This is an automated email from the ASF dual-hosted git repository. FreeAndNil pushed a commit to branch Feature/security-audit-hardening in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
commit e203b7c7424496595b004e0ae62147bc3f43fde0 Author: Jan Friedrich <[email protected]> AuthorDate: Tue Aug 18 00:02:45 2026 +0200 remove the git-broadcast workflow Its push and pull request triggers had been commented out, leaving it dispatched by hand only, so nothing depends on it. What remained was worth removing rather than pinning: it ran npx git-broadcast@beta in a job that checks out with a token able to push to this repository, using mutable action tags and with no permissions block. The beta dist-tag resolves to 0.45.7 from 2024, older than the 0.50.0 that latest points at, so it was not tracking newer code either; it was simply a pointer that can be moved to any published version. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .github/workflows/git-broadcast.yml | 44 ---------------------- .../3.4.0/309-remove-git-broadcast-workflow.xml | 13 +++++++ 2 files changed, 13 insertions(+), 44 deletions(-) diff --git a/.github/workflows/git-broadcast.yml b/.github/workflows/git-broadcast.yml deleted file mode 100644 index 513b8c11..00000000 --- a/.github/workflows/git-broadcast.yml +++ /dev/null @@ -1,44 +0,0 @@ -# -# Licensed to the Apache Software Foundation (ASF) under one or more -# contributor license agreements. See the NOTICE file distributed with -# this work for additional information regarding copyright ownership. -# The ASF licenses this file to you under the Apache License, Version 2.0 -# (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -name: Broadcast master updates to satellites - -on: - workflow_dispatch: -# Temporarily disabled, uncomment if needed. -# push: -# branches: [ master ] -# pull_request: -# branches: [ master ] - -concurrency: - group: git-broadcast - -jobs: - main: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - uses: actions/setup-node@v2-beta - with: - node-version: '16' - - name: broadcast master changes to satellite branches - env: - RUN_NUMBER: ${{ github.run_number }} - run: | - git config --global user.name "Git Broadcast" - git config --global user.email "[email protected]" - npx git-broadcast@beta --ignore abandoned-develop --from master --push --pretty --suppress-log-prefixes --prefix-logs-with $GITHUB_REPOSITORY diff --git a/src/changelog/3.4.0/309-remove-git-broadcast-workflow.xml b/src/changelog/3.4.0/309-remove-git-broadcast-workflow.xml new file mode 100644 index 00000000..1b7b5265 --- /dev/null +++ b/src/changelog/3.4.0/309-remove-git-broadcast-workflow.xml @@ -0,0 +1,13 @@ +<?xml version="1.0" encoding="UTF-8"?> +<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; + xmlns="https://logging.apache.org/xml/ns"; + xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"; + type="removed"> + <issue id="309" link="https://github.com/apache/logging-log4net/pull/309"/> + <description format="asciidoc"> + remove the `git-broadcast` workflow. Its push and pull request triggers had been commented out, + leaving it dispatched by hand only, while it still ran `npx git-broadcast@beta`, a dist-tag that can + be repointed at any published version, in a job that checks out with a token able to push to this + repository, using mutable action tags and no `permissions` block (CWE-1357) (audit 1231d72-f011) + </description> +</entry>
