[SPARK-56724][INFRA][4.x] Make docker/* GitHub Actions up-to-date by sarutak · Pull Request #56517 · apache/spark

sarutak · 2026-06-15T13:56:43Z

What changes were proposed in this pull request?

Update the commit SHAs of the following Docker-related GitHub Actions in branch-4.x to match the ones registered in the Apache organization's GitHub Actions allowlist:

docker/login-action
docker/setup-qemu-action
docker/setup-buildx-action
docker/build-push-action

Why are the changes needed?

CI on branch-4.x fails with the error:

The actions docker/login-action@c94ce9fb..., docker/setup-qemu-action@29109295..., docker/setup-buildx-action@8d2750c6..., and docker/build-push-action@10e90e36... are not allowed in apache/spark because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns...

https://github.com/apache/spark/actions/runs/27544506457

The master branch was already updated to the new SHAs, but branch-4.x still had the old ones that are no longer in the allowlist.

[SPARK-56724][INFRA] Make docker/* GitHub Actions up-to-date #55687

Does this PR introduce any user-facing change?

No.

How was this patch tested?

CI should pass with this change.

Was this patch authored or co-authored using generative AI tooling?

Kiro CLI / Claude

dongjoon-hyun

+1, LGTM.

I revised the PR description by referring.

#55687

gaogaotiantian · 2026-06-15T19:23:56Z

Thank you for noticing this. We need the fix to all other maintenance branches too. 4.2 is probably freezing now so let's fix others first. The trigger is that we are moving CIs to the corresponding branches, which means we need to maintain the build_and_test.yml file for every branch (but it would be a much simpler file in the future).

dongjoon-hyun · 2026-06-15T19:26:11Z

BTW, @sarutak , if SHAs are different from #55687, you need to start from master branch again.

And, if there is not much difference, you had better cherry-pick and resolve the conflict while preserving the original JIRA ID. I guess we need this in branch-4.2 and older branch too, don't we?

Otherwise, it might be difficult to track because we need multiple JIRA issues for the same SHAs; master/branch-4.x/branch-4.2/branch-4.1/branch-4.0/branch-3.5.

This PR upgrades four `docker/*` GitHub Actions to the latest commit hashes approved by the Apache Software Foundation in [`infrastructure-actions/approved_patterns.yml`](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml): | Action | Before (tag) | After (tag) | | --- | --- | --- | | `docker/build-push-action` | `10e90e3645eae34f1e60eeb005ba3a3d33f178e8` (v6.19.2) | `bcafcacb16a39f128d818304e6c9c0c18556b85f` (v7.1.0) | | `docker/login-action` | `c94ce9fb468520275223c153574b00df6fe4bcc9` (v3.7.0) | `4907a6ddec9925e35a0a9e82d7399ccc52663121` (v4.1.0) | | `docker/setup-buildx-action` | `8d2750c68a42422c14e847fe6c8ac0403b4cbd6f` (v3.12.0) | `4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd` (v4.0.0) | | `docker/setup-qemu-action` | `29109295f81e9208d7d86ff1c6c12d2833863392` (v3.6.0) | `ce360397dd3f832beb865e1373c09c0e9f86d70a` (v4.0.0) | Updated workflow files (25 references in total): - `.github/workflows/build_and_test.yml` (8 references) - `.github/workflows/build_infra_images_cache.yml` (17 references) The previously pinned hashes were one major version behind upstream and predate the Node.js 20 runtime that Docker actions require going forward. Apache Infrastructure has already approved the newer hashes in `approved_patterns.yml`, so this PR brings Apache Spark's Docker actions onto the supported baseline while keeping ASF policy compliance. No. CI-only change; no Spark runtime, API, or release artifact is affected. Pass the CIs. Generated-by: Claude Code (claude-opus-4-7) Closesapache#55687 from dongjoon-hyun/SPARK-56724. Authored-by: Dongjoon Hyun <dongjoon@apache.org> Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>

dongjoon-hyun · 2026-06-15T20:58:00Z

Thank you for revising this PR, @sarutak .

sarutak · 2026-06-15T21:00:27Z

Cherry-picked from #55687 and change the PR title.
Also opened a PR for branch-4.1. Will open another PR for branch-4.2 once ~~4.0.3~~ 4.2.0 is released.
I think branch-4.0 and older branches don't need to change the hash because branch-4.0 and older branches use tag-based references (e.g., @V3) instead of pinned SHAs, so they are not affected by this allowlist change.

dongjoon-hyun · 2026-06-15T21:01:53Z

I guess you want to mention 4.2.0 RC3 instead of 4.0.3? I released 4.0.3 already last week. :)

Will open another PR for branch-4.2 once 4.0.3 is released.

And, it's great for branch-4.0 and olders~ Thank you for checking.

sarutak · 2026-06-15T21:05:07Z

I guess you want to mention 4.2.0 RC3 instead of 4.0.3? I released 4.0.3 already last week. :)

Oh sorry for the typo, I was half-asleep because I just woke up a few minutes ago, so...

gaogaotiantian · 2026-06-15T21:41:44Z

Hi @sarutak , if it's possible, could you merge this to the older branches as well.

I don't think we are supposed to use version pins like v3 for apache projects (unless it's pre-approved like github/apache official actions?). It was okay because the yml file is almost never used for older branches. Once the branch is cut, the build_and_test.yml file would only be used when a new commit is pushed to that branch.

However, we are moving to a point where build_and_test.yml on that branch is the only CI source for that branch, so the scheduled CI is using the build_and_test.yml file from that branch, instead of master. This change will effectively make build_and_test.yml on every branch active. We will need to update those files in the future so maybe it's nice to just update them now.

