potiuk opened a new pull request, #70623: URL: https://github.com/apache/airflow/pull/70623
[apache/infrastructure-actions#1032](https://github.com/apache/infrastructure-actions/pull/1032) added tag-based, per-action releases to that repository — each action is now tagged under its own prefix (`allowlist-check/vX.Y.Z`, `save/vX.Y.Z`, `restore/vX.Y.Z`, plus moving `…/v1` majors). Its recommended consumption is a SHA pin carrying the tag as a comment, which is what Dependabot needs to offer bumps. Our pins predate that. All 16 `stash/save` and `stash/restore` uses sat on `49df447b`, a commit with no version behind it, and `allowlist-check` was pinned to `4e9c961f` with a bare `# main` comment — i.e. tracking whatever main happened to be at the time it was written. This moves all 17 pins to `61dcea11f19e2bbe1263f14d72235e8da17d3ad0`, the commit the initial `v1.0.0` tags of all three actions point at, and names the tag in the comment: ```yaml uses: apache/infrastructure-actions/stash/restore@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # restore/v1.0.0 uses: apache/infrastructure-actions/stash/save@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # save/v1.0.0 uses: apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0 # allowlist-check/v1.0.0 ``` `61dcea11` is 686 commits ahead of the pin it replaces, tipped by the release-automation commit itself: ``` $ gh api repos/apache/infrastructure-actions/compare/49df447b...61dcea11 status: ahead, ahead_by: 686, behind_by: 0 ... Add tag-based, per-action releases (closes #1007) (#1032) ``` Two follow-on details: * **`.github/zizmor.yml`** carried the rationale "apache/infrastructure-actions is branch-tracked (no version tags)", which is no longer true. The `ref-version-mismatch` ignore stays — zizmor matches comments against plain `vX.Y.Z` tags and the prefixed form still reads as a mismatch to it — but the comment now says so. * **Nine pins needed `# yamllint disable-line rule:line-length`.** A 40-character SHA plus the action path already runs to ~100 columns, so any trailing comment crosses the 110 limit. Previously these lines passed only because yamllint's `allow-non-breakable-words` exempts a line that is a single unbreakable token — adding the comment introduces a space and forfeits that. Keeping the comment on the same line is deliberate: Dependabot only reads it there. Nothing about the actions' behaviour changes; this is a pin refresh plus the version metadata that makes future refreshes automatic. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
