2026
Merged
lupyuen added a commit to lupyuen14/nuttx that referenced this pull request Mar 22, 2026
@lupyuen
CI: Revert GitHub Actions for Docker, by hash
0d74d3d 
All CI Builds have been failing since 18 hours ago:
- apache#18571 (comment)
- https://github.com/apache/nuttx/actions/runs/23389990049

> _The action docker/login-action@v4 is not allowed in apache/nuttx because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: 1Password/load-secrets-action@13f58ee, 1Password/load-secrets-action@8d0d610, 1Password/load-secrets-action@dafbe7c, AdoptOpenJDK/install-jdk@*, BobAnkh/auto-generate-changelog@*, DavidAnson/markdownlint-cli2-action@07035fd, DavidAnson/markdownlint-cli2-action@30a0e04, EnricoMi/publish-unit-test-result-action@*, JamesIves/github-pages-deploy-action@4a3abc7, JamesIves/github-pages-deploy-action@d92aa23, Jimver/cuda-toolkit@6008063, Jimver/cuda-toolkit@b6fc3a9, JustinBeckwith/linkinator-action@af984b9f30f63e796..._

That's because ASF Infrastructure Team has mandated that we use the Hash Versions of GitHub Actions for Docker, stated below:
- https://github.com/apache/infrastructure-actions/blob/main/actions.yml
- Which generates: https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
- Due to: apache/infrastructure-actions#547

```yaml
docker/build-push-action:
  10e90e3645eae34f1e60eeb005ba3a3d33f178e8:
    tag: v6.19.2
docker/login-action:
  c94ce9fb468520275223c153574b00df6fe4bcc9:
    tag: v3.7.0
docker/metadata-action:
  c299e40c65443455700f0fdfc63efafe5b349051:
    tag: v5.10.0
docker/setup-buildx-action:
  8d2750c68a42422c14e847fe6c8ac0403b4cbd6f:
    tag: v3.12.0
```

This PR reverts our GitHub Actions for Docker to the hash versions stated above.

Signed-off-by: Lup Yuen Lee <[email protected]>
@lupyuen lupyuen mentioned this pull request Mar 22, 2026
Merged
lupyuen added a commit to lupyuen14/nuttx-apps that referenced this pull request Mar 22, 2026
@lupyuen
CI: Revert GitHub Actions for Docker
15cc834 
All CI Builds have been failing since 18 hours ago:
- apache/nuttx#18571 (comment)
- https://github.com/apache/nuttx/actions/runs/23389990049

> _The action docker/login-action@v4 is not allowed in apache/nuttx because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: 1Password/load-secrets-action@13f58ee, 1Password/load-secrets-action@8d0d610, 1Password/load-secrets-action@dafbe7c, AdoptOpenJDK/install-jdk@*, BobAnkh/auto-generate-changelog@*, DavidAnson/markdownlint-cli2-action@07035fd, DavidAnson/markdownlint-cli2-action@30a0e04, EnricoMi/publish-unit-test-result-action@*, JamesIves/github-pages-deploy-action@4a3abc7, JamesIves/github-pages-deploy-action@d92aa23, Jimver/cuda-toolkit@6008063, Jimver/cuda-toolkit@b6fc3a9, JustinBeckwith/linkinator-action@af984b9f30f63e796..._

That's because ASF Infrastructure Team has mandated that we use the Hash Versions of GitHub Actions for Docker, stated below:
- https://github.com/apache/infrastructure-actions/blob/main/actions.yml
- Which generates: https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
- Due to: apache/infrastructure-actions#547

```yaml
docker/build-push-action:
  10e90e3645eae34f1e60eeb005ba3a3d33f178e8:
    tag: v6.19.2
docker/login-action:
  c94ce9fb468520275223c153574b00df6fe4bcc9:
    tag: v3.7.0
docker/metadata-action:
  c299e40c65443455700f0fdfc63efafe5b349051:
    tag: v5.10.0
docker/setup-buildx-action:
  8d2750c68a42422c14e847fe6c8ac0403b4cbd6f:
    tag: v3.12.0
```

This PR reverts our GitHub Actions for Docker to the hash versions stated above.

