jamesfredley commented on PR #25: URL: https://github.com/apache/grails-gradle-publish/pull/25#issuecomment-4305249604
## Added: SHA-pin all GitHub Actions per ASF policy ([f2a9cf5](https://github.com/apache/grails-gradle-publish/commit/f2a9cf5)) Per the [ASF GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) and [apache/infrastructure-actions](https://github.com/apache/infrastructure-actions): *"Always pin actions to exact commit SHAs, never use tags or branch references."* SHAs sourced from `apache/infrastructure-actions/actions.yml` where explicit entries exist; otherwise resolved from the action's own tag. ### Changes (4 workflow files, 26 replacements) | Action | Was | Now (SHA) | Version | Source | |---|---|---|---|---| | `gradle/actions/setup-gradle` | `@v4` / `@v5` | `50e97c2cd7a37755bbfafc9c5b7cafaece252f6e` | v6.1.0 | `actions.yml` (no expiry) | | `actions/checkout` | `@v4` | `34e114876b0b11c390a56381ad16ebd13914f8d5` | v4.3.1 | tag ref | | `actions/checkout` | `@v5` | `93cb6efe18208431cddfb8368fd83d5badbf9bfd` | v5.0.1 | tag ref | | `actions/setup-java` | `@v4` | `c1e323688fd81a25caa38c78aa6df2d33d3e20d9` | v4.8.0 | tag ref | | `actions/setup-java` | `@v5` | `be666c2fcd27ec809703dec50e508c2fdc7f6654` | v5.2.0 | tag ref | | `actions/upload-artifact` | `@v4` | `ea165f8d65b6e75b540449e92b4886f43607fa02` | v4.6.2 | tag ref | | `softprops/action-gh-release` | `@v2` | `3bb12739c298aeb8a4eeaf626c5b8d85266b0e65` | v2.6.2 | tag ref | | `release-drafter/release-drafter` | `@v6` | `6a93d829887aa2e0748befe2e808c66c0ec6e4c7` | v6.4.0 | tag ref | Every pin also leaves the version as a trailing `# vX.Y.Z` comment so reviewers and future readers can see at a glance what each SHA resolves to. ### Intentionally left on `@asf` branch - `apache/grails-github-actions/pre-release@asf` - `apache/grails-github-actions/deploy-github-pages@asf` - `apache/grails-github-actions/post-release@asf` These live in the auto-allowed `apache/*` namespace, are maintained by the ASF, and every other ASF release workflow consumes them via the `@asf` branch. Pinning them to a SHA here would freeze ASF release-tooling improvements from flowing into this project without a coordinated bump. ### Side benefit `gradle/actions/setup-gradle@v4` (used by `ci.yaml` and `rat.yaml`) was going to break very soon anyway: the approved v4.4.2 SHA in `actions.yml` expires **2026-04-24** (tomorrow). Upgrading straight to v6.1.0 (no expiry) avoids back-to-back churn. The only `with:` arg used across our workflows is `develocity-access-key`, which is unchanged across v4 -> v5 -> v6. ### Verification - `python3 -c "import yaml; yaml.safe_load(open(...))"` - all 5 workflow files still parse. - CRLF line endings preserved (ASF standard for these YAMLs). - CI will re-run on push; will flag any runtime issue with the v6.1.0 pin. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
