jamesfredley opened a new pull request, #15690: URL: https://github.com/apache/grails-core/pull/15690
## What Audit of every GitHub Action used in the repository against the [ASF approved actions allow-list](https://github.com/apache/infrastructure-actions/blob/main/actions.yml), updating each to its current approved version. ## Why The primary driver is `setup-gradle`: - The `v5.0.0` SHA in use across most workflows was **never on the ASF allow-list**. - The `v5.0.2` SHA used in the release workflows **expires from the allow-list on 2026-06-20**. - `gradle/actions` `v6.0.0` moved caching into a proprietary `enhanced` provider governed by [Gradle's commercial Terms of Use](https://gradle.com/legal/terms-of-use/). `v6.1.0` reintroduced an MIT-licensed `basic` cache provider built on `@actions/cache`. Standardizing on the approved **`v6.1.0`** SHA with **`cache-provider: basic`** gets us onto a supported, allow-list-approved version while keeping caching MIT-licensed. Each `cache-provider` line carries an inline comment documenting the MIT-vs-proprietary distinction. ## Changes `setup-gradle` -> `v6.1.0` (approved SHA) + `cache-provider: basic` across all workflows. Other actions bumped to their current ASF-approved versions: | Action | Version | |--------|---------| | `actions/checkout` | `v6.0.2` | | `actions/setup-java` | `v5.2.0` (standardized from mixed v4/v5) | | `actions/cache` | `v5.0.5` | | `actions/download-artifact` | `v8.0.1` (compatible with `upload-artifact` v7.0.1) | | `actions/upload-artifact` | SHA-pinned to `v7.0.1` consistently | | `github/codeql-action` | `v4.36.0` | | `release-drafter/release-drafter` | `v7.3.1` SHA | | `softprops/action-gh-release` | `v3.0.0` SHA | | `nick-fields/retry` | `v4.0.0` SHA | The `grails-forge` GitHub workflow templates received the same `setup-gradle` + `checkout`/`setup-java` updates so generated applications also default to the MIT-licensed cache provider, and `PlainGithubWorkflowSpec` was extended to assert the generated content. ## Verification - Zero stale `gradle/actions` SHAs remain; all references on `v6.1.0`. - All 16 workflow YAML files parse cleanly. - `grails-forge` `PlainGithubWorkflowSpec` passes (4/4, across JDK 17/21/25); rocker templates and test classes compile. This targets `7.0.x` and is intended to be merged forward to the other active branches. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
