Repository navigation
fix(deps, ci): bump sbt/setup-sbt to v1.5.7 to restore CI - #7710
Merged
Merged
Conversation
The ASF actions allowlist stopped permitting carabiner-dev/actions@2a11d59, which v1.5.2 reaches transitively through carabiner-dev/actions@94f2939. Every job that sets sbt up now fails during "Prepare all required actions", before checkout. v1.5.7 routes through ampel/verify@36a39ef -> install/ampel@2fec8bd8 instead, and no longer pulls install/bnd at all.
Contributor
Automated Reviewer SuggestionsBased on the
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7710 +/- ##
============================================
+ Coverage 90.93% 90.95% +0.01%
- Complexity 4450 4456 +6
============================================
Files 1175 1175
Lines 47140 47140
Branches 5284 5284
============================================
+ Hits 42865 42874 +9
+ Misses 2582 2580 -2
+ Partials 1693 1686 -7
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
aglinxinyuan
changed the title
Contributor
|
| config | throughput | MB/s | latency | max Δ latest / 7d | |
|---|---|---|---|---|---|
| 🔴 | bs=10 sw=10 sl=64 | 404 | 0.246 | 23,707/30,775/30,775 us | 🟢 -16.5% / 🔴 +90.3% |
| 🟢 | bs=100 sw=10 sl=64 | 800 | 0.488 | 124,880/146,676/146,676 us | 🟢 -5.2% / 🔴 +38.9% |
| ⚪ | bs=1000 sw=10 sl=64 | 910 | 0.555 | 1,099,506/1,183,774/1,183,774 us | ⚪ within ±5% / 🔴 +17.0% |
Baseline details
Latest main 9d58135 from same runner
| config | metric | PR | latest main | 7d avg | Δ latest | Δ 7d |
|---|---|---|---|---|---|---|
| bs=10 sw=10 sl=64 | throughput | 404 tuples/sec | 403 tuples/sec | 784.16 tuples/sec | +0.2% | -48.5% |
| bs=10 sw=10 sl=64 | MB/s | 0.246 MB/s | 0.246 MB/s | 0.479 MB/s | 0.0% | -48.6% |
| bs=10 sw=10 sl=64 | p50 | 23,707 us | 22,553 us | 12,626 us | +5.1% | +87.8% |
| bs=10 sw=10 sl=64 | p95 | 30,775 us | 36,877 us | 16,169 us | -16.5% | +90.3% |
| bs=10 sw=10 sl=64 | p99 | 30,775 us | 36,877 us | 18,986 us | -16.5% | +62.1% |
| bs=100 sw=10 sl=64 | throughput | 800 tuples/sec | 794 tuples/sec | 1,023 tuples/sec | +0.8% | -21.8% |
| bs=100 sw=10 sl=64 | MB/s | 0.488 MB/s | 0.485 MB/s | 0.625 MB/s | +0.6% | -21.9% |
| bs=100 sw=10 sl=64 | p50 | 124,880 us | 122,346 us | 99,185 us | +2.1% | +25.9% |
| bs=100 sw=10 sl=64 | p95 | 146,676 us | 154,705 us | 105,616 us | -5.2% | +38.9% |
| bs=100 sw=10 sl=64 | p99 | 146,676 us | 154,705 us | 113,681 us | -5.2% | +29.0% |
| bs=1000 sw=10 sl=64 | throughput | 910 tuples/sec | 904 tuples/sec | 1,057 tuples/sec | +0.7% | -13.9% |
| bs=1000 sw=10 sl=64 | MB/s | 0.555 MB/s | 0.552 MB/s | 0.645 MB/s | +0.5% | -13.9% |
| bs=1000 sw=10 sl=64 | p50 | 1,099,506 us | 1,109,023 us | 965,435 us | -0.9% | +13.9% |
| bs=1000 sw=10 sl=64 | p95 | 1,183,774 us | 1,150,646 us | 1,012,135 us | +2.9% | +17.0% |
| bs=1000 sw=10 sl=64 | p99 | 1,183,774 us | 1,150,646 us | 1,042,088 us | +2.9% | +13.6% |
Raw CSV
config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,495.48,200,128000,404,0.246,23706.71,30774.88,30774.88
1,100,10,64,20,2499.84,2000,1280000,800,0.488,124879.76,146675.81,146675.81
2,1000,10,64,20,21984.73,20000,12800000,910,0.555,1099506.46,1183774.42,1183774.42
Contributor
|
Backport PR opened: draft #7716 (#7716) to |
This was referenced Oct 21, 2026
renovate-bot
pushed a commit
to renovate-bot/apache-_-texera
that referenced
this pull request
Nov 6, 2026
### What changes were proposed in this PR? Nothing can merge into main right now. Every job that sets up sbt (`amber`, `amber-integration`, `platform` ×6, `platform-integration` ×6, `Bench`, the image builds and the dependency graph) has died at `Setup sbt launcher` since 2026-11-05 15:36 UTC, on main itself and on every PR, so `Required Checks` is red and the merge queue takes nothing. Nothing in this repository changed: main at `312a0cefc` (apache#9325, run at 07:16 UTC) was green, main at `8b0fb168e` (apache#8848, run at 20:54 UTC) is red, and that commit touches three frontend files. Before: Scala job -> sbt/setup-sbt v1.5.12 -> "Verify the sbt distribution signature" reads carabiner-dev/policies at HEAD -> ampel v1.3.6 cannot parse it -> exit 1 before sbt is installed After: Scala job -> sbt/setup-sbt v1.5.14 -> the same step reads the policy pinned at carabiner-dev/policies@971d670e9 -> sbt installs -> the job runs Root cause. v1.5.12 hands `carabiner-dev/actions/ampel/verify@32587e8` (ampel v1.3.6) the policy argument `git+https://github.com/carabiner-dev/policies#signature/signature.json`, with no ref, so the policy is whatever that repository's main holds at run time. On 2026-11-05 `signature/signature.json` gained a `meta.name` field that ampel v1.3.6 rejects, and ampel exits while loading the policy with `compiling policy: unable to parse a policy, group or policySet from data`. The step's `fail: false` covers a failed verification verdict, not the loader exiting, so the composite action fails and the job stops. sbt/setup-sbt#155, released as v1.5.14 the same day, pins the policy to `carabiner-dev/policies@971d670e93f2fb4da304b0e5f071066dc4686a5a`, a commit