This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 9ad206a01de Pin apache/infrastructure-actions to its released tags
(#70623)
9ad206a01de is described below
commit 9ad206a01def2dc6fffe9a7d237c643d66645078
Author: Jarek Potiuk <[email protected]>
AuthorDate: Wed Aug 19 13:53:10 2026 +0200
Pin apache/infrastructure-actions to its released tags (#70623)
* Pin apache/infrastructure-actions to its released tags
Until now these pins named commits with no version behind them, and the
allowlist-check one tracked whatever main happened to be. The upstream
repository has since started tagging each action under its own prefix, so
the pins can name a real release and Dependabot can offer bumps for them
the way it already does for every other action.
* Stop suppressing ref-version-mismatch for the allowlist check
The suppression existed because that pin carried a "# main" comment, which
can never match the commit it names. Now that it names a released tag,
zizmor resolves the comment to exactly the pinned commit and reports
nothing, so the workflow can be checked like every other one.
---
.github/actions/build_ci_image_with_cache/action.yml | 15 +++++++++------
.github/actions/install-prek/action.yml | 5 +++--
.github/actions/prepare_breeze_and_image/action.yml | 3 ++-
.github/actions/prepare_single_ci_image/action.yml | 3 ++-
.github/workflows/asf-allowlist-check.yml | 3 ++-
.github/workflows/basic-tests.yml | 10 ++++++----
.github/workflows/ci-image-build.yml | 20 ++++++++++++--------
.github/workflows/ci-image-checks.yml | 5 +++--
.github/workflows/prod-image-build.yml | 2 +-
.github/workflows/publish-docs-to-s3.yml | 5 +++--
.github/zizmor.yml | 6 ------
11 files changed, 43 insertions(+), 34 deletions(-)
diff --git a/.github/actions/build_ci_image_with_cache/action.yml
b/.github/actions/build_ci_image_with_cache/action.yml
index 3309891832d..b7a6d0bbce4 100644
--- a/.github/actions/build_ci_image_with_cache/action.yml
+++ b/.github/actions/build_ci_image_with_cache/action.yml
@@ -48,7 +48,8 @@ runs:
# cache. The commit it was built from tells the two apart and is stashed
on its own, so
# deciding costs a few bytes rather than the image the decision may make
unnecessary.
- name: "Restore the commit the stashed CI image was built from"
- uses:
apache/infrastructure-actions/stash/restore@0ff9972b5872e19c9f4555c9159c2fea4f794355
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: "ci-image-commit-v3-${{ inputs.platform }}-${{ inputs.python }}\
-${{ inputs.image-stash-ref }}"
@@ -73,7 +74,8 @@ runs:
if: steps.restore-commit.outputs.stash-hit == 'true'
# Restored ahead of the caches that feed the build, so a build made
unnecessary skips them too.
- name: "Restore the CI image stashed for this ref"
- uses:
apache/infrastructure-actions/stash/restore@0ff9972b5872e19c9f4555c9159c2fea4f794355
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: "ci-image-save-v3-${{ inputs.platform }}-${{ inputs.python }}\
-${{ inputs.image-stash-ref }}"
@@ -108,7 +110,8 @@ runs:
# Scoped to the ref for the same reason the image is: the mount cache
holds the dependency set
# the sources resolve to, and a ref's and the branch tip's are exactly
what differ.
- name: "Restore the mount cache stashed for this ref"
- uses:
apache/infrastructure-actions/stash/restore@0ff9972b5872e19c9f4555c9159c2fea4f794355
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{ inputs.python
}}\
-${{ inputs.image-stash-ref }}"
@@ -182,7 +185,7 @@ runs:
git rev-parse HEAD > "${COMMIT_FILE}"
if: steps.stashed-image.outputs.reusable != 'true'
- name: "Stash the CI image"
- uses:
apache/infrastructure-actions/stash/save@0ff9972b5872e19c9f4555c9159c2fea4f794355
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
key: "ci-image-save-v3-${{ inputs.platform }}-${{ inputs.python }}\
-${{ inputs.image-stash-ref }}"
@@ -194,7 +197,7 @@ runs:
