sbglasius opened a new pull request, #16315: URL: https://github.com/apache/grails-core/pull/16315
## Problem Six workflows on `8.0.x` are failing at **startup**, before any job runs: `CI`, `Coverage`, `Code Analysis`, `End to End`, `Groovy Snapshot Canary`, and `Validate GitHub Actions`. The 7.2.x forward merge fixed the ASF-approved pins it could reach, but a merge cannot carry a fix into a file the source branch does not have. 7.2.x has 29 `setup-gradle` sites; `8.0.x` has 45. The 16 that were missed live in workflows that do not exist on 7.2.x at all — `benchmark`, `codeanalysis`, `coverage`, `end-to-end`, `sitemesh2`, `validate-actions`, `groovy-snapshot-canary` — or in `gradle.yml` jobs added since. `validate-actions.yml` was itself pinned to the unapproved SHA, so the one check that exists to catch this died at startup and could never report it. ## Changes | Action | Before | After | Sites | |---|---|---|---| | `gradle/actions/setup-gradle` | `50e97c2` v6.1.0 — **not approved** | `9c971963` v6.3.0 | 16 | | `actions/cache` | `@v4` floating | `0057852b` v4.3.0 | 3 | | `actions/cache/restore` | `@v4` floating | `0057852b` v4.3.0 | 1 | | `actions/cache/save` | `@v4` floating | `0057852b` v4.3.0 | 4 | | `actions/setup-java` (`release.yml`) | `@v4` floating | `be666c2f` v5.2.0 | 2 | `9c971963` (v6.3.0) is the current approved entry with no expiry date, and matches what 7.0.x, 7.1.x and 7.2.x already use. v6.1.1 is also approved but expires from the allowlist on 2026-09-05. The two `release.yml` `setup-java` refs are the Micronaut JDK 25 switch and the JDK 21 restore. The other three `setup-java` refs in that same file are already pinned to v5.2.0; inputs are unchanged. ## Verification `./gradlew validateActions` — the task that exists for exactly this: - **before:** exit 1, 16 findings - **after:** `[validateActions] Checked 20 workflow file(s) — all compliant`, exit 0 SHAs checked against [`apache/infrastructure-actions/actions.yml`](https://github.com/apache/infrastructure-actions/blob/main/actions.yml) as of 2026-09-04. All workflow YAML parses. ## Note Test sources are never style-checked — both `GrailsCodeStylePlugin` blocks unconditionally disable any task whose name contains `test`, so `grails.code-style.enabled.tests` has no effect even though `GrailsViolationAggregationPlugin` reads it. Unrelated to this PR, but it is why some issues on `8.0.x` went unnoticed; worth its own issue. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
