ajfabbri commented on PR #8530: URL: https://github.com/apache/hadoop/pull/8530#issuecomment-5073447988
Thanks for the review! > before committing, switch the uses declarations to use the checksum with a version the comment for dependabot, as that's the only way to lock down workflows For first-party `uses:` workflows, there is an assumption that they are using immutable releases (i.e. tags that cannot be moved). Also [ASF policy](https://infra.apache.org/github-actions-policy.html) only requires SHA version pins for third-party actions. There is no harm in adding git hashes here though, so I'll do that. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