# Saved last and with the image's retention, so that finding this commit
is enough to know the
# image it describes is there to be restored.
- name: "Stash the commit the CI image was built from"
- uses:
apache/infrastructure-actions/stash/save@0ff9972b5872e19c9f4555c9159c2fea4f794355
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
key: "ci-image-commit-v3-${{ inputs.platform }}-${{ inputs.python }}\
-${{ inputs.image-stash-ref }}"
@@ -211,7 +214,7 @@ runs:
--cache-file
/tmp/ci-cache-mount-save-v3-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz
if: steps.stashed-image.outputs.reusable != 'true'
- name: "Stash the mount cache"
- uses:
apache/infrastructure-actions/stash/save@0ff9972b5872e19c9f4555c9159c2fea4f794355
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{ inputs.python
}}\
-${{ inputs.image-stash-ref }}"
diff --git a/.github/actions/install-prek/action.yml
b/.github/actions/install-prek/action.yml
index ad592947586..6db0308c8b9 100644
--- a/.github/actions/install-prek/action.yml
+++ b/.github/actions/install-prek/action.yml
@@ -70,7 +70,8 @@ runs:
echo
shell: bash
- name: "Restore prek cache"
- uses:
apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
# yamllint disable rule:line-length
key: cache-prek-v9-${{ inputs.platform }}-python${{
inputs.python-version }}-uv${{ steps.versions.outputs.uv-version }}-${{
hashFiles('**/.pre-commit-config.yaml') }}
@@ -119,7 +120,7 @@ runs:
shell: bash
if: inputs.save-cache == 'true'
- name: "Save prek cache"
- uses:
apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
# yamllint disable rule:line-length
key: cache-prek-v9-${{ inputs.platform }}-python${{
inputs.python-version }}-uv${{ steps.versions.outputs.uv-version }}-${{
hashFiles('**/.pre-commit-config.yaml') }}
diff --git a/.github/actions/prepare_breeze_and_image/action.yml
b/.github/actions/prepare_breeze_and_image/action.yml
index ce116477567..09f2a2e189b 100644
--- a/.github/actions/prepare_breeze_and_image/action.yml
+++ b/.github/actions/prepare_breeze_and_image/action.yml
@@ -65,7 +65,8 @@ runs:
- name: >
Restore ${{ inputs.image-type }} docker image ${{ inputs.platform
}}:${{ inputs.python }}
${{ inputs.image-stash-ref != '' && format('built for ref {0}',
inputs.image-stash-ref) || '' }}
- uses:
apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: "${{ inputs.image-type }}-image-save-v3-${{ inputs.platform
}}-${{ inputs.python }}\
${{ inputs.image-stash-ref != '' && format('-{0}',
inputs.image-stash-ref) || '' }}"
diff --git a/.github/actions/prepare_single_ci_image/action.yml
b/.github/actions/prepare_single_ci_image/action.yml
index 3608901015d..d70012c80f7 100644
--- a/.github/actions/prepare_single_ci_image/action.yml
+++ b/.github/actions/prepare_single_ci_image/action.yml
@@ -36,7 +36,8 @@ runs:
using: "composite"
steps:
- name: "Restore CI docker images ${{ inputs.platform }}:${{ inputs.python
}}"
- uses:
apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: ci-image-save-v3-${{ inputs.platform }}-${{ inputs.python }}
path: "/mnt/"
diff --git a/.github/workflows/asf-allowlist-check.yml
b/.github/workflows/asf-allowlist-check.yml
index 81a028a9a65..058c5aca453 100644
--- a/.github/workflows/asf-allowlist-check.yml
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -31,4 +31,5 @@ jobs:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
persist-credentials: false
- - uses:
apache/infrastructure-actions/allowlist-check@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
# main
+ # yamllint disable-line rule:line-length
+ - uses:
apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# allowlist-check/v1.0.0
diff --git a/.github/workflows/basic-tests.yml
b/.github/workflows/basic-tests.yml
index 221e5207ebc..211d77e48c8 100644
--- a/.github/workflows/basic-tests.yml
+++ b/.github/workflows/basic-tests.yml