Even if we don't think about scheduled CI, the current commit to the branch will trigger CI based on build_and_test.yml on the old branch so maybe it's good to just update them?

sarutak · 2026-06-15T22:14:16Z

I think branch-4.0 and older branches don't need to change the hash because branch-4.0 and older branches use tag-based references (e.g., @V3) instead of pinned SHAs, so they are not affected by this allowlist change.

Let me correct my comment above. branch-4.0 uses pinned SHAs. Anyway, I'm OK to open PRs for older branches as @gaogaotiantian suggested. What do you think, @dongjoon-hyun ?

dongjoon-hyun · 2026-06-15T22:31:32Z

I'm okay too~

sarutak · 2026-06-16T00:13:58Z

Opend following PRs:
branch-4.0: #56531
branch-3.5: #56532

### What changes were proposed in this pull request? Update the commit SHAs of the following Docker-related GitHub Actions in `branch-4.x` to match the ones registered in the Apache organization's GitHub Actions allowlist: - `docker/login-action` - `docker/setup-qemu-action` - `docker/setup-buildx-action` - `docker/build-push-action` ### Why are the changes needed? CI on `branch-4.x` fails with the error: > The actions docker/login-actionc94ce9fb..., docker/setup-qemu-action29109295..., docker/setup-buildx-action8d2750c6..., and docker/build-push-action10e90e36... are not allowed in apache/spark because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns... https://github.com/apache/spark/actions/runs/27544506457 The `master` branch was already updated to the new SHAs, but `branch-4.x` still had the old ones that are no longer in the allowlist. - #55687 ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? CI should pass with this change. ### Was this patch authored or co-authored using generative AI tooling? Kiro CLI / Claude Closes#56517 from sarutak/update-docker-actions-branch-4x. Authored-by: Dongjoon Hyun <dongjoon@apache.org> Signed-off-by: Kousuke Saruta <sarutak@apache.org>

sarutak · 2026-06-17T03:31:37Z

Merged to branch-4.x. Thank you all for reviewing.

sarutak force-pushed the update-docker-actions-branch-4x branch from 22fe456 to a2ce3cdCompare June 15, 2026 16:41

dongjoon-hyun approved these changes Jun 15, 2026
View reviewed changes

sarutak force-pushed the update-docker-actions-branch-4x branch from a2ce3cd to 0e0a2d8Compare June 15, 2026 20:38

sarutak changed the title ~~[SPARK-57470][INFRA][4.x] Update docker action SHAs to match the allowlist on branch-4.x~~[SPARK-56724][INFRA][4.x] Update docker action SHAs to match the allowlist on branch-4.xJun 15, 2026

sarutak changed the title ~~[SPARK-56724][INFRA][4.x] Update docker action SHAs to match the allowlist on branch-4.x~~[SPARK-56724][INFRA][4.x] Make docker/* GitHub Actions up-to-dateJun 15, 2026

dongjoon-hyun approved these changes Jun 15, 2026
View reviewed changes

HyukjinKwon approved these changes Jun 16, 2026
View reviewed changes

dongjoon-hyun mentioned this pull request Jun 16, 2026
[SPARK-57496][SQL][BUILD] Keep the Types Framework ops and UDF worker packages out of the published API #56551
Closed

sarutak closed this Jun 17, 2026

Navigation Menu

Uh oh!

[SPARK-56724][INFRA][4.x] Make docker/* GitHub Actions up-to-date - #56517

[SPARK-56724][INFRA][4.x] Make docker/* GitHub Actions up-to-date#56517
sarutak wants to merge 1 commit into
apache:branch-4.xfrom
sarutak:update-docker-actions-branch-4x

sarutak commented Jun 15, 2026•
edited by dongjoon-hyun
Loading

Uh oh!

dongjoon-hyun left a comment

Uh oh!

gaogaotiantian commented Jun 15, 2026

Uh oh!

dongjoon-hyun commented Jun 15, 2026•
edited
Loading

Uh oh!

dongjoon-hyun commented Jun 15, 2026

Uh oh!

sarutak commented Jun 15, 2026•
edited
Loading

Uh oh!

dongjoon-hyun commented Jun 15, 2026•
edited
Loading

Uh oh!

sarutak commented Jun 15, 2026

Uh oh!

gaogaotiantian commented Jun 15, 2026•
edited
Loading

Uh oh!

sarutak commented Jun 15, 2026

Uh oh!

dongjoon-hyun commented Jun 15, 2026

Uh oh!

sarutak commented Jun 16, 2026

Uh oh!

sarutak commented Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

sarutak commented Jun 15, 2026• edited by dongjoon-hyun Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes were proposed in this pull request?

Why are the changes needed?

Does this PR introduce any user-facing change?

How was this patch tested?

Was this patch authored or co-authored using generative AI tooling?

Uh oh!

dongjoon-hyun left a comment

Choose a reason for hiding this comment

Uh oh!

gaogaotiantian commented Jun 15, 2026

Uh oh!

dongjoon-hyun commented Jun 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dongjoon-hyun commented Jun 15, 2026

Uh oh!

sarutak commented Jun 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dongjoon-hyun commented Jun 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sarutak commented Jun 15, 2026

Uh oh!

gaogaotiantian commented Jun 15, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sarutak commented Jun 15, 2026

Uh oh!

dongjoon-hyun commented Jun 15, 2026

Uh oh!

sarutak commented Jun 16, 2026

Uh oh!

sarutak commented Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sarutak commented Jun 15, 2026•
edited by dongjoon-hyun
Loading

dongjoon-hyun commented Jun 15, 2026•
edited
Loading

sarutak commented Jun 15, 2026•
edited
Loading

dongjoon-hyun commented Jun 15, 2026•
edited
Loading

gaogaotiantian commented Jun 15, 2026•
edited
Loading