This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch bump-infrastructure-actions-tags in repository https://gitbox.apache.org/repos/asf/airflow.git
commit 55d377a701f9128cacc8c59369f455cf3ae54e0a Author: Jarek Potiuk <[email protected]> AuthorDate: Tue Jul 28 15:29:30 2026 +0200 Pin apache/infrastructure-actions to its released tags Until now these pins named a commit with no version behind it, and the allowlist-check one tracked whatever main happened to be. The upstream repository has since started tagging each action under its own prefix, so the pins can name a real release and Dependabot can offer bumps for them the way it already does for every other action. --- .github/actions/install-prek/action.yml | 5 +++-- .github/actions/prepare_breeze_and_image/action.yml | 3 ++- .github/actions/prepare_single_ci_image/action.yml | 3 ++- .github/workflows/asf-allowlist-check.yml | 3 ++- .github/workflows/basic-tests.yml | 10 ++++++---- .github/workflows/ci-image-build.yml | 7 ++++--- .github/workflows/ci-image-checks.yml | 5 +++-- .github/workflows/prod-image-build.yml | 2 +- .github/workflows/publish-docs-to-s3.yml | 5 +++-- .github/zizmor.yml | 7 ++++--- 10 files changed, 30 insertions(+), 20 deletions(-) diff --git a/.github/actions/install-prek/action.yml b/.github/actions/install-prek/action.yml index ad592947586..6db0308c8b9 100644 --- a/.github/actions/install-prek/action.yml +++ b/.github/actions/install-prek/action.yml @@ -70,7 +70,8 @@ runs: echo shell: bash - name: "Restore prek cache" - uses: apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec + # yamllint disable-line rule:line-length + uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: # yamllint disable rule:line-length key: cache-prek-v9-${{ inputs.platform }}-python${{ inputs.python-version }}-uv${{ steps.versions.outputs.uv-version }}-${{ hashFiles('**/.pre-commit-config.yaml') }} @@ -119,7 +120,7 @@ runs: shell: bash if: inputs.save-cache == 'true' - name: "Save prek cache" - uses: apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec + uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 with: # yamllint disable rule:line-length key: cache-prek-v9-${{ inputs.platform }}-python${{ inputs.python-version }}-uv${{ steps.versions.outputs.uv-version }}-${{ hashFiles('**/.pre-commit-config.yaml') }} diff --git a/.github/actions/prepare_breeze_and_image/action.yml b/.github/actions/prepare_breeze_and_image/action.yml index 6e6c4efd205..ce4367f97cc 100644 --- a/.github/actions/prepare_breeze_and_image/action.yml +++ b/.github/actions/prepare_breeze_and_image/action.yml @@ -57,7 +57,8 @@ runs: echo "Checking free space!" df -H - name: "Restore ${{ inputs.image-type }} docker image ${{ inputs.platform }}:${{ inputs.python }}" - uses: apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec + # yamllint disable-line rule:line-length + uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: key: ${{ inputs.image-type }}-image-save-v3-${{ inputs.platform }}-${{ inputs.python }} path: "/mnt/" diff --git a/.github/actions/prepare_single_ci_image/action.yml b/.github/actions/prepare_single_ci_image/action.yml index 3608901015d..d70012c80f7 100644 --- a/.github/actions/prepare_single_ci_image/action.yml +++ b/.github/actions/prepare_single_ci_image/action.yml @@ -36,7 +36,8 @@ runs: using: "composite" steps: - name: "Restore CI docker images ${{ inputs.platform }}:${{ inputs.python }}" - uses: apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec + # yamllint disable-line rule:line-length + uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: key: ci-image-save-v3-${{ inputs.platform }}-${{ inputs.python }} path: "/mnt/" diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index 951d5b0d17a..058c5aca453 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -31,4 +31,5 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: apache/infrastructure-actions/allowlist-check@4e9c961f587f72b170874b6f5cd4ac15f7f26eb8 # main + # yamllint disable-line rule:line-length + - uses: apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # allowlist-check/v1.0.0 diff --git a/.github/workflows/basic-tests.yml b/.github/workflows/basic-tests.yml index 9b8f1699747..b1f41b50cbc 100644 --- a/.github/workflows/basic-tests.yml +++ b/.github/workflows/basic-tests.yml @@ -203,7 +203,8 @@ jobs: cache: 'pnpm' cache-dependency-path: 'airflow-core/src/airflow/**/pnpm-lock.yaml' - name: "Restore eslint cache (ui)" - uses: apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec + # yamllint disable-line rule:line-length + uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: path: airflow-core/src/airflow/ui/node_modules/ # yamllint disable-line rule:line-length @@ -214,7 +215,7 @@ jobs: env: FORCE_COLOR: 2 - name: "Save eslint cache (ui)" - uses: apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec + uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 with: path: airflow-core/src/airflow/ui/node_modules/ key: cache-ui-node-modules-v1-${{ runner.os }}-${{ hashFiles('airflow/ui/**/pnpm-lock.yaml') }} @@ -222,7 +223,8 @@ jobs: retention-days: '2' if: steps.restore-eslint-cache-ui.outputs.stash-hit != 'true' - name: "Restore eslint cache (simple auth manager UI)" - uses: apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec + # yamllint disable-line rule:line-length + uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: path: airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui/node_modules/ key: > @@ -234,7 +236,7 @@ jobs: env: FORCE_COLOR: 2 - name: "Save eslint cache (ui)" - uses: apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec + uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 with: path: airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui/node_modules/ key: > diff --git a/.github/workflows/ci-image-build.yml b/.github/workflows/ci-image-build.yml index e7c644568a6..8be55c73d10 100644 --- a/.github/workflows/ci-image-build.yml +++ b/.github/workflows/ci-image-build.yml @@ -137,7 +137,8 @@ jobs: - name: "Install Breeze" uses: ./.github/actions/breeze - name: "Restore ci-cache mount image ${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}" - uses: apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec + # yamllint disable-line rule:line-length + uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}" path: "/tmp/" @@ -194,7 +195,7 @@ jobs: run: breeze ci-image save --platform "${PLATFORM}" --image-file-dir "/mnt" if: inputs.upload-image-artifact == 'true' - name: "Stash CI docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}" - uses: apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec + uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 with: key: ci-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }} path: "/mnt/ci-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar" @@ -209,7 +210,7 @@ jobs: --cache-file /tmp/ci-cache-mount-save-v3-${PYTHON_MAJOR_MINOR_VERSION}.tar.gz if: inputs.upload-mount-cache-artifact == 'true' - name: "Stash cache mount ${{ inputs.platform }}:${{ env.PYTHON_MAJOR_MINOR_VERSION }}" - uses: apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec + uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 with: key: "ci-cache-mount-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }}" path: "/tmp/ci-cache-mount-save-v3-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar.gz" diff --git a/.github/workflows/ci-image-checks.yml b/.github/workflows/ci-image-checks.yml index 36fe649bd9c..b44230da7c8 100644 --- a/.github/workflows/ci-image-checks.yml +++ b/.github/workflows/ci-image-checks.yml @@ -206,7 +206,8 @@ jobs: use-uv: ${{ inputs.use-uv }} make-mnt-writeable-and-cleanup: true - name: "Restore docs inventory cache" - uses: apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec + # yamllint disable-line rule:line-length + uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: path: ./generated/_inventory_cache/ key: cache-docs-inventory-v1 @@ -322,7 +323,7 @@ jobs: env: SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} - name: "Save docs inventory cache" - uses: apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec + uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 with: path: ./generated/_inventory_cache/ key: cache-docs-inventory-v1 diff --git a/.github/workflows/prod-image-build.yml b/.github/workflows/prod-image-build.yml index cc0f52c1d70..d4620181bc0 100644 --- a/.github/workflows/prod-image-build.yml +++ b/.github/workflows/prod-image-build.yml @@ -284,7 +284,7 @@ jobs: breeze prod-image save --platform "${PLATFORM}" --image-file-dir "/mnt" if: inputs.upload-image-artifact == 'true' - name: "Stash PROD docker image ${{ env.PYTHON_MAJOR_MINOR_VERSION }}" - uses: apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec + uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 with: key: prod-image-save-v3-${{ inputs.platform }}-${{ env.PYTHON_MAJOR_MINOR_VERSION }} path: "/mnt/prod-image-save-*-${{ env.PYTHON_MAJOR_MINOR_VERSION }}.tar" diff --git a/.github/workflows/publish-docs-to-s3.yml b/.github/workflows/publish-docs-to-s3.yml index 9b27edc1669..fec54207019 100644 --- a/.github/workflows/publish-docs-to-s3.yml +++ b/.github/workflows/publish-docs-to-s3.yml @@ -317,7 +317,8 @@ jobs: -t "ghcr.io/apache/airflow/main/ci/python${PYTHON_MAJOR_MINOR_VERSION}:latest" --target main . -f Dockerfile.ci --platform linux/amd64 - name: "Restore docs inventory cache" - uses: apache/infrastructure-actions/stash/restore@49df447b39b18354895520e0a63731b7cad7cbec + # yamllint disable-line rule:line-length + uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 with: path: ./generated/_inventory_cache/ key: cache-docs-inventory-v1 @@ -347,7 +348,7 @@ jobs: breeze build-docs ${SPHINX_INCLUDE_DOCS} --docs-only ${FAIL_ON_INVENTORIES} fi - name: "Save docs inventory cache" - uses: apache/infrastructure-actions/stash/save@49df447b39b18354895520e0a63731b7cad7cbec + uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 if: >- steps.restore-docs-inventory-cache.outputs.stash-hit != 'true' && steps.build-sphinx-docs.outputs.sphinx-build-skipped != 'true' diff --git a/.github/zizmor.yml b/.github/zizmor.yml index da6ed9b6d88..0eaeb5a1314 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -19,9 +19,10 @@ rules: secrets-outside-env: disable: true - # apache/infrastructure-actions is branch-tracked (no version tags); we pin it - # by commit SHA with a "# main" comment on purpose, so zizmor's expectation of a - # version-matching comment does not apply to that pin. + # apache/infrastructure-actions tags each action under its own prefix + # (allowlist-check/vX.Y.Z, save/vX.Y.Z, restore/vX.Y.Z), so its pins now carry a real + # version comment. zizmor matches comments against plain `vX.Y.Z` tags, so the prefixed + # form still reads as a mismatch to it. ref-version-mismatch: ignore: - asf-allowlist-check.yml
