CI doesn't run all jobs when GitHub Actions job is removed from Apache approved_patterns.yml

[ebyhr]

Please describe the bug 🐞

CI shows false green when the GitHub Actions job is excluded from https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml

For example, #16903 only ran 6 jobs because gradle/actions/setup-gradle was stale after apache/infrastructure-actions@25ab499

https://github.com/apache/iceberg-python has the same problem (apache/iceberg-python#3510).
I haven't confirmed other Iceberg repositories.

Willingness to contribute

• I can contribute a fix for this bug independently
• I would be willing to contribute a fix for this bug with guidance from the Iceberg community
• I cannot contribute a fix for this bug at this time

[kevinjqliu]

I looked into this, i think its actually expected that dependabot PRs (like #16903) do not modify the runtime-deps.txt file. And thus there can be a potential drift

This is somewhat documented at

iceberg/runtime-deps.gradle

Lines 33 to 37 in fb6bb97

	// generateRuntimeDeps - resolves runtimeClasspath and writes a sorted
	// baseline of group:artifact:major.minor coordinates
	// to runtime-deps.txt in the project directory.
	// Patch versions are omitted so that routine
	// Dependabot bumps never cause baseline drift.

In #16233, I tried to get rid of the patch version runtime-deps.txt so that we see less noise.

All the changes in https://github.com/apache/iceberg/pull/16908/changes are for minor versions, which lines up with the above

I think maybe we just have to deal with this and manually update runtime-deps.txt. Open to suggestions! I'm just out of ideas

[ebyhr]

The stale runtime-deps.txt isn't the problem I want to address in this issue.

The problem I was seeing is CI shows false green when the action is removed from Apache approved_patterns.yml. I think CI should fail in the PR so we can avoid accidental merge.

[kevinjqliu]

Oh I see, you're right.

https://github.com/apache/iceberg/pull/16903/checks has a bunch of skipped CI (the black part of the progress bar). This is what .github/workflows/asf-allowlist-check.yml should prevent, so #16926 makes sense to me

[kevinjqliu]

Thanks for catching this!

[kevinjqliu]

Unfortunately I copied this bug to every iceberg repo 😭

https://grep.app/search?f.path.pattern=github%2Fworkflows%2Fasf-allowlist-check.yml&f.repo.pattern=apache%2Ficeberg&q=paths%3A

• apache/iceberg
• apache/iceberg-python
• apache/iceberg-rust
• apache/iceberg-go
• apache/iceberg-cpp

We should also copy over this CI check to https://github.com/apache/terraform-provider-iceberg/tree/main/.github for parity

[kevinjqliu]

tracking in #16934