jamesfredley commented on code in PR #16025:
URL: https://github.com/apache/grails-core/pull/16025#discussion_r3677410203
##########
.github/workflows/gradle.yml:
##########
@@ -547,7 +547,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
##########
.github/workflows/gradle.yml:
##########
@@ -495,7 +495,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
##########
.github/workflows/gradle.yml:
##########
@@ -323,7 +323,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
##########
.github/workflows/gradle.yml:
##########
@@ -242,7 +242,7 @@ jobs:
distribution: 'liberica'
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
##########
.github/workflows/gradle.yml:
##########
@@ -193,7 +193,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Agreed, reverted. Every `actions/*` reference this PR had pinned is back to
its original version reference. `gradle.yml`, `vulnerability-scan.yml`,
`release-close.yml`, and `release-publish-docs.yml` now show no diff at all
against `8.0.x`.
The validator was changed to match the policy rather than fight it:
`RepositoryConventionsTask` now carries `EXEMPT_ACTION_OWNERS = ['actions',
'apache']`, which skips both the 40-hex SHA requirement and the cross-file
SHA-consistency check for those namespaces while still requiring a non-empty
`@ref`. Third-party actions and Docker digests stay enforced. New specs cover
the accept, reject, and trailing-`@` cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
