Repository navigation
The action astral-sh/setup-uv@v7 is not allowed in apache/iceberg-python #550
Description
Hey folks,
I'm running into an issue with our github action suddenly failing today. Was there any changes on the infra side?
I'm seeing
Error
The action astral-sh/setup-uv@v7 is not allowed in apache/iceberg-python because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns
I see the astral-sh/setup-uv allowlist here but looking through the commit history, astral-sh/setup-uv@v7 was never allowed. Why did it start failing today?
More importantly, because the action failed on "startup failure", it is ignored in my PR (apache/iceberg-python#3171). Everything looks green even though the CI failed to start. This can be a huge footgun.
Activity
dfoulks1 commentedon Mar 20, 2026
There was a security vulnerability that required us to disable the blanket approval for verified actions. This may have caused some disturbance to your workflow. We sent out an email a while ago with details. In short please submit a PR to this repo requesting to explicitly whitelist the actions required.
kevinjqliu commentedon Mar 20, 2026
Thanks for the context! Was that change made recently? Looking at our github action logs, this started happening as of today.
What im concerned about is the fact that this is silently failing, and theres no indication of failure from github
For example, for this PR the CI action ran but failed on "startup failure" (https://github.com/apache/iceberg-python/actions/runs/23358400193). But github pr is all green.
This can potentially impact many repos, https://grep.app/search?f.repo.pattern=apache%2F&q=astral-sh%2Fsetup-uv%40v
kevinjqliu commentedon Mar 20, 2026
We can (and should) definitely fix forward, but the fact that the CI is just skipped by Github is scary
dfoulks1 commentedon Mar 20, 2026
Yes, a security issue in a verified action was discovered earlier today, verified actions were disabled roughly 5 hours ago.
kevinjqliu commentedon Mar 20, 2026
Thanks @dfoulks1 is there a list of changes i can reference?
Also, could you help me understand why
astral-sh/setup-uv@v7was working prior to today? I see the allowlist only contains entries forsetup-uvwith commit hashes.https://github.com/apache/infrastructure-actions/blame/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L7-L9
kevinjqliu commentedon Mar 20, 2026
btw heres my findings about the github behavior.
Our CI workflow failed with "startup failture", due to
astral-sh/setup-uvbeing blocked.The PR UI has no indication of workflow failure; it doesn't show the CI workflow either (which was how I stumble on this issue)
In the PR's "Checks" tab, I see a fixture of green and black:
The "black" status does not get reported as failure; it is silently ignored.
kevinjqliu commentedon Mar 20, 2026
List of affeted repos
ci: pin third-party actions to Apache-approved SHAs (#2266)
ci: pin third-party actions to Apache-approved SHAs (apache#2266)
ci: pin third-party actions to Apache-approved SHAs (apache#2266)
Rebase fork onto upstream/main (datafusion 53.1, arrow 58) (#13)
Sync upstream: apache/iceberg-rust 7ef4063 -> 6077a42 (#26)