jamesfredley commented on code in PR #16025:
URL: https://github.com/apache/grails-core/pull/16025#discussion_r3677408470
##########
.github/workflows/gradle.yml:
##########
@@ -950,7 +950,7 @@ jobs:
compression-level: 0 # Already a zip
- name: "🚀 Publish to Github Pages"
if: github.event_name == 'push'
- uses: apache/grails-github-actions/deploy-github-pages@asf
+ uses:
apache/grails-github-actions/deploy-github-pages@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Agreed, reverted. All `apache/grails-github-actions/*` references are back
to `@asf`, and `RepositoryConventionsTask` now exempts the `apache` owner
namespace from the SHA rule, so the gate no longer encodes the opposite of this
decision. A reference with an empty ref is still a violation, but any version
or branch ref is accepted.
##########
.github/workflows/gradle.yml:
##########
@@ -923,7 +923,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
##########
.github/workflows/gradle.yml:
##########
@@ -812,7 +812,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
##########
.github/workflows/gradle.yml:
##########
@@ -694,7 +694,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
##########
.github/workflows/gradle.yml:
##########
@@ -628,7 +628,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
