This is an automated email from the ASF dual-hosted git repository.
zeroshade pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg-go.git
The following commit(s) were added to refs/heads/main by this push:
new 1f000b38 CI: Use specific patch versions in workflow action comments
(#1032)
1f000b38 is described below
commit 1f000b3883b4018e1fcc856c3a6895e857d6450f
Author: Kevin Liu <[email protected]>
AuthorDate: Wed May 6 15:34:35 2026 -0400
CI: Use specific patch versions in workflow action comments (#1032)
Similar to https://github.com/apache/iceberg/pull/16229
The workflow files use SHA-pinned actions (immutable), but the
human-readable comments referenced only major versions (e.g., `# v6`, `#
v5`).
**When maintainers move these mutable tags to a new commit, zizmor fails
in CI because the SHA no longer matches the stated tag.**
---
.github/workflows/asf-allowlist-check.yml | 2 +-
.github/workflows/codeql.yml | 2 +-
.github/workflows/go-release-docs.yml | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/asf-allowlist-check.yml
b/.github/workflows/asf-allowlist-check.yml
index 65dbe8bc..8d7952a9 100644
--- a/.github/workflows/asf-allowlist-check.yml
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -40,7 +40,7 @@ jobs:
asf-allowlist-check:
runs-on: ubuntu-24.04
steps:
- - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses:
apache/infrastructure-actions/allowlist-check@4e9c961f587f72b170874b6f5cd4ac15f7f26eb8
# main
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7e9c8208..49212916 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -41,7 +41,7 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
diff --git a/.github/workflows/go-release-docs.yml
b/.github/workflows/go-release-docs.yml
index 4574571d..6f73a855 100644
--- a/.github/workflows/go-release-docs.yml
+++ b/.github/workflows/go-release-docs.yml
@@ -45,7 +45,7 @@ jobs:
persist-credentials: false
- name: Setup mdBook
- uses:
peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2
+ uses:
peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
with:
mdbook-version: '0.4.36'
