[aglinxinyuan]

What changes were proposed in this PR?

CI has been red since 2026-10-19 on main and on every PR that runs a Scala stack (amber, amber-integration, Bench). The jobs die in under 40s at Set up job, before checkout, so they produce no test output.

As in #7710, the cause is the ASF actions allowlist, not anything in this repository. sbt/setup-sbt reaches nested carabiner-dev actions that are no longer permitted:

.github/workflows/*.yml
  └─ sbt/setup-sbt@8feba82                                        v1.5.7   allowed
       └─ carabiner-dev/actions/ampel/verify@36a39ef              v1.2.6   allowed
            └─ carabiner-dev/actions/install/ampel@2fec8bd8                BLOCKED
                 └─ install/download-and-verify@16009dca                   BLOCKED
                      └─ install/ampel-bootstrap@619a474                   BLOCKED

The action carabiner-dev/actions@619a474 is not allowed in apache/texera because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns: …

Nothing in the tree changed. apache/infrastructure-actions commit 7a8ef18970 ("Remove Expired Refs", 2026-10-19T02:35Z) dropped the transitive ampel-bootstrap refs that carabiner's older internal refs use. Last clean run: main @ a46ddc6e at 2026-10-19T00:53Z. First failures: #9028 / #9029 at 07:07Z, and main @ 22b82a29 at 23:39Z.

This bumps all 9 call sites from v1.5.7 to v1.5.12, which resolves down a fully allowed path:

	v1.5.7 (current)	v1.5.12 (this PR)
ampel/verify	36a39ef (v1.2.6)	32587e8
install/ampel	2fec8bd8 — blocked	d6d91c5
install/download-and-verify	16009dca — blocked	2fec8bd8
install/ampel-bootstrap	619a474 — blocked	16009dca

Every link on the v1.5.12 side is in the current approved_patterns.yml, and actions.yml gives v1.5.12 no expiry date (v1.5.7's own entry expires 2026-11-17). The action's inputs (sbt-runner-version, disk-cache) are the same in both versions, so no call site needs editing beyond the pin.

Call sites: benchmarks.yml (1), build-and-push-images.yml (3), build.yml (4), dependency-graph.yml (1).

release/v1.2 and release/v1.3 pin the same v1.5.7, so this carries their backport labels. release/v1.1 pins setup-sbt@508b753, which is not on the allowlist either; it needs its own bump if that branch still runs CI.

Any related issues, documentation, discussions?

No issue filed — the regression originates outside the repository and this PR is the unblock. The previous bump of this pin was #7710.

How was this PR tested?

By this PR's CI, which is the only place the failure reproduces — it depends on the apache/texera actions policy and cannot be triggered locally or on a fork.

The change touches .github/**, so the labeler applies ci, which runs every stack in LABEL_STACKS plus Bench. Every job that uses sbt/setup-sbt is exercised here.

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Claude Opus 5.5)

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

• No candidates found from git blame history.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.30%. Comparing base (b0769b4) to head (03d8dd2).

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #9064      +/-   ##
============================================
- Coverage     92.33%   92.30%   -0.03%     
+ Complexity     5046     5045       -1     
============================================
  Files          1261     1260       -1     
  Lines         54112    53879     -233     
  Branches       6767     6713      -54     
============================================
- Hits          49964    49733     -231     
  Misses         2486     2486              
+ Partials       1662     1660       -2     

Flag	Coverage Δ		*Carryforward flag
access-control-service	77.38% <0.00%> (ø)		Carriedforward from 91f4753
agent-service	99.16% <0.00%> (ø)
amber	87.31% <0.00%> (-0.01%)	⬇️	Carriedforward from 91f4753
computing-unit-managing-service	60.48% <0.00%> (ø)		Carriedforward from 91f4753
config-service	87.37% <0.00%> (ø)		Carriedforward from 91f4753
file-service	82.00% <0.00%> (ø)		Carriedforward from 91f4753
frontend	96.54% <0.00%> (-0.01%)	⬇️	Carriedforward from 91f4753
notebook-migration-service	83.73% <0.00%> (ø)		Carriedforward from 91f4753
pyamber	98.54% <0.00%> (-0.04%)	⬇️	Carriedforward from 91f4753
workflow-compiling-service	72.43% <0.00%> (ø)		Carriedforward from 91f4753

