From 77021edbdf664c7bdff5fa8722eacfe1f43e935e Mon Sep 17 00:00:00 2001 From: Mend Renovate Date: Mon, 10 Aug 2026 02:04:11 +0000 Subject: [PATCH 1/3] chore(deps, ci): update github-actions --- .github/workflows/benchmarks.yml | 4 ++-- .github/workflows/build-and-push-images.yml | 18 +++++++++--------- .github/workflows/build.yml | 14 +++++++------- .github/workflows/dependency-graph.yml | 4 ++-- 4 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index b07c146f897..b7988de9bfd 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -214,7 +214,7 @@ jobs: - name: Setup Python uses: actions/setup-python@v7 with: - python-version: "3.12" + python-version: "3.14" - name: Install Python dependencies # Mirrors amber-integration's installer in build.yml so the bench # subprocess imports resolve identically (pytorch CPU index + @@ -241,7 +241,7 @@ jobs: - name: Generate Python proto bindings run: bash bin/python-proto-gen.sh - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' diff --git a/.github/workflows/build-and-push-images.yml b/.github/workflows/build-and-push-images.yml index fb5885492a2..0dfaed4d215 100644 --- a/.github/workflows/build-and-push-images.yml +++ b/.github/workflows/build-and-push-images.yml @@ -126,7 +126,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: @@ -328,7 +328,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: @@ -353,7 +353,7 @@ jobs: - name: Log in to GitHub Container Registry if: startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -361,7 +361,7 @@ jobs: - name: Log in to Docker Hub if: ${{ !startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') }} - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} @@ -408,7 +408,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: @@ -439,7 +439,7 @@ jobs: - name: Log in to GitHub Container Registry if: startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -447,7 +447,7 @@ jobs: - name: Log in to Docker Hub if: ${{ !startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') }} - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} @@ -481,7 +481,7 @@ jobs: steps: - name: Log in to GitHub Container Registry if: startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -489,7 +489,7 @@ jobs: - name: Log in to Docker Hub if: ${{ !startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') }} - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ebb79678ff9..91373fe8d52 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -124,7 +124,7 @@ jobs: - name: Setup Python uses: actions/setup-python@v7 with: - python-version: "3.12" + python-version: "3.14" - name: Install dependency timeout-minutes: 20 run: yarn --cwd frontend install --immutable --inline-builds --network-timeout=100000 @@ -228,7 +228,7 @@ jobs: env: PGPASSWORD: postgres - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -394,7 +394,7 @@ jobs: - name: Setup Python for Scala-Python integration tests uses: actions/setup-python@v7 with: - python-version: "3.11" + python-version: "3.14" - name: Show Python run: python --version || python3 --version - name: Install Python dependencies @@ -478,7 +478,7 @@ jobs: env: PGPASSWORD: postgres - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -785,7 +785,7 @@ jobs: distribution: "temurin" java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -940,7 +940,7 @@ jobs: distribution: "temurin" java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -1309,7 +1309,7 @@ jobs: uses: actions/setup-node@v7 with: # Matches the frontend job's pinned Node. - node-version: 24.10.0 + node-version: 24.19.0 - name: Prepare Yarn 1.22.22 # The package ships a classic (v1) lockfile; pin the matching Yarn # via corepack rather than relying on the runner image's bundled diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml index 1321846d97b..4034b15715f 100644 --- a/.github/workflows/dependency-graph.yml +++ b/.github/workflows/dependency-graph.yml @@ -48,11 +48,11 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 + uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 - name: Submit sbt dependency graph - uses: scalacenter/sbt-dependency-submission@d84eef4c09e633bcf5f113bcad7fd5e9af1baee9 # v3.1.1 + uses: scalacenter/sbt-dependency-submission@d84eef4c09e633bcf5f113bcad7fd5e9af1baee9 # v3.2.3 with: configs-ignore: provided optional test compile-internal runtime-internal scala-tool scala-doc-tool From 2a2ce73cc6d933561615174fe73c29e8e790f4f6 Mon Sep 17 00:00:00 2001 From: Xinyuan Lin Date: Tue, 11 Aug 2026 00:15:35 -0700 Subject: [PATCH 2/3] fix(ci): keep sbt/setup-sbt and docker/login-action on allowlisted SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v1.5.7 pin for sbt/setup-sbt is not on the ASF GitHub Enterprise actions allowlist, so GitHub rejects the run while building the workflow graph: The action sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc is not allowed in apache/texera because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: ... Required Checks, Backport Checks and Benchmarks all end in startup_failure with zero jobs (build.yml is the reusable workflow the first two call), so the `Required Checks` status context is never created and the PR can never satisfy branch protection. Same failure mode as #6989, #4643 and #4344. docker/login-action v4.6.0 is reverted for the same reason: it only appears in build-and-push-images.yml, which does not run on pull_request, so PR CI cannot prove the new SHA is allowlisted — and #4344 was exactly that action's SHAs being rejected after merge. Both pins go back to the SHAs main already runs green on. The rest of the bump (Node 24.19.0, Python 3.14, the corrected sbt-dependency-submission version comment) is unchanged. --- .github/workflows/benchmarks.yml | 2 +- .github/workflows/build-and-push-images.yml | 18 +++++++++--------- .github/workflows/build.yml | 8 ++++---- .github/workflows/dependency-graph.yml | 2 +- 4 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index b7988de9bfd..949c7de2762 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -241,7 +241,7 @@ jobs: - name: Generate Python proto bindings run: bash bin/python-proto-gen.sh - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' diff --git a/.github/workflows/build-and-push-images.yml b/.github/workflows/build-and-push-images.yml index 0dfaed4d215..fb5885492a2 100644 --- a/.github/workflows/build-and-push-images.yml +++ b/.github/workflows/build-and-push-images.yml @@ -126,7 +126,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: @@ -328,7 +328,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: @@ -353,7 +353,7 @@ jobs: - name: Log in to GitHub Container Registry if: startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -361,7 +361,7 @@ jobs: - name: Log in to Docker Hub if: ${{ !startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') }} - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} @@ -408,7 +408,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: @@ -439,7 +439,7 @@ jobs: - name: Log in to GitHub Container Registry if: startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -447,7 +447,7 @@ jobs: - name: Log in to Docker Hub if: ${{ !startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') }} - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} @@ -481,7 +481,7 @@ jobs: steps: - name: Log in to GitHub Container Registry if: startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -489,7 +489,7 @@ jobs: - name: Log in to Docker Hub if: ${{ !startsWith(needs.set-parameters.outputs.docker_registry, 'ghcr.io/') }} - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 91373fe8d52..d58e562c967 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -228,7 +228,7 @@ jobs: env: PGPASSWORD: postgres - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -478,7 +478,7 @@ jobs: env: PGPASSWORD: postgres - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -785,7 +785,7 @@ jobs: distribution: "temurin" java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' @@ -940,7 +940,7 @@ jobs: distribution: "temurin" java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 with: extraSbtFiles: '["*.sbt", "project/**.{scala,sbt}", "project/build.properties" ]' diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml index 4034b15715f..f4b7be10f4c 100644 --- a/.github/workflows/dependency-graph.yml +++ b/.github/workflows/dependency-graph.yml @@ -48,7 +48,7 @@ jobs: java-version: 17 - name: Setup sbt launcher - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@6444f4c8111de4b9059c3975def104b03cfaa5f0 # v1.5.2 - uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 From 92dae724f95b3ae422e7c8c4be8edf695754b1ff Mon Sep 17 00:00:00 2001 From: Xinyuan Lin Date: Tue, 11 Aug 2026 00:51:46 -0700 Subject: [PATCH 3/3] fix(ci): drop the Python 3.14 bump and sync the frontend Node pin Python 3.14 breaks amber-integration on macOS. numpy is pinned at 2.1.0, which predates 3.14 and ships no cp314 wheel, so uv builds it from source and Apple clang 21 rejects its C++: x Failed to build `numpy==2.1.0` `-> Call to `mesonpy.build_wheel` failed (exit status: 1) ../numpy/_core/src/umath/string_fastsearch.h:132:5: error: no type named ... 11 errors generated. numpy, pandas and pyarrow are deliberately frozen (.github/ renovate.json5) because they sit on the Arrow IPC path between the JVM engine and the Python workers, so the Python floor cannot move until they do. pyamber's own matrix is ["3.11", "3.12", "3.13"] for the same reason -- 3.14 would have tested the engine against a Python the workers do not support. The Linux build happens to succeed (Benchmarks is ubuntu-only and went green on 3.14), but amber-integration runs a macOS leg, so the bump cannot stand. The Node bump is kept and completed. Renovate only rewrote the `with: node-version:` literal in the pyright-language-service job; the frontend job takes its version from a bare matrix list item the github-actions manager does not match, so it stayed on 24.10.0 and falsified the "Matches the frontend job's pinned Node." comment directly above the bumped line. Both are now 24.19.0. This invalidates the frontend yarn cache once, since the key is keyed on matrix.node-version. --- .github/workflows/benchmarks.yml | 2 +- .github/workflows/build.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index 949c7de2762..b07c146f897 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -214,7 +214,7 @@ jobs: - name: Setup Python uses: actions/setup-python@v7 with: - python-version: "3.14" + python-version: "3.12" - name: Install Python dependencies # Mirrors amber-integration's installer in build.yml so the bench # subprocess imports resolve identically (pytorch CPU index + diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d58e562c967..c28457b1986 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -97,7 +97,7 @@ jobs: - os: windows-latest arch: x64 node-version: - - 24.10.0 + - 24.19.0 steps: - name: Checkout Texera uses: actions/checkout@v7 @@ -124,7 +124,7 @@ jobs: - name: Setup Python uses: actions/setup-python@v7 with: - python-version: "3.14" + python-version: "3.12" - name: Install dependency timeout-minutes: 20 run: yarn --cwd frontend install --immutable --inline-builds --network-timeout=100000 @@ -394,7 +394,7 @@ jobs: - name: Setup Python for Scala-Python integration tests uses: actions/setup-python@v7 with: - python-version: "3.14" + python-version: "3.11" - name: Show Python run: python --version || python3 --version - name: Install Python dependencies