CharlieMCY opened a new issue, #19634: URL: https://github.com/apache/druid/issues/19634
### Summary The default branch already hardened `.github/workflows/revised-its.yml` against the issue(s) below, but **5** release branches still carry it. This proposes the same, minimal, scanner-verified fix for each. ### What's flagged (by [zizmor](https://github.com/woodruffw/zizmor)) - `unpinned-uses` — actions referenced by mutable tag/branch instead of a pinned commit SHA Already resolved on the default branch in: - https://github.com/apache/druid/commit/f3fe1773ee275007df68bc31c2131c68ed906045 ### Affected release branches (5) - **`33.0.0`** (still present as of HEAD `a3135039`) - **`34.0.0`** (still present as of HEAD `caa27688`) - **`32.0.1`** (still present as of HEAD `d40b81fe`) - **`31.0.2`** (still present as of HEAD `bdd298e9`) - **`32.0.0`** (still present as of HEAD `10542a76`) ### Suggested per-branch patches Each diff below was checked locally with **zizmor** and **actionlint**: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.) <details> <summary><code>33.0.0</code> — unpinned-uses</summary> File `.github/workflows/revised-its.yml`; suggested edits: - ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA) ```diff --- a/.github/workflows/revised-its.yml +++ b/.github/workflows/revised-its.yml @@ -51,7 +51,7 @@ # the common extension in revised ITs is different from the one in standard ITs common-extensions: ${{ steps.filter.outputs.common-extensions }} steps: - - uses: dorny/[email protected] + - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0 if: github.event_name == 'pull_request' id: filter with: ``` </details> <details> <summary><code>34.0.0</code> — unpinned-uses</summary> File `.github/workflows/revised-its.yml`; suggested edits: - ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA) ```diff --- a/.github/workflows/revised-its.yml +++ b/.github/workflows/revised-its.yml @@ -51,7 +51,7 @@ # the common extension in revised ITs is different from the one in standard ITs common-extensions: ${{ steps.filter.outputs.common-extensions }} steps: - - uses: dorny/[email protected] + - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0 if: github.event_name == 'pull_request' id: filter with: ``` </details> <details> <summary><code>32.0.1</code> — unpinned-uses</summary> File `.github/workflows/revised-its.yml`; suggested edits: - ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA) ```diff --- a/.github/workflows/revised-its.yml +++ b/.github/workflows/revised-its.yml @@ -51,7 +51,7 @@ # the common extension in revised ITs is different from the one in standard ITs common-extensions: ${{ steps.filter.outputs.common-extensions }} steps: - - uses: dorny/[email protected] + - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0 if: github.event_name == 'pull_request' id: filter with: ``` </details> <details> <summary><code>31.0.2</code> — unpinned-uses</summary> File `.github/workflows/revised-its.yml`; suggested edits: - ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA) ```diff --- a/.github/workflows/revised-its.yml +++ b/.github/workflows/revised-its.yml @@ -51,7 +51,7 @@ # the common extension in revised ITs is different from the one in standard ITs common-extensions: ${{ steps.filter.outputs.common-extensions }} steps: - - uses: dorny/[email protected] + - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0 if: github.event_name == 'pull_request' id: filter with: ``` </details> <details> <summary><code>32.0.0</code> — unpinned-uses</summary> File `.github/workflows/revised-its.yml`; suggested edits: - ~ jobs.$J.steps[id=filter].uses : pin(dorny/paths-filter -> target_ref SHA) ```diff --- a/.github/workflows/revised-its.yml +++ b/.github/workflows/revised-its.yml @@ -51,7 +51,7 @@ # the common extension in revised ITs is different from the one in standard ITs common-extensions: ${{ steps.filter.outputs.common-extensions }} steps: - - uses: dorny/[email protected] + - uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0 if: github.event_name == 'pull_request' id: filter with: ``` </details> --- *Happy to open pull requests instead if that's preferred.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
