Copilot commented on code in PR #11720:
URL: https://github.com/apache/gravitino/pull/11720#discussion_r3428927223
##########
.github/workflows/mcp-integration-test.yml:
##########
@@ -35,7 +35,7 @@ jobs:
mcp_or_authz_changes: ${{ steps.filter.outputs.mcp_or_authz_changes }}
steps:
- uses: actions/checkout@v4
- - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+ - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d
id: filter
Review Comment:
When pinning actions to a raw commit SHA, it becomes harder to audit/upgrade
later. Consider adding an inline comment indicating the corresponding
release/tag (e.g., `# vX.Y.Z`) so future updates can be made confidently while
still complying with the allowlist.
##########
.github/workflows/mcp-integration-test.yml:
##########
@@ -59,7 +59,7 @@ jobs:
java-version: 17
- name: Install uv
- uses: astral-sh/setup-uv@v5
+ uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
Review Comment:
For pinned action SHAs, add an inline comment mapping the SHA back to the
intended major/minor version (e.g., `# v5`). This improves traceability and
reduces the risk of unintentionally changing behavior during future
allowlist-driven repins.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