without the field. Change. All 9 call sites (`build.yml` ×4, `build-and-push-images.yml` ×3, `benchmarks.yml`, `dependency-graph.yml`) move from `ecad189dd245444b9ae0a0cd5922fd938b88906f` (v1.5.12) to `67d461eba2c4753196c230e02da850757ba4775e` (v1.5.14), as apache#9100 moved them to v1.5.12. Between the two versions `action.yml` differs in two lines: the policy pin above and the default `sbt-runner-version` (2.0.10 -> 2.0.12), which this repository does not use because `project/build.properties` sets `sbt.version`. The nested actions, `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` and `carabiner-dev/actions/ampel/verify@32587e82f960d49b36101e8c45d1956e511965d3`, are the same in both, and no call site passes inputs. Scope. v1.5.13 is already on the ASF allow list but carries the same unpinned policy line, so it fails the same way; v1.5.14 is the first version that does not. This PR changes nothing about what the signature step does when it runs; it only stops the step from reading a moving target. **Blocked on apache/infrastructure-actions#1498.** `sbt/setup-sbt@67d461eba` is not on the ASF actions allow list yet; apache#1498 (opened 2026-11-05 13:39 UTC) adds it. Until it merges, every sbt job on this PR fails at `Set up job` with the action not allowed, which is how v1.5.7 failed in apache#9100, so the red checks here are expected and this PR must not be merged before apache#1498 lands. Once it does, a re-run of the failed jobs is the proof; nothing in this branch needs to change. ### Any related issues, documentation, discussions? Closes apache#9345. Upstream fix: sbt/setup-sbt#155 (v1.5.14). Allow-list entry: apache/infrastructure-actions#1498. Precedent: apache#9100 moved the same 9 call sites to v1.5.12 after the ASF allow list dropped the actions v1.5.7 reached, with backports apache#9132 (v1.3) and apache#9133 (v1.2); apache#7710 and apache#6990 are the earlier bumps of the same kind. ### How was this PR tested? Every changed file parses: ``` python -I -c "import sys, yaml; [yaml.safe_load(open(f, encoding='utf-8')) for f in sys.argv[1:]]" .github/workflows/build.yml .github/workflows/build-and-push-images.yml .github/workflows/benchmarks.yml .github/workflows/dependency-graph.yml ``` `git ls-remote --tags https://github.com/sbt/setup-sbt.git` resolves `refs/tags/v1.5.14^{}` to `67d461eba2c4753196c230e02da850757ba4775e`. Diffing `action.yml` at `ecad189` against `67d461eba` shows only the two lines described above, with identical `uses:` lines. Walking the `uses:` chain under v1.5.14 reaches `ampel/verify@32587e8`, which is in `apache/infrastructure-actions` `approved_patterns.yml`; `sbt/setup-sbt@67d461eba` itself is not yet, which apache/infrastructure-actions#1498 adds. The rest is CI. The labeler applies `ci` for `.github/**`, which runs every stack that sets up sbt. Those jobs cannot pass until apache/infrastructure-actions#1498 lands (see above); the re-run after that is the test, and the checks on this PR are the first run of v1.5.14 in this repository. ### Was this PR authored or co-authored using generative AI tooling? Yes. Generated-by: Claude Code (claude-fable-5-1). Co-authored with Claude; the author reviewed the change before submission.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this PR?
CI has been red repo-wide since 2026-08-16 ~02:00 UTC —
main, the merge queue, and every PR that runs a Scala stack. The jobs die in 3–7s during Prepare all required actions, before checkout, so they produce no test output at all.The cause is the ASF actions allowlist, not anything in this repository.
sbt/setup-sbtreaches a nestedcarabiner-devaction that is no longer permitted:Nothing in the tree changed — every link in that chain is SHA-pinned, and the
sbt/setup-sbtpin last moved in #6710 on 2026-07-22. The same2a11d59downloaded successfully at2026-08-15T02:01Z(#7674's amber job) and is rejected at2026-08-17T02:13Z. Last clean run before the break: merge-queuepr-7699at2026-08-16T01:52:00Z; first failure:mainat2026-08-16T02:04:42Z.This bumps all 9 call sites from v1.5.2 to v1.5.7, which resolves down a different path:
ampel/verify94f2939(v1.2.1)36a39ef(v1.2.6)install/ampel2a11d59— blocked2fec8bd8install/bnd2a11d59Call sites:
benchmarks.yml(1),build-and-push-images.yml(3),build.yml(4),dependency-graph.yml(1).Any related issues, documentation, discussions?
No issue filed — the regression originates outside the repository and this PR is the unblock. The previous bump of this pin was #6710.
How was this PR tested?
By this PR's CI, which is the only place the failure reproduces — it depends on the
apache/texeraactions policy and cannot be triggered locally or on a fork.The change touches
.github/**, so the labeler appliesci, andcimaps to every stack inLABEL_STACKS(.github/workflows/precheck.yml) —frontend,amber,amber-integration,platform,platform-integration,pyamber,agent-service,infra,pyright-language-service— plusBench. Every job that consumessbt/setup-sbtis therefore exercised here.Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Opus 5)