CI: every job that sets up sbt fails at "Setup sbt launcher" since 2026-11-05, so Required Checks is red on main and on every PR #9345

What happened?

Since 2026-11-05 15:36 UTC every workflow run that calls sbt/setup-sbt dies in the action's "Verify the sbt distribution signature" step, before sbt is installed and before any Texera code is compiled. That is the amber, amber-integration, platform (×6), platform-integration (×6) and Bench jobs, so Required Checks is red on main itself and on every open PR, and nothing can go through the merge queue. Jobs that do not set up sbt (frontend, Check License Headers, Validate PR title, the backport checks) still pass.

Nothing in this repository changed. main at 312a0cefc (#9325, run at 07:16 UTC) was green; main at 8b0fb168e (#8848, run at 20:54 UTC) is red, and that commit touches three frontend .ts files only.

The failing step is inside sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f (v1.5.12), which is pinned at nine call sites (build.yml ×4, build-and-push-images.yml ×3, benchmarks.yml, dependency-graph.yml). It runs carabiner-dev/actions/ampel/verify@32587e8 (ampel v1.3.6) with the policy argument git+https://github.com/carabiner-dev/policies#signature/signature.json, that is, whatever main of carabiner-dev/policies holds at run time. On 2026-11-05 that file gained a meta.name field that ampel v1.3.6 does not accept, so ampel exits 1 while loading the policy. The step's fail: false only covers a verification verdict, not the loader crashing, so the composite action fails and the job stops.

sbt/setup-sbt fixed this the same day in v1.5.14 (67d461eba2c4753196c230e02da850757ba4775e, sbt/setup-sbt#155) by pinning the policy to a commit that predates the field. The action's inputs and the nested actions it uses (actions/cache@55cc834, ampel/verify@32587e8) are unchanged from v1.5.12; the only other change between the two is the default launcher version, which this repository does not use (project/build.properties sets sbt's version).

How to reproduce?

Re-run any build workflow on main or push to any PR; expand build / platform (config-service) → Setup sbt launcher → Verify the sbt distribution signature → Run key_flags=().

Example runs: main at bb6136d8d and PRs #9040, #9041, #9042 (run 42142992336, job 127647745863).

Version/Branch

1.4.0-incubating-SNAPSHOT (main)

Commit Hash (Optional)

No response

What browsers are you seeing the problem on?

No response

Relevant log output

Setup sbt launcher
  Run sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f
  ...
  Download and Install sbt                                   2s
  Verify the sbt distribution signature                      3s
    Run carabiner-dev/actions/ampel/verify@32587e82f960d49b36101e8c45d1956e511965d3
    Run key_flags=()
      Error: compiling policy: unable to parse a policy, group or policySet from data
      Error: Process completed with exit code 1.