The GitHub Actions job "CodeQL" on grails-core.git/ci/asf-approved-pins-8.0.x has succeeded. Run started by GitHub user sbglasius (triggered by sbglasius).
Head commit for run: e9cf8b186491c0cb0912e90de610c5e5577f376c / Søren Berg Glasius <[email protected]> ci: pin the remaining actions to ASF-approved SHAs on 8.0.x The 7.2.x forward merge could not reach these. 7.2.x has 29 `setup-gradle` sites; 8.0.x has 45, and 16 of them live in workflows that do not exist on 7.2.x at all (`benchmark`, `codeanalysis`, `coverage`, `end-to-end`, `sitemesh2`, `validate-actions`, `groovy-snapshot-canary`) or in `gradle.yml` jobs added since. A merge cannot carry a fix into a file the source branch does not have, so those kept the unapproved `50e97c2` (v6.1.0) pin and every one of those workflows still failed at startup: CI, Coverage, Code Analysis, End to End, Groovy Snapshot Canary and Validate GitHub Actions - all startup_failure `validate-actions.yml` was itself pinned to the unapproved SHA, so the one check that exists to catch this died at startup and could never report it. - `gradle/actions/setup-gradle` -> `9c971963` (v6.3.0), 16 sites. The current approved entry with no expiry; matches 7.0.x/7.1.x/7.2.x. v6.1.1 is also approved but expires 2026-09-05. - SHA-pin the floating `actions/cache`, `actions/cache/restore` and `actions/cache/save` refs to `0057852b` (v4.3.0). - `actions/setup-java` in `release.yml` (the Micronaut JDK 25 switch and the JDK 21 restore) to `be666c2f` (v5.2.0), matching the three other `setup-java` refs already pinned in that same file. Inputs unchanged. Verified with the task that exists for this: `./gradlew validateActions` fails with exit 1 and these 16 findings before the change, and reports "Checked 20 workflow file(s) - all compliant" after. SHAs checked against apache/infrastructure-actions/actions.yml as of 2026-09-04. Report URL: https://github.com/apache/grails-core/actions/runs/33853306808 With regards, GitHub Actions via GitBox
