Copilot commented on code in PR #12824:
URL: https://github.com/apache/gluten/pull/12824#discussion_r3813347214
##########
.github/workflows/docker_image.yml:
##########
@@ -42,10 +42,10 @@ jobs:
uses: actions/checkout@v7
- name: Set up Docker Buildx
- uses:
docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+ uses:
docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
Review Comment:
For long-term maintainability/auditability, consider annotating pinned
action SHAs with the corresponding release tag (e.g., `# vX.Y.Z`). This makes
it easier to review future security/compliance scans and understand what
behavior changed without having to look up each commit.
##########
.github/workflows/docker_image.yml:
##########
@@ -158,16 +158,16 @@ jobs:
- name: Docker meta
id: meta
- uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
+ uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9
Review Comment:
For long-term maintainability/auditability, consider annotating pinned
action SHAs with the corresponding release tag (e.g., `# vX.Y.Z`). This makes
it easier to review future security/compliance scans and understand what
behavior changed without having to look up each commit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