@@ -203,7 +203,8 @@ jobs:
cache: 'pnpm'
cache-dependency-path: 'airflow-core/src/airflow/**/pnpm-lock.yaml'
- name: "Restore eslint cache (ui)"
- uses:
apache/infrastructure-actions/stash/restore@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
path: airflow-core/src/airflow/ui/node_modules/
# yamllint disable-line rule:line-length
@@ -214,7 +215,7 @@ jobs:
env:
FORCE_COLOR: 2
- name: "Save eslint cache (ui)"
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
path: airflow-core/src/airflow/ui/node_modules/
key: cache-ui-node-modules-v1-${{ runner.os }}-${{
hashFiles('airflow/ui/**/pnpm-lock.yaml') }}
@@ -222,7 +223,8 @@ jobs:
retention-days: '2'
if: steps.restore-eslint-cache-ui.outputs.stash-hit != 'true'
- name: "Restore eslint cache (simple auth manager UI)"
- uses:
apache/infrastructure-actions/stash/restore@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
path:
airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui/node_modules/
key: >
@@ -234,7 +236,7 @@ jobs:
env:
FORCE_COLOR: 2
- name: "Save eslint cache (ui)"
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
path:
airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui/node_modules/
key: >
diff --git a/.github/workflows/ci-image-build.yml
b/.github/workflows/ci-image-build.yml
index 4efee890095..7817fd211c3 100644
--- a/.github/workflows/ci-image-build.yml
+++ b/.github/workflows/ci-image-build.yml
@@ -167,7 +167,8 @@ jobs:
- name: >
Restore the commit the CI image stashed for ref ${{
inputs.image-stash-ref }}
was built from
- uses:
apache/infrastructure-actions/stash/restore@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: "ci-image-commit-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}\
-${{ inputs.image-stash-ref }}"
@@ -200,7 +201,8 @@ jobs:
- name: >
Restore CI docker image built for ref ${{ inputs.image-stash-ref }}
${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}
- uses:
apache/infrastructure-actions/stash/restore@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: "ci-image-save-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}\
-${{ inputs.image-stash-ref }}"
@@ -215,7 +217,8 @@ jobs:
- name: >
Restore ci-cache mount image ${{ inputs.platform }}:${{
env.PYTHON_MAJOR_MINOR_VERSION }}
${{ inputs.image-stash-ref != '' && format('for ref {0}',
inputs.image-stash-ref) || '' }}
- uses:
apache/infrastructure-actions/stash/restore@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}\
${{ inputs.image-stash-ref != '' && format('-{0}',
inputs.image-stash-ref) || '' }}"
@@ -242,7 +245,8 @@ jobs:
--cache-file
/tmp/ci-cache-mount-save-v3-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz
if: steps.restore-cache-mount.outputs.stash-hit == 'true'
- name: "Restore CI docker image ${{ inputs.platform }}:${{
env.PYTHON_MAJOR_MINOR_VERSION }}"
- uses:
apache/infrastructure-actions/stash/restore@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
key: "ci-image-save-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}"
path: "/mnt/"
@@ -327,7 +331,7 @@ jobs:
shell: bash
if: inputs.upload-image-artifact == 'true' &&
steps.stashed-image.outputs.reusable != 'true'
- name: "Stash CI docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
key: ci-image-save-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}
path: "/mnt/ci-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION
}}.tar"
@@ -340,7 +344,7 @@ jobs:
# what a later publish of that same ref reads - hence a retention that
outlives the shared
# one, the same ref being rebuilt three days apart at the very least.
- name: "Stash CI docker image built for ref ${{ inputs.image-stash-ref
}}"
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
key: "ci-image-save-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}\
-${{ inputs.image-stash-ref }}"
@@ -353,7 +357,7 @@ jobs:
