From c3e7122b0ef1ffee0b05025b216bcc4781bc63a4 Mon Sep 17 00:00:00 2001 From: Eugene Gu Date: Fri, 6 Nov 2026 22:09:44 +0000 Subject: [PATCH] fix(deps, ci): bump sbt/setup-sbt to v1.5.14 to restore CI (#9346) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ### What changes were proposed in this PR? Nothing can merge into main right now. Every job that sets up sbt (`amber`, `amber-integration`, `platform` ×6, `platform-integration` ×6, `Bench`, the image builds and the dependency graph) has died at `Setup sbt launcher` since 2026-11-05 15:36 UTC, on main itself and on every PR, so `Required Checks` is red and the merge queue takes nothing. Nothing in this repository changed: main at `312a0cefc` (#9325, run at 07:16 UTC) was green, main at `8b0fb168e` (#8848, run at 20:54 UTC) is red, and that commit touches three frontend files. Before: Scala job -> sbt/setup-sbt v1.5.12 -> "Verify the sbt distribution signature" reads carabiner-dev/policies at HEAD -> ampel v1.3.6 cannot parse it -> exit 1 before sbt is installed After: Scala job -> sbt/setup-sbt v1.5.14 -> the same step reads the policy pinned at carabiner-dev/policies@971d670e9 -> sbt installs -> the job runs Root cause. v1.5.12 hands `carabiner-dev/actions/ampel/verify@32587e8` (ampel v1.3.6) the policy argument `git+https://github.com/carabiner-dev/policies#signature/signature.json`, with no ref, so the policy is whatever that repository's main holds at run time. On 2026-11-05 `signature/signature.json` gained a `meta.name` field that ampel v1.3.6 rejects, and ampel exits while loading the policy with `compiling policy: unable to parse a policy, group or policySet from data`. The step's `fail: false` covers a failed verification verdict, not the loader exiting, so the composite action fails and the job stops. sbt/setup-sbt#155, released as v1.5.14 the same day, pins the policy to `carabiner-dev/policies@971d670e93f2fb4da304b0e5f071066dc4686a5a`, a commit without the field. Change. All 9 call sites (`build.yml` ×4, `build-and-push-images.yml` ×3, `benchmarks.yml`, `dependency-graph.yml`) move from `ecad189dd245444b9ae0a0cd5922fd938b88906f` (v1.5.12) to `67d461eba2c4753196c230e02da850757ba4775e` (v1.5.14), as #9100 moved them to v1.5.12. Between the two versions `action.yml` differs in two lines: the policy pin above and the default `sbt-runner-version` (2.0.10 -> 2.0.12), which this repository does not use because `project/build.properties` sets `sbt.version`. The nested actions, `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` and `carabiner-dev/actions/ampel/verify@32587e82f960d49b36101e8c45d1956e511965d3`, are the same in both, and no call site passes inputs. Scope. v1.5.13 is already on the ASF allow list but carries the same unpinned policy line, so it fails the same way; v1.5.14 is the first version that does not. This PR changes nothing about what the signature step does when it runs; it only stops the step from reading a moving target. **Blocked on apache/infrastructure-actions#1498.** `sbt/setup-sbt@67d461eba` is not on the ASF actions allow list yet; #1498 (opened 2026-11-05 13:39 UTC) adds it. Until it merges, every sbt job on this PR fails at `Set up job` with the action not allowed, which is how v1.5.7 failed in #9100, so the red checks here are expected and this PR must not be merged before #1498 lands. Once it does, a re-run of the failed jobs is the proof; nothing in this branch needs to change. ### Any related issues, documentation, discussions? Closes #9345. Upstream fix: sbt/setup-sbt#155 (v1.5.14). Allow-list entry: apache/infrastructure-actions#1498. Precedent: #9100 moved the same 9 call sites to v1.5.12 after the ASF allow list dropped the actions v1.5.7 reached, with backports #9132 (v1.3) and #9133 (v1.2); #7710 and #6990 are the earlier bumps of the same kind. ### How was this PR tested? Every changed file parses: ``` python -I -c "import sys, yaml; [yaml.safe_load(open(f, encoding='utf-8')) for f in sys.argv[1:]]" .github/workflows/build.yml .github/workflows/build-and-push-images.yml .github/workflows/benchmarks.yml .github/workflows/dependency-graph.yml ``` `git ls-remote --tags https://github.com/sbt/setup-sbt.git` resolves `refs/tags/v1.5.14^{}` to `67d461eba2c4753196c230e02da850757ba4775e`. Diffing `action.yml` at `ecad189` against `67d461eba` shows only the two lines described above, with identical `uses:` lines. Walking the `uses:` chain under v1.5.14 reaches `ampel/verify@32587e8`, which is in `apache/infrastructure-actions` `approved_patterns.yml`; `sbt/setup-sbt@67d461eba` itself is not yet, which apache/infrastructure-actions#1498 adds. The rest is CI. The labeler applies `ci` for `.github/**`, which runs every stack that sets up sbt. Those jobs cannot pass until apache/infrastructure-actions#1498 lands (see above); the re-run after that is the test, and the checks on this PR are the first run of v1.5.14 in this repository. ### Was this PR authored or co-authored using generative AI tooling? Yes. Generated-by: Claude Code (claude-fable-5-1). Co-authored with Claude; the author reviewed the change before submission. (backported from commit c6a464568c2efe706f5b761a6ba0be877a7b96d4) --- .github/workflows/benchmarks.yml | 2 +- .github/workflows/build-and-push-images.yml | 6 +++--- .github/workflows/build.yml | 8 ++++---- .github/workflows/dependency-graph.yml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index a34f34dc98f..3d2d60f45cf 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -241,7 +241,7 @@ jobs: - name: Generate Python proto bindings run: bash bin/python-proto-gen.sh - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' diff --git a/.github/workflows/build-and-push-images.yml b/.github/workflows/build-and-push-images.yml index 9e4a334882d..896852587e4 100644 --- a/.github/workflows/build-and-push-images.yml +++ b/.github/workflows/build-and-push-images.yml @@ -126,7 +126,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: @@ -334,7 +334,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: @@ -431,7 +431,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index afae01298b4..5f79832c43b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -246,7 +246,7 @@ jobs: env: PGPASSWORD: postgres - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -500,7 +500,7 @@ jobs: env: PGPASSWORD: postgres - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -813,7 +813,7 @@ jobs: distribution: "temurin" java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -968,7 +968,7 @@ jobs: distribution: "temurin" java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml index 4a2ddf05d17..c7b4a65cf80 100644 --- a/.github/workflows/dependency-graph.yml +++ b/.github/workflows/dependency-graph.yml @@ -48,7 +48,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 + uses: sbt/setup-sbt@67d461eba2c4753196c230e02da850757ba4775e # v1.5.14 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1