Signed-off-by: Lup Yuen Lee <[email protected]>
@lupyuen lupyuen mentioned this pull request Mar 22, 2026
Merged
simbit18 pushed a commit to apache/nuttx that referenced this pull request Mar 22, 2026
@lupyuen @simbit18
CI: Revert GitHub Actions for Docker, by hash
a84d263 
All CI Builds have been failing since 18 hours ago:
- #18571 (comment)
- https://github.com/apache/nuttx/actions/runs/23389990049

> _The action docker/login-action@v4 is not allowed in apache/nuttx because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: 1Password/load-secrets-action@13f58ee, 1Password/load-secrets-action@8d0d610, 1Password/load-secrets-action@dafbe7c, AdoptOpenJDK/install-jdk@*, BobAnkh/auto-generate-changelog@*, DavidAnson/markdownlint-cli2-action@07035fd, DavidAnson/markdownlint-cli2-action@30a0e04, EnricoMi/publish-unit-test-result-action@*, JamesIves/github-pages-deploy-action@4a3abc7, JamesIves/github-pages-deploy-action@d92aa23, Jimver/cuda-toolkit@6008063, Jimver/cuda-toolkit@b6fc3a9, JustinBeckwith/linkinator-action@af984b9f30f63e796..._

That's because ASF Infrastructure Team has mandated that we use the Hash Versions of GitHub Actions for Docker, stated below:
- https://github.com/apache/infrastructure-actions/blob/main/actions.yml
- Which generates: https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
- Due to: apache/infrastructure-actions#547

```yaml
docker/build-push-action:
  10e90e3645eae34f1e60eeb005ba3a3d33f178e8:
    tag: v6.19.2
docker/login-action:
  c94ce9fb468520275223c153574b00df6fe4bcc9:
    tag: v3.7.0
docker/metadata-action:
  c299e40c65443455700f0fdfc63efafe5b349051:
    tag: v5.10.0
docker/setup-buildx-action:
  8d2750c68a42422c14e847fe6c8ac0403b4cbd6f:
    tag: v3.12.0
```

This PR reverts our GitHub Actions for Docker to the hash versions stated above.

Signed-off-by: Lup Yuen Lee <[email protected]>
lupyuen added a commit to apache/nuttx-apps that referenced this pull request Mar 22, 2026
@lupyuen
CI: Revert GitHub Actions for Docker
5fe0877 
All CI Builds have been failing since 18 hours ago:
- apache/nuttx#18571 (comment)
- https://github.com/apache/nuttx/actions/runs/23389990049

> _The action docker/login-action@v4 is not allowed in apache/nuttx because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: 1Password/load-secrets-action@13f58ee, 1Password/load-secrets-action@8d0d610, 1Password/load-secrets-action@dafbe7c, AdoptOpenJDK/install-jdk@*, BobAnkh/auto-generate-changelog@*, DavidAnson/markdownlint-cli2-action@07035fd, DavidAnson/markdownlint-cli2-action@30a0e04, EnricoMi/publish-unit-test-result-action@*, JamesIves/github-pages-deploy-action@4a3abc7, JamesIves/github-pages-deploy-action@d92aa23, Jimver/cuda-toolkit@6008063, Jimver/cuda-toolkit@b6fc3a9, JustinBeckwith/linkinator-action@af984b9f30f63e796..._

That's because ASF Infrastructure Team has mandated that we use the Hash Versions of GitHub Actions for Docker, stated below:
- https://github.com/apache/infrastructure-actions/blob/main/actions.yml
- Which generates: https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
- Due to: apache/infrastructure-actions#547

```yaml
docker/build-push-action:
  10e90e3645eae34f1e60eeb005ba3a3d33f178e8:
    tag: v6.19.2
docker/login-action:
  c94ce9fb468520275223c153574b00df6fe4bcc9:
    tag: v3.7.0
docker/metadata-action:
  c299e40c65443455700f0fdfc63efafe5b349051:
    tag: v5.10.0
docker/setup-buildx-action:
  8d2750c68a42422c14e847fe6c8ac0403b4cbd6f:
    tag: v3.12.0
```

This PR reverts our GitHub Actions for Docker to the hash versions stated above.

Signed-off-by: Lup Yuen Lee <[email protected]>
terana pushed a commit to terana/spark that referenced this pull request Mar 23, 2026
@dongjoon-hyun @terana
[SPARK-56126][INFRA] Sync docker-related GitHub Actions versions to…
7a47aba 
… the ASF approved patterns

### What changes were proposed in this pull request?

This PR aims to sync `docker`-related GitHub Actions versions to the ASF approved patterns.