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚠️ Benchmark changes need a look

🟢 0 better · 🔴 10 worse · ⚪ 5 noise (<±5%) · 0 without baseline

Compared against main b0769b4 benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	384	0.235	24,946/34,465/34,465 us	🔴 +13.8% / 🔴 +144.1%
🔴	bs=100 sw=10 sl=64	819	0.5	119,494/140,989/140,989 us	🔴 +7.6% / 🔴 +52.5%
🔴	bs=1000 sw=10 sl=64	951	0.581	1,047,110/1,175,615/1,175,615 us	🔴 +5.7% / 🔴 +38.7%

Baseline details

Latest main b0769b4 from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	384 tuples/sec	435 tuples/sec	968.33 tuples/sec	-11.7%	-60.3%
bs=10 sw=10 sl=64	MB/s	0.235 MB/s	0.266 MB/s	0.591 MB/s	-11.7%	-60.2%
bs=10 sw=10 sl=64	p50	24,946 us	21,924 us	10,646 us	+13.8%	+134.3%
bs=10 sw=10 sl=64	p95	34,465 us	35,163 us	14,120 us	-2.0%	+144.1%
bs=10 sw=10 sl=64	p99	34,465 us	35,163 us	16,498 us	-2.0%	+108.9%
bs=100 sw=10 sl=64	throughput	819 tuples/sec	875 tuples/sec	1,252 tuples/sec	-6.4%	-34.6%
bs=100 sw=10 sl=64	MB/s	0.5 MB/s	0.534 MB/s	0.764 MB/s	-6.4%	-34.6%
bs=100 sw=10 sl=64	p50	119,494 us	111,549 us	83,736 us	+7.1%	+42.7%
bs=100 sw=10 sl=64	p95	140,989 us	130,981 us	92,464 us	+7.6%	+52.5%
bs=100 sw=10 sl=64	p99	140,989 us	130,981 us	108,561 us	+7.6%	+29.9%
bs=1000 sw=10 sl=64	throughput	951 tuples/sec	963 tuples/sec	1,321 tuples/sec	-1.2%	-28.0%
bs=1000 sw=10 sl=64	MB/s	0.581 MB/s	0.588 MB/s	0.806 MB/s	-1.2%	-27.9%
bs=1000 sw=10 sl=64	p50	1,047,110 us	1,034,920 us	811,260 us	+1.2%	+29.1%
bs=1000 sw=10 sl=64	p95	1,175,615 us	1,112,660 us	847,636 us	+5.7%	+38.7%
bs=1000 sw=10 sl=64	p99	1,175,615 us	1,112,660 us	879,277 us	+5.7%	+33.7%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,520.52,200,128000,384,0.235,24946.29,34464.51,34464.51
1,100,10,64,20,2441.89,2000,1280000,819,0.500,119493.68,140988.68,140988.68
2,1000,10,64,20,21026.36,20000,12800000,951,0.581,1047110.43,1175614.91,1175614.91

[aglinxinyuan]

Combined with #9096 into #9100 — this bump alone keeps timing out in the merge queue, and #9096 can't pass its Scala checks without it. #9100 is this PR's commit plus Ian's one-line .asf.yaml change, nothing else.

[parshimers]

Well, that's progress of a kind, I think? Seems that it was ejected but for actual reasons, and not just a timeout. @aglinxinyuan I think that we need to combine your two fixes (this and #9091)
Would you prefer I do it or would you like to?

[parshimers]

Actually nevermind, I think I can just merge main into #9100 and submit that. Let's see!

[aglinxinyuan]

Replaced by #9100