Fix chart 1-2x line CI startup failure from non-allowlisted actions#69630
Merged
potiuk merged 1 commit intoJul 8, 2026
Merged
Conversation
Pull requests targeting chart/v1-2x-test failed to run any CI: every run ended in startup_failure and reported only branch-independent bot checks, so a PR could sit with no tests, static checks, or CodeQL. The cause was aws-actions/configure-aws-credentials pinned at v6.0.0, a version no longer on the ASF Actions allowlist; GitHub refuses to start a workflow that references a non-allowlisted action, and startup_failure produces no check runs, which is why the failure was invisible on the PR. Bump the stale action pins on this branch to the allowlisted revisions already used on main, and add the ASF Allowlist Check workflow so future drift onto a non-allowlisted action is caught here instead of silently breaking CI.
potiuk
requested review from
amoghrajesh,
ashb,
bugraoz93,
gopidesupavan,
jason810496,
jscheffl and
kaxil
as code owners
Miretpl
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PRs targeting
chart/v1-2x-testfailed to run any CI — every workflow run ended instartup_failureand the PR showed only branch-independent bot checks (Mergeable/WIP), so a change could sit with no tests, static checks, or CodeQL (e.g. #69579).Root cause: the branch pinned
aws-actions/configure-aws-credentials@8df5847… (v6.0.0), a version no longer on the ASF Actions allowlist. GitHub refuses to start a workflow that references a non-allowlisted action, and astartup_failureemits no check runs — which is why the failure was invisible on the PR.mainalready runs the allowlistedv6.2.1, which is whymainPRs are unaffected.This PR:
main(configure-aws-credentials→ v6.2.1,actions/checkout→ v7.0.0,actions/upload-artifact→ v7.0.1,github/codeql-action→ v4.36.2,astral-sh/setup-uv→ v8.2.0,slackapi/slack-github-action→ v3.0.3,pnpm/action-setup→ v6.0.9,actions/setup-node/setup-go/setup-java,actions/stale,actions/github-script,apache/infrastructure-actions/stash).main) so future drift onto a non-allowlisted action is caught here instead of silently breaking CI.chart/v1-2x-stablecarries the same stale pins and needs the same fix as a follow-up.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 4.8) following the guidelines