### Why are the changes needed?

Currently, the CI is blocked by the ASF check because of the recent change.
- https://github.com/apache/spark/actions/workflows/build_main.yml
  - https://github.com/apache/spark/actions/runs/23362042477
- https://github.com/apache/spark/actions/workflows/build_non_ansi.yml
  - https://github.com/apache/spark/actions/runs/23369253367

> The actions docker/login-actionv3, docker/setup-qemu-actionv3, docker/setup-buildx-actionv3, and docker/build-push-actionv6 are not allowed in apache/spark because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns:

<img width="905" height="380" alt="Screenshot 2026-03-20 at 20 32 56" src="https://github.com/user-attachments/assets/2582b68a-6303-44ab-b961-d9b753072f1e" />

This is due to the following change.
- apache/infrastructure-actions#547

As of now, the updated patterns are the following.

- https://github.com/apache/infrastructure-actions/blob/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L100-L104
```
- docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
- docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
- docker/metadata-actionc299e40c65443455700f0fdfc63efafe5b349051
- docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
- docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

Manually check like the following because the updated CI should be triggered manually.

```
$ git grep 'uses: docker' | sort | uniq -c
   5 .github/workflows/build_and_test.yml:        uses: docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
   1 .github/workflows/build_and_test.yml:        uses: docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
   1 .github/workflows/build_and_test.yml:        uses: docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
   1 .github/workflows/build_and_test.yml:        uses: docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
  16 .github/workflows/build_infra_images_cache.yml:        uses: docker/build-push-action10e90e3645eae34f1e60eeb005ba3a3d33f178e8
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/login-actionc94ce9fb468520275223c153574b00df6fe4bcc9
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/setup-buildx-action8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
   1 .github/workflows/build_infra_images_cache.yml:        uses: docker/setup-qemu-action29109295f81e9208d7d86ff1c6c12d2833863392
```

### Was this patch authored or co-authored using generative AI tooling?

Generated-by: Claude Code (claude-opus-4-6)

Closes apache#54935 from dongjoon-hyun/SPARK-56126.

Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
Otpvondoiats pushed a commit to Otpvondoiats/nuttx that referenced this pull request Mar 31, 2026
@lupyuen @Otpvondoiats
CI: Revert GitHub Actions for Docker, by hash
d8efffd 
All CI Builds have been failing since 18 hours ago:
- apache#18571 (comment)
- https://github.com/apache/nuttx/actions/runs/23389990049

> _The action docker/login-action@v4 is not allowed in apache/nuttx because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: 1Password/load-secrets-action@13f58ee, 1Password/load-secrets-action@8d0d610, 1Password/load-secrets-action@dafbe7c, AdoptOpenJDK/install-jdk@*, BobAnkh/auto-generate-changelog@*, DavidAnson/markdownlint-cli2-action@07035fd, DavidAnson/markdownlint-cli2-action@30a0e04, EnricoMi/publish-unit-test-result-action@*, JamesIves/github-pages-deploy-action@4a3abc7, JamesIves/github-pages-deploy-action@d92aa23, Jimver/cuda-toolkit@6008063, Jimver/cuda-toolkit@b6fc3a9, JustinBeckwith/linkinator-action@af984b9f30f63e796..._

That's because ASF Infrastructure Team has mandated that we use the Hash Versions of GitHub Actions for Docker, stated below:
- https://github.com/apache/infrastructure-actions/blob/main/actions.yml
- Which generates: https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml
- Due to: apache/infrastructure-actions#547

```yaml
docker/build-push-action:
  10e90e3645eae34f1e60eeb005ba3a3d33f178e8:
    tag: v6.19.2
docker/login-action:
  c94ce9fb468520275223c153574b00df6fe4bcc9:
    tag: v3.7.0
docker/metadata-action:
  c299e40c65443455700f0fdfc63efafe5b349051:
    tag: v5.10.0
docker/setup-buildx-action:
  8d2750c68a42422c14e847fe6c8ac0403b4cbd6f:
    tag: v3.12.0
```

This PR reverts our GitHub Actions for Docker to the hash versions stated above.

Signed-off-by: Lup Yuen Lee <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hubcio @dfoulks1
⚡