ci: revert pypa/gh-action-pypi-publish to v1.13.0#337
Merged
Conversation
The v1.14.0 SHA (cef221092ed1bacb1cc03d23a2d87d1d172e277b) is not yet in the Apache GitHub organization's allowed actions list, causing the Release Python Binding workflow to fail. Revert to v1.13.0 (ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e) which is already approved. This reverts part of the changes from apache#297. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pypa/gh-action-pypi-publishfrom v1.14.0 (cef221092ed1bacb1cc03d23a2d87d1d172e277b) to v1.13.0 (ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e)The action pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b is not allowedMotivation
The Apache GitHub organization enforces an allowlist for third-party GitHub Actions. The v1.14.0 commit SHA is not yet approved, blocking all Python package releases. Reverting to the previously approved v1.13.0 restores the release pipeline.
We can upgrade again once the Apache INFRA team adds the new SHA to the allowlist.