From b6b5460c29da9393720079a25a6839fc63ca3ea3 Mon Sep 17 00:00:00 2001 From: Harish Bajaj <148284740+sn-harishbajaj@users.noreply.github.com> Date: Tue, 29 Jul 2025 13:03:04 -0700 Subject: [PATCH 1/5] ci: remove daily scheduled snapshot builds and keep manual trigger only --- .github/workflows/snapshot.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml index 5dff054..be40750 100644 --- a/.github/workflows/snapshot.yml +++ b/.github/workflows/snapshot.yml @@ -16,8 +16,6 @@ name: "Publish SNAPSHOTs" on: - schedule: - - cron: '0 0 * * *' # Deploy every day workflow_dispatch: env: From 3c4b3ad278aaf91c9be2a1b15229fcd45f1410b2 Mon Sep 17 00:00:00 2001 From: Harish Bajaj <148284740+sn-harishbajaj@users.noreply.github.com> Date: Mon, 23 Mar 2026 12:03:24 -0700 Subject: [PATCH 2/5] fix(ci): update IMAGE_REPO to use dynamic repository name --- .github/workflows/docker_push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker_push.yml b/.github/workflows/docker_push.yml index a005097..48e890c 100644 --- a/.github/workflows/docker_push.yml +++ b/.github/workflows/docker_push.yml @@ -31,7 +31,7 @@ on: env: REGISTRY: ghcr.io OWNER: ${{ github.repository_owner }} - IMAGE_REPO: flink-docker + IMAGE_REPO: ${{ github.event.repository.name }} jobs: build_and_push: From ab81c16564851d283700fcbffd7e820de0353956 Mon Sep 17 00:00:00 2001 From: Harish Bajaj <148284740+sn-harishbajaj@users.noreply.github.com> Date: Mon, 24 Mar 2025 03:43:26 -0700 Subject: [PATCH 3/5] Update GitHub Actions workflow to change repository owner for snapshot job --- .github/workflows/snapshot.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml index be40750..0a62011 100644 --- a/.github/workflows/snapshot.yml +++ b/.github/workflows/snapshot.yml @@ -20,13 +20,13 @@ on: env: REGISTRY: ghcr.io - OWNER: apache - IMAGE_REPO: flink-docker + OWNER: sn-harishbajaj + IMAGE_REPO: apache.flink-docker jobs: snapshot: # Do not run for forks. - if: github.repository_owner == 'apache' + if: github.repository_owner == 'sn-harishbajaj' runs-on: ubuntu-latest permissions: contents: read From 21fd0c29ba3113bd3cdd87f37cdd6cb43b6ee447 Mon Sep 17 00:00:00 2001 From: Harish Bajaj <148284740+sn-harishbajaj@users.noreply.github.com> Date: Mon, 23 Mar 2026 13:10:09 -0700 Subject: [PATCH 4/5] ci: update docker/bake-action to version 5 in snapshot workflow --- .github/workflows/snapshot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml index 0a62011..68b53ce 100644 --- a/.github/workflows/snapshot.yml +++ b/.github/workflows/snapshot.yml @@ -75,7 +75,7 @@ jobs: run: env - name: "Build and push Docker images (supported platforms)" - uses: docker/bake-action@v4 + uses: docker/bake-action@v5 with: files: | .github/workflows/docker-bake.hcl From 709220b4cd5bb3061c503415645bdaed01871aba Mon Sep 17 00:00:00 2001 From: Sean Campbell Date: Tue, 7 Jul 2026 13:40:47 -0700 Subject: [PATCH 5/5] STRY64301574: Update log4j to fix CVE-2025-68161 --- 1.20/scala_2.12-java11-ubuntu/Dockerfile | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/1.20/scala_2.12-java11-ubuntu/Dockerfile b/1.20/scala_2.12-java11-ubuntu/Dockerfile index c34f456..caf9d7d 100644 --- a/1.20/scala_2.12-java11-ubuntu/Dockerfile +++ b/1.20/scala_2.12-java11-ubuntu/Dockerfile @@ -96,6 +96,17 @@ RUN set -ex; \ sed -i '/taskmanager.host: localhost/d' "$CONF_FILE"; \ fi; +# Update log4j to fix CVE-2025-68161 +RUN set -ex; \ + LOG4J_VERSION=2.25.4; \ + find "$FLINK_HOME/lib" -name "log4j-*.jar" -delete; \ + wget -nv -P "$FLINK_HOME/lib" \ + "https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-api/${LOG4J_VERSION}/log4j-api-${LOG4J_VERSION}.jar" \ + "https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/${LOG4J_VERSION}/log4j-core-${LOG4J_VERSION}.jar" \ + "https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-1.2-api/${LOG4J_VERSION}/log4j-1.2-api-${LOG4J_VERSION}.jar" \ + "https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-slf4j-impl/${LOG4J_VERSION}/log4j-slf4j-impl-${LOG4J_VERSION}.jar"; \ + chown flink:flink "$FLINK_HOME/lib"/log4j-*.jar + # Configure container COPY docker-entrypoint.sh / ENTRYPOINT ["/docker-entrypoint.sh"]