Pil0tXia opened a new pull request, #224: URL: https://github.com/apache/eventmesh-dashboard/pull/224
### Motivation The Continuous Integration workflow fails before any build jobs start because ASF policy rejects `gradle/actions/setup-gradle@v3`, as seen in #223. Dependabot metadata and Docker actions also use floating tags that do not match the ASF allowlist. ### Modifications Pin all five external action references in the CI, Dependabot, and Docker workflows to ASF-approved full commit SHAs, with version comments for Dependabot updates: - `gradle/actions/setup-gradle`: v5.0.2 - `dependabot/fetch-metadata`: v3.1.0 - `docker/login-action`: v4.6.0 - `docker/metadata-action`: v6.2.0 - `docker/build-push-action`: v7.3.0 Gradle v5.0.2 is explicitly retained in the ASF allowlist. Existing workflow triggers, build commands, action inputs, and Apache/GitHub-owned action references are preserved. ### Validation - Parsed all four workflow YAML files successfully. - Confirmed all five external references are full SHAs present in the ASF allowlist and their action definitions match the corresponding official tags. - Compared YAML structures: exactly five `uses` values changed; all other values are unchanged. - `git diff --check` passed. - GitHub-hosted execution remains to be verified on this PR. Docker publishing is still triggered only by release tags. ### Documentation No new feature is introduced. This change updates CI action references only; no documentation changes are required. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
