CI doesn't run all jobs when GitHub Actions job is removed from Apache approved_patterns.yml #16914

Activity

1. ebyhr

   added

   bugSomething isn't workingSomething isn't working

   on Jun 22, 2026
2. ebyhr

   changed the title [-]CI silently passes when GitHub Actions job is expired[/-] [+]CI doesn't run all jobs when GitHub Actions job is removed from Apache approved_patterns.yml[/+] on Jun 22, 2026
3. manuzhang

   added 3 commits that reference this issue on Jun 22, 2026

   CI: Check ASF allowlist and update setup-gradle

   ...

   This issue will close once commit 0987666 is merged into the 'dev' branch.

   0987666

   CI: Check ASF allowlist and update setup-gradle

   ...

   This issue will close once commit f27be47 is merged into the 'dev' branch.

   f27be47

   CI: Check ASF action allowlist on every PR

   ...

   This issue will close once commit 5c4039f is merged into the 'dev' branch.

   5c4039f
4. kevinjqliu commented on Jun 22, 2026

   

   kevinjqliu

   on Jun 22, 2026

   Contributor

   More actions

   I looked into this, i think its actually expected that dependabot PRs (like #16903) do not modify the runtime-deps.txt file. And thus there can be a potential drift

   This is somewhat documented at

   iceberg/runtime-deps.gradle

   Lines 33 to 37 in fb6bb97

   	// generateRuntimeDeps - resolves runtimeClasspath and writes a sorted
   	// baseline of group:artifact:major.minor coordinates
   	// to runtime-deps.txt in the project directory.
   	// Patch versions are omitted so that routine
   	// Dependabot bumps never cause baseline drift.

   
   In #16233, I tried to get rid of the patch version runtime-deps.txt so that we see less noise.

   All the changes in https://github.com/apache/iceberg/pull/16908/changes are for minor versions, which lines up with the above

   I think maybe we just have to deal with this and manually update runtime-deps.txt. Open to suggestions! I'm just out of ideas
5. ebyhr commented on Jun 22, 2026

   

   ebyhr

   on Jun 22, 2026

   MemberAuthor

   More actions

   The stale runtime-deps.txt isn't the problem I want to address in this issue.

   The problem I was seeing is CI shows false green when the action is removed from Apache approved_patterns.yml. I think CI should fail in the PR so we can avoid accidental merge.
6. kevinjqliu commented on Jun 22, 2026

   

   kevinjqliu

   on Jun 22, 2026

   Contributor

   More actions

   Oh I see, you're right.

   https://github.com/apache/iceberg/pull/16903/checks has a bunch of skipped CI (the black part of the progress bar). This is what .github/workflows/asf-allowlist-check.yml should prevent, so #16926 makes sense to me
7. kevinjqliu

   closed this as completedin #16926on Jun 22, 2026
8. kevinjqliu commented on Jun 22, 2026

   

   kevinjqliu

   on Jun 22, 2026

   Contributor

   More actions

   Thanks for catching this!
9. kevinjqliu commented on Jun 22, 2026

   

   kevinjqliu

   on Jun 22, 2026

   Last edited by kevinjqliu

   Contributor

   More actions

   Unfortunately I copied this bug to every iceberg repo 😭

   https://grep.app/search?f.path.pattern=github%2Fworkflows%2Fasf-allowlist-check.yml&f.repo.pattern=apache%2Ficeberg&q=paths%3A

   • apache/iceberg
   • apache/iceberg-python
   • apache/iceberg-rust
   • apache/iceberg-go
   • apache/iceberg-cpp

   We should also copy over this CI check to https://github.com/apache/terraform-provider-iceberg/tree/main/.github for parity
10. kevinjqliu commented on Jun 22, 2026

    

    kevinjqliu

    on Jun 22, 2026

    Contributor

    More actions

    tracking in #16934
11. clairemcginty

    added a commit that references this issue on Jun 22, 2026

    CI: Check ASF action allowlist on every PR (apache#16926)

    ...

    This issue will close once commit 02631cd is merged into the 'main' branch.

    02631cd
12. jakelong95

    added a commit that references this issue on Jun 29, 2026

    CI: Check ASF action allowlist on every PR (apache#16926)

    ...

    This issue will close once commit 7fb2f0b is merged into the 'main' branch.

    7fb2f0b