adoroszlai opened a new pull request, #68: URL: https://github.com/apache/ozone-docker-testkrb5/pull/68
## What changes were proposed in this pull request? > The [GitHub Actions Policy](github-actions-policy.html) requires a specific git hash only for **external** actions; actions in the `apache/*`, `github/*` and `actions/*` namespaces may be used without that restriction. Pinning those to a major version tag rather than to a hash lets a patch or minor release arrive without a pull request, which removes a large share of the Dependabot traffic a project sees. External actions still **MUST** be pinned to a specific git hash. ([source](https://infra.apache.org/services.html#gha-mitigations)) - This PR updates workflows to pin `actions/*` and `apache/*` by major version instead of SHA, as recommended by Apache Infra above. `github/*` actions are not used here. - Configure zizmor to allow such pinning. - Make sure zizmor workflow is triggered by changes in zizmor config. https://issues.apache.org/jira/browse/HDDS-16816 ## How was this patch tested? CI: https://github.com/adoroszlai/ozone-docker-testkrb5/actions/runs/38909318546 zizmor: https://github.com/adoroszlai/ozone-docker-testkrb5/actions/runs/38909318496 asf-allowlist-check: https://github.com/adoroszlai/ozone-docker-testkrb5/actions/runs/38909318393 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
