jamesfredley commented on code in PR #16025:
URL: https://github.com/apache/grails-core/pull/16025#discussion_r3677923074
##########
.github/workflows/release-close.yml:
##########
@@ -45,7 +45,7 @@ jobs:
ref: ${{ env.TAG }}
token: ${{ secrets.GITHUB_TOKEN }}
- name: "⚙️ Run post-release"
- uses: apache/grails-github-actions/post-release@asf
+ uses:
apache/grails-github-actions/post-release@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Addressed in `7a0aceb5ff`. First-party `actions/*` and
`apache/grails-github-actions/*` are back on version/branch refs (no SHA pins).
`RepositoryConventionsTask` exempts those namespaces from the 40-hex rule.
##########
.github/workflows/groovy-joint-workflow.yml:
##########
@@ -105,7 +105,7 @@ jobs:
runs-on: ubuntu-latest
services:
mongodb:
- image: mongo:8
+ image:
mongo@sha256:951c2ff9fc6bdb6cb89b1dfea4a0e8ae3ee4fb287c0bf579b2bba54c7803f75d #
mongo:8
Review Comment:
Third-party action pins remain intentional. Dependabot for action digests is
a follow-up if we want automated bump PRs; not required for this conventions PR.
##########
.github/workflows/gradle.yml:
##########
@@ -950,7 +950,7 @@ jobs:
compression-level: 0 # Already a zip
- name: "🚀 Publish to Github Pages"
if: github.event_name == 'push'
- uses: apache/grails-github-actions/deploy-github-pages@asf
+ uses:
apache/grails-github-actions/deploy-github-pages@fe90f651c47c5230cdd70b6fee0e0d250fea30ac
# asf
Review Comment:
Addressed in `7a0aceb5ff`. First-party `actions/*` and
`apache/grails-github-actions/*` are back on version/branch refs (no SHA pins).
`RepositoryConventionsTask` exempts those namespaces from the 40-hex rule.
##########
.github/workflows/gradle.yml:
##########
@@ -923,7 +923,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -812,7 +812,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -694,7 +694,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -628,7 +628,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -547,7 +547,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -495,7 +495,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -323,7 +323,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