# Saved last and with the image's retention, so that finding this commit
is enough to
# know the image it describes is there to be restored.
- name: "Stash the commit the CI image for ref ${{
inputs.image-stash-ref }} was built from"
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
key: "ci-image-commit-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}\
-${{ inputs.image-stash-ref }}"
@@ -375,7 +379,7 @@ jobs:
- name: >
Stash cache mount ${{ inputs.platform }}:${{
env.PYTHON_MAJOR_MINOR_VERSION }}
${{ inputs.image-stash-ref != '' && format('for ref {0}',
inputs.image-stash-ref) || '' }}
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}\
${{ inputs.image-stash-ref != '' && format('-{0}',
inputs.image-stash-ref) || '' }}"
diff --git a/.github/workflows/ci-image-checks.yml
b/.github/workflows/ci-image-checks.yml
index 08143d4e82e..1caa2386ec5 100644
--- a/.github/workflows/ci-image-checks.yml
+++ b/.github/workflows/ci-image-checks.yml
@@ -206,7 +206,8 @@ jobs:
use-uv: ${{ inputs.use-uv }}
make-mnt-writeable-and-cleanup: true
- name: "Restore docs inventory cache"
- uses:
apache/infrastructure-actions/stash/restore@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
path: ./generated/_inventory_cache/
key: cache-docs-inventory-v1
@@ -322,7 +323,7 @@ jobs:
env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
- name: "Save docs inventory cache"
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
path: ./generated/_inventory_cache/
key: cache-docs-inventory-v1
diff --git a/.github/workflows/prod-image-build.yml
b/.github/workflows/prod-image-build.yml
index 250cd3e26c4..d4620181bc0 100644
--- a/.github/workflows/prod-image-build.yml
+++ b/.github/workflows/prod-image-build.yml
@@ -284,7 +284,7 @@ jobs:
breeze prod-image save --platform "${PLATFORM}" --image-file-dir
"/mnt"
if: inputs.upload-image-artifact == 'true'
- name: "Stash PROD docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}"
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
with:
key: prod-image-save-v3-${{ inputs.platform }}-${{
env.PYTHON_MAJOR_MINOR_VERSION }}
path: "/mnt/prod-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION
}}.tar"
diff --git a/.github/workflows/publish-docs-to-s3.yml
b/.github/workflows/publish-docs-to-s3.yml
index 61705a6320e..b5d009d47d3 100644
--- a/.github/workflows/publish-docs-to-s3.yml
+++ b/.github/workflows/publish-docs-to-s3.yml
@@ -344,7 +344,8 @@ jobs:
${{ secrets.CONSTRAINTS_GITHUB_REPOSITORY != '' &&
secrets.CONSTRAINTS_GITHUB_REPOSITORY || 'apache/airflow' }}
- name: "Restore docs inventory cache"
- uses:
apache/infrastructure-actions/stash/restore@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ # yamllint disable-line rule:line-length
+ uses:
apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# restore/v1.0.0
with:
path: ./generated/_inventory_cache/
key: cache-docs-inventory-v1
@@ -375,7 +376,7 @@ jobs:
breeze build-docs ${SPHINX_INCLUDE_DOCS} --docs-only
${FAIL_ON_INVENTORIES}
fi
- name: "Save docs inventory cache"
- uses:
apache/infrastructure-actions/stash/save@e0a5f64438492ea3ee6cbe06336b2d8e25f5d222
+ uses:
apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0
# save/v1.0.0
if: >-
steps.restore-docs-inventory-cache.outputs.stash-hit != 'true' &&
steps.build-sphinx-docs.outputs.sphinx-build-skipped != 'true'
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index da6ed9b6d88..ef9fbc6d507 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -19,9 +19,3 @@
rules:
secrets-outside-env:
disable: true
- # apache/infrastructure-actions is branch-tracked (no version tags); we pin
it
- # by commit SHA with a "# main" comment on purpose, so zizmor's expectation
of a
- # version-matching comment does not apply to that pin.
- ref-version-mismatch:
- ignore:
- - asf-allowlist-check.yml
