This is an automated email from the ASF dual-hosted git repository.
diqiu50 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new 5d150b1853 [MINOR] fix(ci): Pin pnpm/action-setup to an
ASF-allowlisted SHA (#12899)
5d150b1853 is described below
commit 5d150b1853ee257608cacc1bb1e61df972d78377
Author: Yuhui <[email protected]>
AuthorDate: Fri Sep 4 11:09:41 2026 +0800
[MINOR] fix(ci): Pin pnpm/action-setup to an ASF-allowlisted SHA (#12899)
### What changes were proposed in this pull request?
Pin `pnpm/action-setup` in `web-ui-tests.yml` to the ASF-allowlisted
commit SHA for `v6.0.10`, instead of the moving `v4` tag.
### Why are the changes needed?
`apache/infrastructure-actions` tightened its allowlist for
`pnpm/action-setup` from a wildcard (`'*': keep: true`) to a single
pinned SHA (`0977fd99725f1db4007ccb2928dbb4e90d06cc86`, tag `v6.0.10`):
https://github.com/apache/infrastructure-actions/commit/db9062086b9700ef67cbfa5c2eb2e2a67d4a1c9.
As a result, `asf-allowlist-check` now fails on every workflow run that
still references `pnpm/action-setup@v4`. `v6.0.10`'s `action.yml` keeps
the same `version` input used here, so this is a drop-in replacement.
### Does this PR introduce any user-facing change?
No.
### How was this patch tested?
N/A — CI-only change.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01SpCQ2tawE67Ur1X4nyKsV1
Co-authored-by: Claude Sonnet 5 <[email protected]>
---
.github/workflows/web-ui-tests.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/web-ui-tests.yml
b/.github/workflows/web-ui-tests.yml
index 8dcc5d118c..f2324d48b2 100644
--- a/.github/workflows/web-ui-tests.yml
+++ b/.github/workflows/web-ui-tests.yml
@@ -21,7 +21,7 @@ jobs:
uses: actions/checkout@v4
- name: Setup pnpm
- uses: pnpm/action-setup@v4
+ uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 #
v6.0.10
with:
version: 9
