The action astral-sh/setup-uv@v7 is not allowed in apache/iceberg-python

[kevinjqliu]

Hey folks,

I'm running into an issue with our github action suddenly failing today. Was there any changes on the infra side?

I'm seeing

Error
The action astral-sh/setup-uv@v7 is not allowed in apache/iceberg-python because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns

I see the astral-sh/setup-uv allowlist here but looking through the commit history, astral-sh/setup-uv@v7 was never allowed. Why did it start failing today?

More importantly, because the action failed on "startup failure", it is ignored in my PR (apache/iceberg-python#3171). Everything looks green even though the CI failed to start. This can be a huge footgun.

[dfoulks1]

There was a security vulnerability that required us to disable the blanket approval for verified actions. This may have caused some disturbance to your workflow. We sent out an email a while ago with details. In short please submit a PR to this repo requesting to explicitly whitelist the actions required.

[kevinjqliu]

Thanks for the context! Was that change made recently? Looking at our github action logs, this started happening as of today.

What im concerned about is the fact that this is silently failing, and theres no indication of failure from github
For example, for this PR the CI action ran but failed on "startup failure" (https://github.com/apache/iceberg-python/actions/runs/23358400193). But github pr is all green.

This can potentially impact many repos, https://grep.app/search?f.repo.pattern=apache%2F&q=astral-sh%2Fsetup-uv%40v

[kevinjqliu]

We can (and should) definitely fix forward, but the fact that the CI is just skipped by Github is scary

[dfoulks1]

Yes, a security issue in a verified action was discovered earlier today, verified actions were disabled roughly 5 hours ago.

[kevinjqliu]

Thanks @dfoulks1 is there a list of changes i can reference?

Also, could you help me understand why astral-sh/setup-uv@v7 was working prior to today? I see the allowlist only contains entries for setup-uv with commit hashes.
https://github.com/apache/infrastructure-actions/blame/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L7-L9

[kevinjqliu]

btw heres my findings about the github behavior.

Our CI workflow failed with "startup failture", due to astral-sh/setup-uv being blocked.

The PR UI has no indication of workflow failure; it doesn't show the CI workflow either (which was how I stumble on this issue)

In the PR's "Checks" tab, I see a fixture of green and black:

The "black" status does not get reported as failure; it is silently ignored.

[kevinjqliu]

List of affeted repos

gh search code "setup-uv@v org:apache" --json repository --jq '.[].repository.nameWithOwner' | sort -u

• apache/datafusion-ballista (ci: pin third-party actions to Apache-approved SHAs datafusion-ballista#1516)
• apache/datafusion-python (ci: pin third-party actions to Apache-approved SHAs datafusion-python#1438)
• apache/datafusion-ray (ci: pin third-party actions to Apache-approved SHAs datafusion-ray#92)
• apache/flink-agents
• apache/hamilton
• apache/hudi-rs (ci: pin third-party actions to Apache-approved SHAs hudi-rs#550)
• apache/iceberg (ci: pin third-party actions to Apache-approved SHAs iceberg#15707)
• apache/iceberg-python (ci: pin third-party actions to Apache-approved SHAs iceberg-python#3172)
• apache/iceberg-rust (ci: pin third-party actions to Apache-approved SHAs iceberg-rust#2266)
• apache/libcloud
• apache/mahout
• apache/nifi
• apache/opendal
• apache/otava
• apache/sedona
• apache/steve
• apache/tvm-ffi